A
licenseNot graded
qualityC
maintenanceEnables automated code review and GitHub PR commenting through MCP integration.
457 npm
9
MIT
safe-fix-mcp
by pamela-0
Allows to propose removal pull requests for dead code (unused imports) on GitHub, after verifying the test suite passes.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@safe-fix-mcpscan repo for dead code and propose safe PR for unused imports"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
safe-fix-mcp
A real MCP server that finds dead code in a Python repository and proposes a branch + PR for the one class of finding that's actually safe to auto-remove: unused imports on a single-name import line. Everything else it finds — unused functions, classes, unused dependencies — stays report-only. A human always merges. This tool never merges anything itself.
Why this exists
Most "dead code" tools stop at reporting. The ones that go further usually delete with no safety net. This does neither: it drafts a real, minimal, reviewable PR, gated on the target repo's own full test suite actually passing after the removal — not a heuristic, a real pytest run. If the suite fails, nothing is committed or pushed; the repo is left exactly as it started.
Related MCP server: Python Code Guardian MCP Server
Tools
scan_dead_code(repo_path=".", min_confidence=60)
Read-only. Runs vulture (dead code) and deptry (dependency issues) and returns a human-readable list of findings. Never modifies anything.
propose_removal_pr(repo_path=".")
Refuses on a dirty working tree — never edits on top of uncommitted work.
Filters to unused imports at ≥90% vulture confidence, on single-name import lines only (
from x import y, zis skipped — removing the whole line would silently removeztoo).Creates a real branch, removes the qualifying imports, runs the repo's real full test suite.
Only on a real pass: commits, pushes, and tries to open a PR via
gh pr create.If
ghisn't installed/authenticated, the branch is still committed and pushed for real — only PR creation degrades, with the real error returned so you can open it manually.
Install
pip install safe-fix-mcpAdd to your MCP client config (e.g. Claude Code):
claude mcp add safe-fix-mcp -- safe-fix-mcpOr run directly for local testing:
python -m safe_fix_mcp.serverInstalling from source instead of PyPI:
pip install -e .Skill
A SKILL.md ships inside this same package — not a separate download — and teaches Claude when and how to use the two tools correctly (e.g. that propose_removal_pr only ever auto-removes single-name unused imports, never functions/classes/dependencies). Install it into your project:
safe-fix-mcp-install-skillRun it from the project root you want the skill active in — it writes to .claude/skills/safe-fix-mcp/SKILL.md relative to your current directory.
Requirements
Python ≥ 3.10
giton PATHgh(GitHub CLI) on PATH and authenticated, if you wantpropose_removal_prto actually open the PR — without it, the branch still gets pushed for real, and the tool tells you to open the PR by hand.
Development
pip install -e ".[dev]"
pytestKnown limitation
vulture flags scan_dead_code/propose_removal_pr themselves as "unused" — a known false-positive class, not a real bug: they're dispatched by the @mcp.tool() decorator at runtime, not called directly anywhere in the source, so static call-graph analysis can't see the real caller (the MCP framework itself).
Verifying it for real
scripts/verify_real_client.py launches the packaged server as a real subprocess and talks to it with the real mcp.client.ClientSession — the same path a real MCP client uses. Useful as a smoke test after any change:
python scripts/verify_real_client.pyAvailable Tools
2 toolspropose_removal_prA
Propose a real branch+PR removing only unused imports (single-name
import lines, >= 90% vulture confidence) from a Python repository. Runs
the repo's own full test suite as a safety gate before ever committing
or pushing — a failure there reverts everything and nothing is
committed or pushed. If gh isn't available or PR creation otherwise
fails, the branch is still committed and pushed for real; only the PR
itself needs opening manually. A human always merges — this never
merges anything itself.
repo_path: path to a real git repository with a clean working tree (uncommitted changes are refused, not overwritten).
| Name | Required | Description | Default |
|---|---|---|---|
| repo_path | No | . |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
scan_dead_codeA
Scan a Python repository for real dead code (vulture) and dependency issues (deptry). Read-only — never modifies anything. Returns a human-readable list of findings, or "No real candidates found."
repo_path: path to the repository to scan (must contain a pyproject.toml for the dependency checks to run; dead-code scanning works regardless). min_confidence: vulture's own confidence threshold (0-100). Lower values surface more candidates but more false positives.
| Name | Required | Description | Default |
|---|---|---|---|
| repo_path | No | . | |
| min_confidence | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
v0.1.2- First observed
propose_removal_pr - First observed
scan_dead_code
TDQS
A4.4/5.0
Scored across 2 tools
Disambiguation5/5
scan_dead_code is purely read-only analysis, while propose_removal_pr actually creates a branch and PR. Their purposes are complementary and unlikely to be confused.
Naming Consistency4/5
Both tool names use lower_snake verb-first conventions: scan_dead_code and propose_removal_pr. The pattern is predictable, though the second name is slightly less clean because 'removal_pr' bundles an action and an object into one noun phrase.
Tool Count3/5
Two tools is on the thin side and sits at the borderline of feeling complete. However, each tool has a distinct role in a focused analyze-then-propose workflow, so the small count is plausible for a narrow server.
Completeness3/5
The scan surfaces both dead code and dependency issues, but propose_removal_pr only handles unused imports. Dependency fixes and non-import dead-code removals are therefore dead ends, creating a notable gap in the advertised safe-fix domain.
Maintenance
ActivityInactive
ResponsivenessNo recent community issues
Related MCP Connectors
Codebase intelligence for AI agents — dead code, blast radius, ownership.
Screens public GitHub repos and PRs to generate risk maps, findings, and merge-readiness signals.
Scan a public GitHub repo for known Vercel Python-runtime deploy footguns.
Security + bug + perf + refactor audit for Python. Returns 0-10 score + MD report.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceEnables automated Python code quality checks including linting, complexity analysis, typo detection, structure validation, duplicate detection, and test coverage, with integration into Cursor IDE and CLI.MIT
- AlicenseNot gradedqualityDmaintenanceEnables scanning projects for dependency vulnerabilities, secrets, license conflicts, code quality, and git health, returning a 0-100 health score with actionable suggestions.2 npmMIT
- FlicenseNot gradedqualityBmaintenanceEnables whole-program callgraph reachability analysis to locate dead functions and stale flags, and integrates with MCP-compliant clients for automated code review, breaking-change audits, and CI/CD workflow pruning.8-