RepoCrunch
Provides deterministic analysis of GitHub repositories to extract structured metadata, including technology stacks, dependency details, architectural patterns, maintenance health, and security signals.
RepoCrunch
Analyze any public GitHub repository into structured JSON. No AI, no LLMs — fully deterministic.
Give it a repo, get back tech stack, dependencies, architecture, health metrics, and security signals in clean, consistent JSON. Use it as a Python library, CLI tool, REST API, or MCP server.
Quick Start
Requires Python 3.11+.
pip install repocrunch
repocrunch analyze fastapi/fastapi --prettyThat's it. Also works with uv:
uvx repocrunch analyze astral-sh/uv --prettyInstall from source
git clone https://github.com/kimwwk/repocrunch.git
cd repocrunch
uv venv && uv pip install -e ".[all]"Install just what you need:
uv pip install -e "." # Library only (httpx + pydantic)
uv pip install -e ".[cli]" # + CLI
uv pip install -e ".[api]" # + REST API
uv pip install -e ".[mcp]" # + MCP server
uv pip install -e ".[all]" # EverythingSet a GitHub Token (optional)
Without a token you get 60 API calls/hour. With one, 5,000/hour. A token also lets you analyze private repositories you have access to.
export GITHUB_TOKEN=ghp_...Related MCP server: GitHub PR Review MCP Server
Usage
CLI
repocrunch analyze fastapi/fastapi --pretty # Full analysis, pretty JSON
repocrunch analyze facebook/react -f tech_stack # Single field
repocrunch analyze https://github.com/gin-gonic/gin # Full URL works too
repocrunch serve # Start REST API on :8000
repocrunch mcp # Start MCP server (STDIO)Python Library
from repocrunch import analyze, analyze_sync
# Async
result = await analyze("fastapi/fastapi")
# Sync
result = analyze_sync("pallets/flask")
print(result.summary.stars)
print(result.tech_stack.framework)
print(result.model_dump_json(indent=2))REST API
repocrunch serve
# Then:
curl "http://localhost:8000/analyze?repo=fastapi/fastapi" | python -m json.tool
curl "http://localhost:8000/health"
curl "http://localhost:8000/docs" # OpenAPI docsMCP Server (for Claude, Cursor, etc.)
repocrunch mcp # Starts STDIO transportSample Output
$ repocrunch analyze pallets/flask --pretty{
"schema_version": "1",
"repo": "pallets/flask",
"url": "https://github.com/pallets/flask",
"analyzed_at": "2026-02-08T19:07:31Z",
"summary": {
"stars": 71143,
"forks": 16697,
"watchers": 2092,
"last_commit": "2026-02-06T21:23:01Z",
"age_days": 5787,
"license": "BSD-3-Clause",
"primary_language": "Python",
"languages": { "Python": 99.9, "HTML": 0.1 }
},
"tech_stack": {
"runtime": "Python",
"framework": null,
"package_manager": "pip",
"dependencies": { "direct": 6, "dev": 0 },
"key_deps": ["blinker", "click", "itsdangerous", "jinja2", "markupsafe", "werkzeug"]
},
"architecture": {
"monorepo": false,
"docker": false,
"ci_cd": ["GitHub Actions"],
"test_framework": "pytest",
"has_tests": true
},
"health": {
"open_issues": 2,
"open_prs": 0,
"contributors": 862,
"commit_frequency": "daily",
"maintenance_status": "actively_maintained"
},
"security": {
"has_env_file": false,
"dependabot_enabled": false,
"branch_protection": false,
"security_policy": false
},
"warnings": [
"Branch protection status unknown (requires admin access or authenticated request)"
]
}Supported Ecosystems
Language | Manifest Files | Package Manager Detection |
JavaScript / TypeScript |
| npm, yarn, pnpm, bun (from lockfiles) |
Python |
| pip, poetry, uv, pdm, pipenv |
Rust |
| cargo |
Go |
| go |
Java / Kotlin |
| maven, gradle |
Ruby |
| bundler |
C / C++ |
| cmake |
Framework detection covers 40+ frameworks across all supported ecosystems (FastAPI, Django, React, Next.js, Spring Boot, Rails, Gin, Actix, and many more).
What It Detects
Category | Signals |
Summary | Stars, forks, watchers, age, license, languages |
Tech Stack | Runtime, framework, package manager, direct/dev dependency count, key deps |
Architecture | Monorepo, Docker, CI/CD platform, test framework |
Health | Commit frequency (daily/weekly/monthly/sporadic/inactive), maintenance status, contributors, open issues |
Security |
|
Roadmap
Not yet implemented, but planned:
Secrets regex scanning — detect leaked API keys, tokens, passwords in the file tree
Architecture type classification — library vs. application vs. framework
API rate limiting — per-key throttling for the REST API
npm/npx package —
npx repocrunch analyze owner/repoVulnerability scanning — known CVE detection in dependencies
Comparison mode — side-by-side analysis of multiple repos
Historical tracking — track how a repo's health changes over time
Platform deployments — Apify Store, Smithery, mcp.so, RapidAPI
Already shipped: RepoCrunch is published on PyPI —
pip install repocrunch.
License
MIT
This server cannot be installed
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Servers
- AlicenseAquality-maintenanceEnterprise-grade MCP (Model Context Protocol) server for detecting secrets and sensitive information in GitHub repositories. Scans for 35+ types of secrets including API keys, passwords, tokens, and credentials with production-ready reliability features.Last updated50
- Alicense-qualityFmaintenanceComprehensive MCP server for analyzing GitHub pull requests, detecting security vulnerabilities, assessing code quality, and providing risk ratings across multiple languages.Last updated25MIT
- Alicense-qualityCmaintenanceCombines GitHub repository analysis, npm/PyPI package info, and deps.dev security advisories into a single MCP server, requiring no API keys.Last updatedMIT
- Flicense-qualityDmaintenanceMCP server that provides structured briefs for public GitHub repositories, including metadata, key files, release notes, and activity snapshots.Last updated
Related MCP Connectors
Scan any public GitHub MCP-server repo for security issues. 37 MCP-specific L1 rules, 8 languages.
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
Screens public GitHub repos and PRs to generate risk maps, findings, and merge-readiness signals.
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/kimwwk/repocrunch'
If you have feedback or need assistance with the MCP directory API, please join our Discord server