Skip to main content
Glama
uamcp

Understand-Anything MCP Server

by uamcp

Understand-Anything MCP Server

npm version license GitHub stars

A Model Context Protocol (MCP) server that empowers your AI agents to understand your entire project architecture, and a headless CI gateway to enforce architectural rules before code is merged.

Quick Start

NOTE

Prerequisite: ua-mcp is a lightweight reader that connects your AI assistant to your local Understand-Anything knowledge graph. It does not build the graph itself. You must install the core scanner from Egonex-AI/Understand-Anything and run /understand in your project to produce the .ua/knowledge-graph.json file. Commit this file to your repository before proceeding.

Get your AI assistant hooked up with architectural context in 60 seconds. ua_find_callers, ua_impact_analysis, and ua_precheck work immediately for free with no license key required!

Claude Desktop

Add this to your claude_desktop_config.json:

{
  "mcpServers": {
    "understand-anything": {
      "command": "npx",
      "args": ["-y", "ua-mcp"],
      "env": {
        "UA_PROJECT_PATH": "/absolute/path/to/your/project"
      }
    }
  }
}

Cursor

  1. Go to Settings > Features > MCP.

  2. Click + Add new MCP server.

  3. Name: understand-anything

  4. Type: command

  5. Command: npx -y ua-mcp

  6. Add an environment variable: UA_PROJECT_PATH = /absolute/path/to/your/project

Related MCP server: NEAT MCP Server

How UA-MCP compares to Understand-Anything Tool

The free upstream Understand-Anything tool is responsible for generating the local knowledge graph and performing manual local analysis. UA-MCP sits on top of this graph to provide an automated governance layer and safety net for your codebase. While the free tool is a diagnostic scanner, UA-MCP actively blocks risky merges via its CI/branch-protection gate (ua-ci) and enforces your custom .ua-rules.json architectural boundaries.

Privacy Policy

IMPORTANT

Link to Privacy Policy

Data Processing Details:

  • License keys and email addresses are securely stored for billing purposes.

  • Purely local, no network calls: ua_status, ua_scan, ua_graph_summary, ua_explain, ua_onboarding_doc.

  • Sends graph data to the backend: ua_precheck (Free and Pro), and all Pro-only tools (ua_rules, ua_ci_check, ua_find_callers, ua_impact_analysis, ua_validate_graph). When these tools are used, the full local graph object is sent to our backend for CI risk analysis, rule evaluation, and quota validation. All Pro-tier computation is handled remotely.

  • No source code contents are transmitted, only graph metadata (file paths and import relationships). All backend graph processing is done purely in-memory per-request and is never persisted.

Security Considerations

  • UA_API_URL defaults to the official backend (https://ua-mcp-backend.onrender.com). Be extremely cautious if you change this to a custom endpoint, as the third-party backend will receive your full knowledge graph and source file paths.

  • Self-Hosting: If you are self-hosting the backend, note that a PostgreSQL DATABASE_URL is required in production. SQLite is not supported for production deployments.

🚀 Features

  • Branch Protection / CI Gate: Automatically block high-risk PRs based on the codebase graph.

  • Architectural Rules: Define custom .ua-rules.json to enforce boundaries.

  • Blast Radius Analysis: Detect exactly which downstream files will break if a module is modified.

  • On-Demand Knowledge Graph: Let Claude instantly query dependencies across massive codebases without filling its context window.

TIP

System Instruction Recommended: For the best experience, add the following to your AI assistant's system prompt or custom instructions: "Always call ua_precheck before modifying any file in this project."

How it works

  1. Your AI agent decides it wants to modify a critical file (e.g., src/auth.ts).

  2. The agent (following its system instructions) triggers ua_precheck before making the edit to run an Architectural Safety Linter.

  3. The server analyzes the graph to determine the "blast radius" and checks it against your rules.

  4. If the blast radius is too large or violates a rule, a Safety Checkpoint (Elicitation Prompt) interrupts the agent, asking for your explicit confirmation before proceeding.

Configuration Rules (.ua-rules.json)

You can define specific boundaries in a .ua-rules.json file in the root of your workspace to dictate what the LLM is allowed to touch.

{
  // Understand-Anything Architectural Rules
  // Define constraints that agents and developers must respect.
  "rules": [
    {
      "id": "no-ui-db-import",
      "description": "UI layer must never import database layer directly",
      "from_pattern": "src/ui/**",
      "to_pattern": "src/db/**",
      "severity": "error"
    },
    {
      "id": "auth-required-for-payments",
      "description": "Payment modules must always be reachable from auth",
      "requires_path_through": "src/auth/**",
      "for_pattern": "src/payments/**",
      "severity": "error"
    }
  ]
}

đź”’ Usage: CI/CD Branch Protection (Enforcement)

CI Gateway (ua-ci)

A companion CLI that runs locally in your GitHub Actions or GitLab CI. It parses your PR diff and compares it to the local graph.

  • Free Tier: Evaluates blast-radius and logs the risk level.

  • Pro Tier: Automatically blocks the merge if the risk is HIGH or violates architectural rules.

IMPORTANT

The True Enforcement Backstop: While local agents rely on system instructions to run ua_precheck, the ua-ci command is designed to be your unbypassable safety net. By running ua-ci in your GitHub Actions and requiring it as a status check in GitHub Branch Protection, you ensure that no rogue edits can ever be merged into production without explicit approval.

Note on Free Tier: If a valid Pro license key is not detected in the environment variables, the CI check will log a warning and silently pass (exit 0) so it does not block builds for non-paying users.

# .github/workflows/ua-ci.yml
name: Understand-Anything CI Check
on:
  pull_request:
    branches: [ main ]

jobs:
  ua-ci-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Generate PR Diff
        run: git diff origin/main...HEAD > pr.diff

      - name: Run UA Branch Protection
        env:
          UA_LICENSE_KEY: ${{ secrets.UA_LICENSE_KEY }}
        run: npx ua-ci --pr-diff=pr.diff

🛡️ Usage: Local Governance (Agents)

When connected to Claude Desktop or an MCP client, the following tools become available to the agent:

Claude Desktop (claude_desktop_config.json)

Add the following to your Claude Desktop config file (usually ~/Library/Application Support/Claude/claude_desktop_config.json on macOS or %APPDATA%\Claude\claude_desktop_config.json on Windows):

{
  "mcpServers": {
    "understand-anything": {
      "command": "npx",
      "args": ["-y", "ua-mcp"],
      "env": {
        "UA_PROJECT_PATH": "/path/to/your/project",
        "UA_LICENSE_KEY": "your_license_key_here"
      }
    }
  }
}

Cursor

  1. Go to Settings > Features > MCP.

  2. Click + Add new MCP server.

  3. Name: understand-anything

  4. Type: command

  5. Command: npx -y ua-mcp

Continue

Add to your config.json under mcpServers:

"understand-anything": {
  "command": "npx",
  "args": ["-y", "ua-mcp"]
}

Available Tools & Tiering

The Understand-Anything MCP Server operates on a tiered licensing model.

Core Tools (Free Tier)

Available out of the box with no license required.

  • ua_find_callers: Retrieves reverse dependencies up to 2 hops (Now unlimited and free!).

  • ua_impact_analysis: Retrieves full transitive closure of reverse dependencies (Now unlimited and free!).

  • ua_precheck: Pre-flight architectural risk check (10 checks/day, default critical-path rules only)

  • ua_status: Returns MCP health status.

  • ua_scan: Forces a re-scan of the workspace.

  • ua_graph_summary: Returns aggregated node/edge statistics.

  • ua_architecture_report: Groups files by top-level modules.

  • ua_dependency_report: Identifies files with the most incoming dependencies (fan-in).

  • ua_explain: Retrieves 1-hop dependencies for a specific file.

  • ua_onboarding_doc: Generates onboarding context.

Premium Tools (Pro Tier)

Pro Tier — Architectural Enforcement & CI Safety

Team Use: One Pro license key can be shared across your entire team's CI pipelines and MCP configurations — no per-seat pricing.

  • ua_rules & ua_rules_check: Enforce custom .ua-rules.json boundaries. Evaluates constraints to ensure recent changes haven't introduced violations.

  • ua_ci_check & ua-ci: Block risky PRs in GitHub Actions before they reach production. Analyzes Git PR diffs for architectural impact.

  • ua_precheck: Unlimited pre-flight checks with configurable critical paths and .ua-rules.json enforcement

  • ua_validate_graph: Checks the knowledge graph schema for corruption.

Pricing

Tier

Price

Features

Free

$0 forever

Basic graph operations, local storage.

Pro

$10/month OR $50 one-time

Unlimited nodes, advanced graph analytics, rule enforcement, priority support. (Lifetime access limited availability)

Get your license key:

Troubleshooting

  • Server fails to start: Ensure you have Node.js v18 or later installed.

  • License key error: Verify your key in the .env file or Claude config matches the one on your dashboard.

  • Path not found: Ensure UA_PROJECT_PATH is absolute or resolves correctly relative to where the server runs.

License

MIT License

Available Tools

2 tools
ua_architecture_reportA
Read-onlyIdempotent

Generate a module-level architecture report from the knowledge graph. Returns a breakdown of files per directory to identify main components.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the description's additional context (use of knowledge graph, return of breakdown) is helpful but does not significantly expand behavioral disclosure beyond what is in the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-formed sentence that front-loads the core purpose. It contains no wasted words and is appropriately concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description explains the return type (breakdown of files per directory). It covers the tool's function and output, though it could be more complete by mentioning any prerequisites or limitations of the knowledge graph.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has 0 parameters, and schema coverage is 100% (vacuously). Per the rubric, a baseline of 4 applies. The description does not need to add parameter information.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the verb (Generate) and resource (module-level architecture report from the knowledge graph), and specifies the output (breakdown of files per directory). However, it does not explicitly distinguish itself from the sibling tool ua_graph_summary, so it scores a 4 rather than a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives is provided. The description simply states what the tool does, leaving the agent to infer usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ua_graph_summaryA
Read-onlyIdempotent

Get a high-level statistical summary of the codebase knowledge graph. Returns total node and edge counts to gauge project size.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds value by disclosing the specific return content (node and edge counts), which goes beyond what annotations provide. However, it does not mention any side effects or further behavioral traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long with no extraneous information. The first sentence front-loads the purpose, and the second adds output detail. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given zero parameters, no output schema, and rich annotations, the description fully explains what the tool does and what it returns. It is complete for its simplicity and purpose.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema is empty with 100% coverage, so the description does not repeat parameters. It adds meaning by explaining the purpose and output of the tool, which the schema alone cannot convey. This goes beyond the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool gets a 'high-level statistical summary' of the codebase knowledge graph, specifying it returns node and edge counts. This verb+resource combination uniquely identifies it from the sibling tool 'ua_architecture_report' which likely provides a different kind of report.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use for 'gauging project size' but does not explicitly state when to use this tool vs. the sibling tool 'ua_architecture_report'. No exclusions or alternatives are mentioned, so guidance is solely implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 2 tool updatesv0.1.0
    • First observedua_architecture_report
    • First observedua_graph_summary

TDQS

A3.6/5.0

Scored across 2 tools

Disambiguation5/5

The two tools have clearly distinct purposes: one provides a module-level architecture breakdown, the other gives a high-level statistical summary of the graph. There is no overlap in their outputs, so an agent can reliably choose between them.

Naming Consistency5/5

Both tools follow a consistent 'ua_<descriptive_name>' pattern in snake_case. The naming is predictable and clearly conveys each tool's function.

Tool Count2/5

With only two tools, the server feels too limited for its stated purpose of codebase understanding. A well-scoped server for this domain would typically offer at least 5–10 tools to cover key operations like querying, searching, and exploring relationships.

Completeness2/5

The tool surface provides only high-level summaries (architecture and statistics). Essential operations for understanding a codebase—such as searching for specific nodes, exploring dependencies, or querying relationships—are missing, leaving significant gaps.

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    B
    maintenance
    Dev intelligence layer that builds a knowledge graph from any codebase and exposes 7 MCP tools for graph-powered reasoning, impact analysis, and preflight safety and governance checks.
    98 PyPI
    32
    Apache 2.0
  • A
    license
    Not graded
    quality
    A
    maintenance
    Provides AI agents with a live architecture model of a codebase, enabling queries for root cause analysis, blast radius, and dependency traversal through MCP tools.
    156 npm
    18
    Apache 2.0
  • A
    license
    Not graded
    quality
    A
    maintenance
    Enables AI agents to query architecture context, data contracts, and blast radius to prevent cross-repo architectural breakage before merging.
    24
    Apache 2.0
  • F
    license
    Not graded
    quality
    A
    maintenance
    Analyzes repositories, explains architecture, calculates change impact, and enforces guardrails for AI Agents like Claude Code, Cursor, and Codex via MCP tools.
    -