Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@DevLens MCP What files break if I change src/auth/session.ts, and how risky is it?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
DevLens MCP is a high-performance, security-hardened Model Context Protocol (MCP) server engineered for AI coding agents (Claude, Cursor, Cline, Windsurf). It performs zero-execution, AST-based static analysis, symbol location, dependency tracing, change impact analysis, and risk assessment on TypeScript and JavaScript codebases.
analyze_project: High-level structural scan, entry points, module systems, and tech stack detection.
find_symbol: Precise location of classes, functions, interfaces, and types across the entire project.
trace_dependencies: Deep dependency tree analysis with import/export resolution and circular dependency detection.
analyze_impact: Calculates the exact blast radius and affected files before modifying a target file.
detect_dead_code: Identifies unreferenced symbols, orphan files, and unreachable exports.
assess_change_risk: Evaluates cyclomatic complexity, blast radius, and test coverage to assign risk scores (LOW/MEDIUM/HIGH/CRITICAL).
get_project_context: Compact, token-optimized codebase summary designed specifically for LLM context windows.
get_project_diagnostics: Aggregates architectural warnings, circular imports, and deep inheritance trees.
Related MCP server: Semantic JS MCP
Path Traversal Protection: Enforces strict canonical path verification against the designated workspace root; rejects null-bytes, relative symlink escapes, and directory climbing attempts.
Credential & Secret Redaction: Automatically suppresses .env*, id_rsa, .pem, and hidden secrets from scanning indices.
Zero-Execution Static AST: Uses TypeScript compiler APIs strictly in passive inspection mode—no arbitrary code execution.
npx devlens-mcp /path/to/your/projectIdentify files affected by modifying a target module (blast radius).
Inputs: filePath (required).
Map project structure, detect frameworks, package manager, and language distribution.
Inputs: no named parameters.
Assess modification risk (LOW/MEDIUM/HIGH/CRITICAL) using complexity and dependency signals.
Inputs: filePath (required).
Identify unreferenced exports within the project.
Inputs: no named parameters.
Locate functions, classes, interfaces, types, and variables across the project.
Inputs: name (required), exactMatch.
Return concise, token-optimized project context for AI coding agents.
Inputs: no named parameters.
Report broken imports and circular dependency loops.
Inputs: no named parameters.
Trace incoming, outgoing, and external dependencies of a file.
Inputs: filePath (required).
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 8 tools
Most tools target clearly distinct analysis concerns (symbol lookup, dependency tracing, dead code, diagnostics). However, analyze_project vs get_project_context overlap in returning project-level information, and analyze_impact vs assess_change_risk are closely related, though their descriptions (blast radius vs risk rating) help differentiate.
All eight tools follow a consistent snake_case verb_noun pattern (analyze_project, find_symbol, trace_dependencies, detect_dead_code, assess_change_risk, get_project_context, get_project_diagnostics). Verb variation (analyze/find/trace/detect/assess/get) is intentional and readable rather than inconsistent.
Eight tools is well within the ideal 3-15 range. Each tool maps to a distinct analysis capability (structure, symbols, dependencies, impact, dead code, risk, context, diagnostics) with no redundant entries.
The surface covers a broad code-intelligence lifecycle: structure mapping, symbol search, dependency tracing, impact/risk assessment, diagnostics, and context generation. Minor gaps exist, such as a dedicated find-references or file-content retrieval operation, but agents can work around these via existing tools.
Code intelligence platform for AI agents. 20 tools for architecture, security & impact analysis.
Stateless TS/JS compiler facts for agents: references, imports, impact. No repo index or OAuth.
Codebase intelligence for AI agents — dead code, blast radius, ownership.
Code intelligence for coding agents: semantic, AST, graph, and full-text search. 279+ languages.
