Understand-Anything MCP Server
Provides CI/CD validation via ua_ci_check to enforce architectural rules before merging.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Understand-Anything MCP ServerPre-check src/auth.ts before editing."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Understand-Anything MCP Server
A Model Context Protocol (MCP) server that empowers your AI agents to understand your entire project architecture, and a headless CI gateway to enforce architectural rules before code is merged.
Quick Start
Prerequisite: ua-mcp is a lightweight reader that connects your AI assistant to your local Understand-Anything knowledge graph. It does not build the graph itself.
You must install the core scanner from Egonex-AI/Understand-Anything and run /understand in your project to produce the .ua/knowledge-graph.json file. Commit this file to your repository before proceeding.
Get your AI assistant hooked up with architectural context in 60 seconds. ua_find_callers, ua_impact_analysis, and ua_precheck work immediately for free with no license key required!
Claude Desktop
Add this to your claude_desktop_config.json:
{
"mcpServers": {
"understand-anything": {
"command": "npx",
"args": ["-y", "ua-mcp"],
"env": {
"UA_PROJECT_PATH": "/absolute/path/to/your/project"
}
}
}
}Cursor
Go to Settings > Features > MCP.
Click + Add new MCP server.
Name:
understand-anythingType:
commandCommand:
npx -y ua-mcpAdd an environment variable:
UA_PROJECT_PATH = /absolute/path/to/your/project
Related MCP server: NEAT MCP Server
How UA-MCP compares to Understand-Anything Tool
The free upstream Understand-Anything tool is responsible for generating the local knowledge graph and performing manual local analysis. UA-MCP sits on top of this graph to provide an automated governance layer and safety net for your codebase. While the free tool is a diagnostic scanner, UA-MCP actively blocks risky merges via its CI/branch-protection gate (ua-ci) and enforces your custom .ua-rules.json architectural boundaries.
Privacy Policy
Data Processing Details:
License keys and email addresses are securely stored for billing purposes.
Purely local, no network calls:
ua_status,ua_scan,ua_graph_summary,ua_explain,ua_onboarding_doc.Sends graph data to the backend:
ua_precheck(Free and Pro), and all Pro-only tools (ua_rules,ua_ci_check,ua_find_callers,ua_impact_analysis,ua_validate_graph). When these tools are used, the full local graph object is sent to our backend for CI risk analysis, rule evaluation, and quota validation. All Pro-tier computation is handled remotely.No source code contents are transmitted, only graph metadata (file paths and import relationships). All backend graph processing is done purely in-memory per-request and is never persisted.
Security Considerations
UA_API_URLdefaults to the official backend (https://ua-mcp-backend.onrender.com). Be extremely cautious if you change this to a custom endpoint, as the third-party backend will receive your full knowledge graph and source file paths.Self-Hosting: If you are self-hosting the backend, note that a PostgreSQL
DATABASE_URLis required in production. SQLite is not supported for production deployments.
🚀 Features
Branch Protection / CI Gate: Automatically block high-risk PRs based on the codebase graph.
Architectural Rules: Define custom
.ua-rules.jsonto enforce boundaries.Blast Radius Analysis: Detect exactly which downstream files will break if a module is modified.
On-Demand Knowledge Graph: Let Claude instantly query dependencies across massive codebases without filling its context window.
System Instruction Recommended: For the best experience, add the following to your AI assistant's system prompt or custom instructions:
"Always call ua_precheck before modifying any file in this project."
How it works
Your AI agent decides it wants to modify a critical file (e.g.,
src/auth.ts).The agent (following its system instructions) triggers
ua_precheckbefore making the edit to run an Architectural Safety Linter.The server analyzes the graph to determine the "blast radius" and checks it against your rules.
If the blast radius is too large or violates a rule, a Safety Checkpoint (Elicitation Prompt) interrupts the agent, asking for your explicit confirmation before proceeding.
Configuration Rules (.ua-rules.json)
You can define specific boundaries in a .ua-rules.json file in the root of your workspace to dictate what the LLM is allowed to touch.
{
// Understand-Anything Architectural Rules
// Define constraints that agents and developers must respect.
"rules": [
{
"id": "no-ui-db-import",
"description": "UI layer must never import database layer directly",
"from_pattern": "src/ui/**",
"to_pattern": "src/db/**",
"severity": "error"
},
{
"id": "auth-required-for-payments",
"description": "Payment modules must always be reachable from auth",
"requires_path_through": "src/auth/**",
"for_pattern": "src/payments/**",
"severity": "error"
}
]
}đź”’ Usage: CI/CD Branch Protection (Enforcement)
CI Gateway (ua-ci)
A companion CLI that runs locally in your GitHub Actions or GitLab CI. It parses your PR diff and compares it to the local graph.
Free Tier: Evaluates blast-radius and logs the risk level.
Pro Tier: Automatically blocks the merge if the risk is
HIGHor violates architectural rules.
The True Enforcement Backstop: While local agents rely on system instructions to run ua_precheck, the ua-ci command is designed to be your unbypassable safety net.
By running ua-ci in your GitHub Actions and requiring it as a status check in GitHub Branch Protection, you ensure that no rogue edits can ever be merged into production without explicit approval.
Note on Free Tier: If a valid Pro license key is not detected in the environment variables, the CI check will log a warning and silently pass (exit 0) so it does not block builds for non-paying users.
# .github/workflows/ua-ci.yml
name: Understand-Anything CI Check
on:
pull_request:
branches: [ main ]
jobs:
ua-ci-check:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
with:
fetch-depth: 0
- name: Generate PR Diff
run: git diff origin/main...HEAD > pr.diff
- name: Run UA Branch Protection
env:
UA_LICENSE_KEY: ${{ secrets.UA_LICENSE_KEY }}
run: npx ua-ci --pr-diff=pr.diff🛡️ Usage: Local Governance (Agents)
When connected to Claude Desktop or an MCP client, the following tools become available to the agent:
Claude Desktop (claude_desktop_config.json)
Add the following to your Claude Desktop config file (usually ~/Library/Application Support/Claude/claude_desktop_config.json on macOS or %APPDATA%\Claude\claude_desktop_config.json on Windows):
{
"mcpServers": {
"understand-anything": {
"command": "npx",
"args": ["-y", "ua-mcp"],
"env": {
"UA_PROJECT_PATH": "/path/to/your/project",
"UA_LICENSE_KEY": "your_license_key_here"
}
}
}
}Cursor
Go to Settings > Features > MCP.
Click + Add new MCP server.
Name:
understand-anythingType:
commandCommand:
npx -y ua-mcp
Continue
Add to your config.json under mcpServers:
"understand-anything": {
"command": "npx",
"args": ["-y", "ua-mcp"]
}Available Tools & Tiering
The Understand-Anything MCP Server operates on a tiered licensing model.
Core Tools (Free Tier)
Available out of the box with no license required.
ua_find_callers: Retrieves reverse dependencies up to 2 hops (Now unlimited and free!).ua_impact_analysis: Retrieves full transitive closure of reverse dependencies (Now unlimited and free!).ua_precheck: Pre-flight architectural risk check (10 checks/day, default critical-path rules only)ua_status: Returns MCP health status.ua_scan: Forces a re-scan of the workspace.ua_graph_summary: Returns aggregated node/edge statistics.ua_architecture_report: Groups files by top-level modules.ua_dependency_report: Identifies files with the most incoming dependencies (fan-in).ua_explain: Retrieves 1-hop dependencies for a specific file.ua_onboarding_doc: Generates onboarding context.
Premium Tools (Pro Tier)
Pro Tier — Architectural Enforcement & CI Safety
Team Use: One Pro license key can be shared across your entire team's CI pipelines and MCP configurations — no per-seat pricing.
ua_rules&ua_rules_check: Enforce custom.ua-rules.jsonboundaries. Evaluates constraints to ensure recent changes haven't introduced violations.ua_ci_check&ua-ci: Block risky PRs in GitHub Actions before they reach production. Analyzes Git PR diffs for architectural impact.ua_precheck: Unlimited pre-flight checks with configurable critical paths and .ua-rules.json enforcementua_validate_graph: Checks the knowledge graph schema for corruption.
Pricing
Tier | Price | Features |
Free | $0 forever | Basic graph operations, local storage. |
Pro | $10/month OR $50 one-time | Unlimited nodes, advanced graph analytics, rule enforcement, priority support. (Lifetime access limited availability) |
Get your license key:
Troubleshooting
Server fails to start: Ensure you have Node.js v18 or later installed.
License key error: Verify your key in the
.envfile or Claude config matches the one on your dashboard.Path not found: Ensure
UA_PROJECT_PATHis absolute or resolves correctly relative to where the server runs.
License
MIT License
Available Tools
2 toolsua_architecture_reportARead-onlyIdempotent
Generate a module-level architecture report from the knowledge graph. Returns a breakdown of files per directory to identify main components.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the description's additional context (use of knowledge graph, return of breakdown) is helpful but does not significantly expand behavioral disclosure beyond what is in the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-formed sentence that front-loads the core purpose. It contains no wasted words and is appropriately concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description explains the return type (breakdown of files per directory). It covers the tool's function and output, though it could be more complete by mentioning any prerequisites or limitations of the knowledge graph.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has 0 parameters, and schema coverage is 100% (vacuously). Per the rubric, a baseline of 4 applies. The description does not need to add parameter information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the verb (Generate) and resource (module-level architecture report from the knowledge graph), and specifies the output (breakdown of files per directory). However, it does not explicitly distinguish itself from the sibling tool ua_graph_summary, so it scores a 4 rather than a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives is provided. The description simply states what the tool does, leaving the agent to infer usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ua_graph_summaryARead-onlyIdempotent
Get a high-level statistical summary of the codebase knowledge graph. Returns total node and edge counts to gauge project size.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds value by disclosing the specific return content (node and edge counts), which goes beyond what annotations provide. However, it does not mention any side effects or further behavioral traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long with no extraneous information. The first sentence front-loads the purpose, and the second adds output detail. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters, no output schema, and rich annotations, the description fully explains what the tool does and what it returns. It is complete for its simplicity and purpose.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema is empty with 100% coverage, so the description does not repeat parameters. It adds meaning by explaining the purpose and output of the tool, which the schema alone cannot convey. This goes beyond the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool gets a 'high-level statistical summary' of the codebase knowledge graph, specifying it returns node and edge counts. This verb+resource combination uniquely identifies it from the sibling tool 'ua_architecture_report' which likely provides a different kind of report.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use for 'gauging project size' but does not explicitly state when to use this tool vs. the sibling tool 'ua_architecture_report'. No exclusions or alternatives are mentioned, so guidance is solely implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
v0.1.0- First observed
ua_architecture_report - First observed
ua_graph_summary
TDQS
Scored across 2 tools
The two tools have clearly distinct purposes: one provides a module-level architecture breakdown, the other gives a high-level statistical summary of the graph. There is no overlap in their outputs, so an agent can reliably choose between them.
Both tools follow a consistent 'ua_<descriptive_name>' pattern in snake_case. The naming is predictable and clearly conveys each tool's function.
With only two tools, the server feels too limited for its stated purpose of codebase understanding. A well-scoped server for this domain would typically offer at least 5–10 tools to cover key operations like querying, searching, and exploring relationships.
The tool surface provides only high-level summaries (architecture and statistics). Essential operations for understanding a codebase—such as searching for specific nodes, exploring dependencies, or querying relationships—are missing, leaving significant gaps.
Related MCP Connectors
Hosted code graph over MCP: exact callers, dependencies, and cross-repo blast radius for AI agents.
Monitor MCP servers, API contracts and AI outputs for schema drift. Alerts on breaking changes.
MCP-Native LLM Orchestration Agent
Statically audits MCP tool surfaces for token cost, schema quality, and design issues.
Related MCP Servers
- AlicenseNot gradedqualityBmaintenanceDev intelligence layer that builds a knowledge graph from any codebase and exposes 7 MCP tools for graph-powered reasoning, impact analysis, and preflight safety and governance checks.98 PyPI32Apache 2.0

NEAT MCP Serverofficial
AlicenseNot gradedqualityAmaintenanceProvides AI agents with a live architecture model of a codebase, enabling queries for root cause analysis, blast radius, and dependency traversal through MCP tools.156 npm18Apache 2.0
coderadiusofficial
AlicenseNot gradedqualityAmaintenanceEnables AI agents to query architecture context, data contracts, and blast radius to prevent cross-repo architectural breakage before merging.24Apache 2.0- FlicenseNot gradedqualityAmaintenanceAnalyzes repositories, explains architecture, calculates change impact, and enforces guardrails for AI Agents like Claude Code, Cursor, and Codex via MCP tools.-