tzero-mcp

audit_codebase_quality

Run a read-only AST code quality audit to detect code smells, complexity, duplication, and exposed credentials, then return severity-rated remediation steps.

Instructions

Performs an AST static code smell audit, cyclomatic complexity check, copy-paste duplicity scan, and 100% Zero-Leak security audit for exposed credentials.

Behavior:

Read-only: Evaluates AST nodes and regex patterns; does not modify or delete files.
Idempotent: Produces consistent quality diagnostics for the same code.
100% Offline: Fully private local analysis; zero external requests.

Usage Guidelines:

When to use: Run as a pre-commit or pre-PR code health audit to identify complex routines (> 30 lines, > 5 args), missing docstrings, architectural boundary violations, and hardcoded secrets.
Sibling Routing: If you only need to verify zero hardcoded secrets/API keys, use 'verify_zero_leak_security'. If you only want unused function detection, use 'find_dead_code'. If you only want duplicate logic blocks, use 'find_code_duplicity'.

Returns: Comprehensive diagnostic Markdown report with severity ratings (T-001 Security, T-002 Boundaries, T-003 Contracts, T-004 Complexity), line numbers, and actionable remediation steps.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`file_path`	No	Optional path to a specific file to audit. If empty, audits all code files in the workspace.
`project_root`	No	Root directory of the repository to audit (default: current directory).	.

Output Schema

TableJSON Schema

Name	Required	Description	Default
`result`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed2 schema fields changedv0.1.1Oct 16, 2026

addedInput schema / properties / file_path / description

Added value: +"Optional path to a specific file to audit. If empty, audits all code files in the workspace."

addedInput schema / properties / project_root / description

Added value: +"Root directory of the repository to audit (default: current directory)."

First observedv0.1.0Oct 15, 2026

TDQS

A4.7/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations supplied, the description carries the full burden and does so: read-only ('does not modify or delete files'), idempotent ('consistent quality diagnostics for the same code'), and offline ('zero external requests'). That covers the safety, determinism, and network profile an agent needs before invoking an audit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded one-line purpose, then labeled Behavior / Usage Guidelines / Returns blocks. The bullets are dense and each carries distinct information; nothing is padded despite the length being justified by a multi-mode tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so the return-value explanation is technically optional, yet the severity taxonomy (T-001 through T-004) adds useful interpretive context. Combined with complete parameter docs and full behavioral disclosure, an agent has everything needed to call this correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and both parameters (file_path, project_root) are already fully documented with defaults in the schema. The description adds scope context ('audits all code files in the workspace') but no syntax, format, or edge-case meaning beyond what the schema provides, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (performs an audit) and enumerates the four distinct analyses it runs: AST code smells, cyclomatic complexity, copy-paste duplicity, and Zero-Leak credential scanning. This clearly separates it from single-purpose siblings like find_code_duplicity or verify_zero_leak_security.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit 'When to use' (pre-commit / pre-PR health audit) plus a 'Sibling Routing' block that names three alternatives and the exact condition under which each should be preferred instead. This leaves nothing to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.