FullStack Audit MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| scan_projectB | Discover project manifests, frameworks, source file inventory, and skipped-file counts under the configured workspace. Read-only. Use path only as a relative subdirectory; results are paginated. |
| analyze_codeB | Run bounded local heuristics over supported source files. Returns evidence-based possible defects and security risks without executing repository code. Findings are not a guarantee of correctness or completeness. |
| review_frontendC | Review discovered frontend source for selected UI behavior and rendering risks. Static heuristics only; verify context and data sanitization. |
| review_backendB | Review supported backend source for likely route authorization, query construction, error handling, and configuration risks. Middleware can live elsewhere, so heuristic results require verification. |
| trace_integrationB | List statically recognizable frontend request calls and backend Express-style route declarations with file and line evidence. For literal matching paths, report simple request-field mismatches when the same-line JSON object and route body reads are visible. This does not resolve dynamic URLs or prove a route is connected. |
| review_securityA | Check for credential-shaped source values, dynamic code execution, raw HTML insertion, and selected backend risks. Secret file contents are never read or returned. This is not a full security audit. |
| review_testsC | Discover common test files and identify when none are found. Does not run project tests, install packages, or execute scripts. |
| generate_audit_reportB | Generate a bounded Markdown or JSON audit report in the tool response. No file is written. Findings include evidence and uncertainty; source contents and secret values are not included. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 8 tools
Each tool targets a distinct audit phase: discovery, generic heuristics, frontend/backend/security/test reviews, integration tracing, and reporting. The only soft overlap is analyze_code versus the domain-specific reviews (review_security, review_frontend/backend), which all run static heuristics over source, so an agent could be unsure when to use the generic analyzer versus a targeted review. Descriptions mostly clarify these boundaries.
All eight tools follow a clean verb_noun snake_case pattern (scan_project, analyze_code, review_frontend, generate_audit_report, etc.). The verb prefixes (scan/analyze/review/trace/generate) map predictably to the action performed.
Eight tools is well-scoped for a static audit server, with each tool covering a coherent slice of the pipeline from discovery through reporting. No tool feels redundant or like filler.
The surface covers the full audit lifecycle: discovery, code analysis, frontend/backend/security/test review, integration tracing, and reporting. Minor gaps exist, such as no dependency/package vulnerability audit and no remediation guidance, but these are reasonable for a read-only static analyzer.