Skip to main content
Glama
Sign In
FullStack Audit MCP

FullStack Audit MCP

by hlwhkw123123-sudo
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Local

FullStack Audit MCP

FullStack Audit MCP is a read-only local MCP server for evidence-based review of supported software projects. It gives an AI coding agent a bounded inventory and static-analysis findings; the AI agent adds semantic reasoning. Neither layer can prove that a project is defect-free or secure.

Features

  • Eight focused MCP tools for project discovery, code review, integration tracing, security, tests, and reports.

  • Local-only analysis: no source code, secrets, or reports are sent to an external AI service by this server.

  • Workspace-root enforcement, safe symlink skipping, size/file limits, default generated-file exclusions, secret-file skipping, and secret-value redaction.

  • Findings include type, severity, category, location, evidence, confidence, and suggested fix.

  • Markdown and JSON reports are returned in the tool response; files are never written.

  • Repository scripts, migrations, tests, and build commands are never executed.

Related MCP server: RepoMind

Requirements

  • Node.js 20 or newer.

  • Google Antigravity IDE, CLI, or another MCP host that supports local stdio servers.

Install

After publication, install with npx -y fullstack-audit-mcp. The package name is a local candidate until npm registry availability and ownership are verified. Until then, run from a source checkout: npm install followed by npm run build.

Antigravity setup

Antigravity uses a JSON mcpServers object for local stdio servers. See docs/antigravity-setup.md for the verified file locations, a beginner walkthrough, reload instructions, and troubleshooting.

First audit

  1. Open the project you want reviewed as the Antigravity workspace.

  2. Add the local stdio server config shown in the setup guide.

  3. Reload MCP servers and confirm that the eight FullStack Audit tools appear.

  4. Ask the agent: “Run scan_project, then review the frontend, backend, security, and tests. Cite file and line evidence, label uncertainty, and do not modify files.”

  5. Ask: “Generate a Markdown audit report and summarize the three highest-priority findings.”

Useful additional prompt: “Use trace_integration to compare frontend requests with backend routes. Call out dynamic URLs or routes you could not prove are connected.”

Example finding

HIGH · security risk · authorization · src/routes.ts:14
Possible authorization gap on a sensitive-looking route.
Evidence: The route resembles an account endpoint; no common authorization marker was found in this file. Middleware may be defined elsewhere.
Confidence: low
Suggested fix: Trace middleware and enforce authentication plus resource-level authorization.

This example illustrates the report shape; actual findings must come from a project scan.

Supported frameworks

The initial analyzers recognize JavaScript and TypeScript projects, including React, Next.js, Vite, Express, and NestJS manifests. The scanner can inspect common source/configuration formats in Python, Go, Rust, Java, PHP, Ruby, C#, Vue, Svelte, SQL, GraphQL, and related files, but framework-specific semantic checks for those ecosystems are limited or absent. See docs/supported-frameworks.md.

Security limits

This tool is a static heuristic reviewer, not a substitute for expert review, dependency advisory scanning, runtime testing, or threat modeling. It does not run npm audit or query an external vulnerability feed. It does not load project scripts. Files under standard dependency/build directories and sensitive credential files are excluded. Findings can be false positives or misses. Never interpret an empty report as proof of safety. Details: docs/security.md.

Troubleshooting and contributing

See docs/troubleshooting.md, docs/development.md, and CONTRIBUTING.md.

License

MIT. See LICENSE.

Available Tools

8 tools
analyze_codeB

Run bounded local heuristics over supported source files. Returns evidence-based possible defects and security risks without executing repository code. Findings are not a guarantee of correctness or completeness.

Inputs: path, limit, offset.

generate_audit_reportB

Generate a bounded Markdown or JSON audit report in the tool response. No file is written. Findings include evidence and uncertainty; source contents and secret values are not included.

Inputs: path, limit, format.

review_backendB

Review supported backend source for likely route authorization, query construction, error handling, and configuration risks. Middleware can live elsewhere, so heuristic results require verification.

Inputs: path, limit, offset.

review_frontendC

Review discovered frontend source for selected UI behavior and rendering risks. Static heuristics only; verify context and data sanitization.

Inputs: path, limit, offset.

review_securityA

Check for credential-shaped source values, dynamic code execution, raw HTML insertion, and selected backend risks. Secret file contents are never read or returned. This is not a full security audit.

Inputs: path, limit, offset.

review_testsC

Discover common test files and identify when none are found. Does not run project tests, install packages, or execute scripts.

Inputs: path, limit, offset.

scan_projectB

Discover project manifests, frameworks, source file inventory, and skipped-file counts under the configured workspace. Read-only. Use path only as a relative subdirectory; results are paginated.

Inputs: path, limit, offset.

trace_integrationB

List statically recognizable frontend request calls and backend Express-style route declarations with file and line evidence. For literal matching paths, report simple request-field mismatches when the same-line JSON object and route body reads are visible. This does not resolve dynamic URLs or prove a route is connected.

Inputs: path, limit, offset.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Deploy Server
    Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

    TDQS

    B3.4/5.0

    Scored across 8 tools

    Disambiguation4/5

    Each tool targets a distinct audit phase: discovery, generic heuristics, frontend/backend/security/test reviews, integration tracing, and reporting. The only soft overlap is analyze_code versus the domain-specific reviews (review_security, review_frontend/backend), which all run static heuristics over source, so an agent could be unsure when to use the generic analyzer versus a targeted review. Descriptions mostly clarify these boundaries.

    Naming Consistency5/5

    All eight tools follow a clean verb_noun snake_case pattern (scan_project, analyze_code, review_frontend, generate_audit_report, etc.). The verb prefixes (scan/analyze/review/trace/generate) map predictably to the action performed.

    Tool Count5/5

    Eight tools is well-scoped for a static audit server, with each tool covering a coherent slice of the pipeline from discovery through reporting. No tool feels redundant or like filler.

    Completeness4/5

    The surface covers the full audit lifecycle: discovery, code analysis, frontend/backend/security/test review, integration tracing, and reporting. Minor gaps exist, such as no dependency/package vulnerability audit and no remediation guidance, but these are reasonable for a read-only static analyzer.

    Maintenance

    ActivityMaintained
    ResponsivenessOutdated data

    Resources

    Related MCP Connectors

    Related MCP Servers

    • RepoMind

      TaherFetoui
      A
      license
      Not graded
      quality
      C
      maintenance
      Enables AI coding assistants to inspect local and remote repositories through sandboxed tools that surface project overviews, structure, dependency audits, Git churn hotspots, and a heuristic health score. It also supports safe GitHub issue searching and creation with built-in duplicate preflight checks, while blocking sensitive files, binary content, and path traversal attacks.
      22 npm
      MIT

    • codebase-doctor

      subhajitlucky
      A
      license
      A
      quality
      B
      maintenance
      Evidence-backed, read-only codebase diagnostics for coding agents: secrets, dependency, RLS, and source-impact audits with a verify loop and PR review verdicts. Never writes files or uses the network by default.
      7
      114 npm
      MIT

    • ChaiChai

      17lijunyi
      A
      license
      Not graded
      quality
      B
      maintenance
      Enables AI clients to inspect local software structure, code, and runtime behavior through evidence-backed analysis, including sources, coverage, and limitations.
      1
      MIT