Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@io.github.neogeweb3/code-health-suite run a full health check on my codebase"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
16 analysis engines, 28 MCP tools for Python code quality. Zero external dependencies.
{
"mcpServers": {
"code-health": {
"command": "code-health-suite"
}
}
}pip install code-health-suiteOr with uvx (no install needed):
uvx code-health-suitepip install git+https://github.com/nge/code-health-suiteRelated MCP server: MCP Code Analysis & Quality Server
# | Tool | Engine | What it does |
1 |
| complexity | Per-function CC, cognitive complexity, nesting, grades |
2 |
| complexity | Project health score 0-100 |
3 |
| dead-code | Unused imports, functions, variables, arguments |
4 |
| security | OWASP vulns, CWE-mapped findings |
5 |
| security | Security health score 0-100 |
6 |
| import-graph | Import dependency graph, circular deps |
7 |
| import-graph | Import architecture score 0-100 |
8 |
| clone-detect | Type-1/2/3 code clone detection |
9 |
| test-quality | Test suite metrics, anti-patterns |
10 |
| all engines | Combined report with overall grade |
11 |
| hotspot | Files with high git churn AND high complexity |
12 |
| hotspot | Project churn-complexity score |
13 |
| dep-audit | Outdated/vulnerable dependency check |
14 |
| change-impact | Blast radius of file changes |
15 |
| change-impact | Module coupling metrics |
16 |
| type-audit | Type annotation coverage |
17 |
| type-audit | Type coverage score 0-100 |
18 |
| env-audit | Environment variable audit |
19 |
| git-audit | Commit quality audit (security + complexity) |
20 |
| git-audit | Git commit health score |
Python 3.10+
Zero external dependencies (stdlib only)
MIT
Analyze the ripple effect of changing specific files. Shows direct dependents, transitive impact, affected tests, and an impact score (fraction of project affected). Use before refactoring to understand blast radius.
Inputs: path (required), changed_files (required), max_depth.
Analyze Python code complexity for a file or directory. Returns per-function metrics: cyclomatic complexity (McCabe), cognitive complexity, nesting depth, function length, and letter grades (A-F).
Inputs: path (required), top, sort_by, threshold.
Analyze module coupling metrics: afferent coupling (Ca), efferent coupling (Ce), instability (Ce/(Ca+Ce)), and hub scores. Identifies tightly-coupled modules that may resist change.
Inputs: path (required).
Analyze Python import dependency graph. Returns module metrics, circular dependencies (cycles), orphan modules, hub modules, and instability scores. Use to understand project architecture.
Inputs: path (required).
Analyze test suite quality: assertion density, test length, naming conventions, magic numbers, and more. Returns per-file and per-test metrics with a quality score (0-100) and grade.
Inputs: path (required), max_length.
Analyze Python type annotation coverage: function signatures, parameters, return types, Any usage, and type: ignore comments. Returns per-file metrics and coverage percentages.
Inputs: path (required).
Audit Python project dependencies for outdated packages and known vulnerabilities. Reads requirements.txt and/or pyproject.toml. Returns per-dependency status, latest versions, and CVE/vulnerability details.
Inputs: path (required).
Audit Python docstring coverage and quality. Checks public functions, methods, classes, and modules for missing or low-quality docstrings. Returns per-entity coverage, missing docstrings, and quality issues.
Inputs: path (required).
Audit environment variable usage: find undefined vars referenced in code, unused vars in .env files, secrets in templates, and missing .env.example entries. Supports Python, JavaScript, and shell scripts.
Inputs: path (required).
Audit recent git commits in a repository. Extracts changed files and runs static analysis (security scan, complexity) on each commit. Returns per-commit grades, security findings, and complexity violations.
Inputs: repo (required), since, author, commits, +2 more.
Check Python naming conventions (PEP 8). Detects violations: functions/methods must be snake_case, classes must be CamelCase, constants must be UPPER_SNAKE_CASE. Returns violations with suggestions.
Inputs: path (required).
Detect common Python semantic bugs using AST analysis. Finds 8 categories: missing f-strings, mutable class variables, late-binding closures, call-expression defaults (datetime.now()), mutable default arguments, assert-on-tuple, unreachable code, and unreachable exception handlers. Every finding indicates a likely real bug, not a style violation.
Inputs: path (required), rules, min_severity.
Detect code clones (duplicated code blocks) in a Python project. Finds Type-1 (exact), Type-2 (renamed), and Type-3 (near-miss) clones. Returns clone pairs with similarity scores and cluster analysis.
Inputs: path (required), min_lines, threshold.
Detect unused imports, functions, variables, and arguments in Python code. Supports cross-module analysis to reduce false positives.
Inputs: path (required), category, min_severity.
Find code hotspots — files with high git churn AND high complexity. These are the riskiest files in a project: frequently changed AND hard to understand. Requires a git repository. Returns hotspot scores, risk levels, and churn/complexity breakdown.
Inputs: path (required), top, since_days.
Run all analyses (complexity + dead code + security + imports + clones + test quality + type coverage + env audit + naming + TODO debt + bug detection + docstring coverage) on a Python project and return a combined health report with scores, grades, and top issues. Note: hotspot, dependency, and change impact require additional context (git repo, requirements files, changed files) so are excluded from this scan.
Inputs: path (required).
Get a bug detection health score (0-100) with grade (A-F), bug profile classification (clean/fstring_heavy/closure_heavy/etc.), and breakdown by rule and severity. Quick bug health check.
Inputs: path (required).
Get an overall complexity health score (0-100) with letter grade (A-F), complexity profile classification, and top offenders. Quick project health check.
Inputs: path (required).
Get a docstring coverage health score (0-100) with grade. Measures what percentage of public entities have docstrings and penalizes low-quality docstrings. Shows worst files.
Inputs: path (required).
Get a quick overall grade and score for recent commits in a repo. Returns the aggregate score, grade, commit count, and security summary.
Inputs: repo (required), commits.
Get overall hotspot health score (0-100) with grade. Measures concentration of risk (churn x complexity). Lower scores indicate more hotspots that need attention.
Inputs: path (required).
Get an import graph health score (0-100) with grade. Penalizes circular dependencies, orphan modules, unstable modules, and hub concentration. Quick architecture health check.
Inputs: path (required).
Get a naming convention health score (0-100) with grade. Measures PEP 8 naming compliance: snake_case functions, CamelCase classes, UPPER_SNAKE_CASE constants.
Inputs: path (required).
Get an overall security health score (0-100) with grade, profile, and top vulnerability rules. Quick security posture assessment.
Inputs: path (required).
Get a technical debt health score (0-100) with grade based on density and severity of TODO/FIXME/HACK markers. Shows hotspot files.
Inputs: path (required).
Get overall type coverage health score (0-100) with grade. Measures annotation completeness, Any usage, and type: ignore density.
Inputs: path (required).
Scan source code for technical debt markers: TODO, FIXME, HACK, XXX, BUG, NOTE, OPTIMIZE, REFACTOR comments. Returns items with file, line, tag, severity, and message. Optionally enriches with git blame metadata.
Inputs: path (required), tag, blame, severity.
Scan Python code for security vulnerabilities: command injection, SQL injection, path traversal, hardcoded secrets, unsafe deserialization, XSS, and more. Maps findings to CWE identifiers.
Inputs: path (required).
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 28 tools
Most tools are clearly separated by domain and by the detail-vs-score pattern (e.g., security_scan vs. get_security_score). The main ambiguity is between analyze_imports and analyze_coupling, which both report instability and hub-like module metrics, so an agent could pick the wrong one for architecture analysis.
The server uses a consistent snake_case verb_noun convention, and the get_*_score tools form a recognizable summary pattern. However, verb choice varies across analyze/find/audit/scan/check/detect, and get_import_health and full_health_check break the get_*_score pattern, creating minor inconsistency.
At 28 tools, the server exceeds the comfortable range and will likely burden agent selection. The high count is understandable given the detail-plus-score pairing across many health dimensions, but it still feels oversized for a single MCP server.
The suite covers an impressively broad set of Python code-health domains: complexity, security, imports, clones, tests, types, naming, todos, bugs, docstrings, dependencies, hotspots, env vars, and git history. Minor gaps include no actual test coverage percentage and no aggregate score for dead code or clone analysis.
30+ deterministic dev and delivery tools: linting, metrics, diagrams, model advice, AI-text checks.
AI-powered codebase analysis — call graphs, security, dead code, complexity. 150+ tools.
Free MCP tools: the only MCP linter, health checks, cost estimation, and trust evaluation.
Code intelligence platform for AI agents. 20 tools for architecture, security & impact analysis.
