context-ops-mcp

Gives your AI coding agent a bounded map of an unfamiliar TypeScript SaaS repo: where the code lives, what's risky to touch, and where the money / auth / user flows are. Without burning your context window on full-file reads.

Built for the agency, fractional-CTO, or consultancy dev lead who just inherited a TypeScript SaaS codebase and needs to go from zero to a credible map in one afternoon, inside Cursor or Claude Code.

What it does

Eight MCP tools your agent calls locally. All heuristic. Regex over file heads, filename rules, and one whole-file streaming pass in the relevance ranker. No AST. No type checker. No call graph.

• Orientation: structure, top-of-file symbol hints, entry points, config files

• Task focus: ranked candidate files for a task string, plus a step-ordered plan

• Risk: files that often deserve extra care before edits

• SaaS smells: observation-only flags for billing, auth, security patterns, debt markers, and risky deps

Related MCP server: RepoMap

MCP tools exposed

What it will not claim

• Not an audit, diagnosis, or analysis. The smell tool returns presence checks, not verdicts.

• No /100 scores. No hour estimates on remediation.

• No UI-layer claims. This reads code structure, not UX or conversion.

• No AST, type-checker, or call-graph promises.

• A determined engineer rebuilds the orientation core in an afternoon with grep and tree. The differentiator is MCP wiring, task-string ranking, and prose-narrated read order, not capability you cannot have.

Stack

TypeScript · MCP SDK · Node.js · stdio transport

Run locally

npm install
npm run build
npm run start

Wire it into Cursor or Claude Code as a local MCP server (stdio). No API keys required.

Built by

AboJad, Full Stack AI Engineer, Marrakesh

Secrets & API keys

Standing rule: one named API key per project per environment, living in exactly one location, never copied between projects. Give each environment its own distinctly named key (e.g. contextops-dev, contextops-prod) so rotating means replacing a single copy with none left to go stale. The recurring Anthropic key "exposures" across these repos were one key hand-copied between consumers, not a leak.

• Local secrets live only in .env.local / .env (gitignored), never in a committed file.

• Deployed secrets live only in the host env store (Vercel / Railway / etc.).

• A pre-commit secrets scan (scripts/secrets_scan.py) blocks accidental commits; install it once per clone with powershell -ExecutionPolicy Bypass -File scripts/install_hooks.ps1.