15 个#static-analysis MCP 服务器和客户端

SonarQube

SonarSource

Official SonarQube MCP Server for code quality and security in AI agents

✨ Lucidity MCP 🔍

hyperb1iss

AI-powered code quality analysis using MCP to help AI assistants review code more effectively. Analyze git changes for complexity, security issues, and more through structured prompts.

OrangePro

Aamir Siddiqui

OrangePro local-first CLI + MCP server for behavior mapping, grounded test generation, and dynamic proof.

Codegraphx (cgx)

techcraze00

CodeGraphX (CGX) — a local, token-efficient codebase graph engine & MCP server for AI coding agents. Tree-sitter parsing, a bi-temporal SQLite semantic graph, O(1) symbol lookup, and impact/blast-radius tracing so agents answer 'what breaks if I change this?' in a few hundred tok

ROS 2 Workspace Inspector

doer0312

Statically inspect and diagnose ROS 2 workspaces with AI agents—locally, safely, and without installing ROS.

npm: @tastehub/ckb

Mcp Semgrep Scanner

archimedes-market

Curated by Archimedes Market. Static security analysis exposed as MCP tools. OWASP top 10, secrets detection, custom rule packs. Baseline scanning focuses on newly-introduced findings. Built for production-grade security review. → archimedes.market/assets/21c4a8ab-80dc-4a69-8444-

Compuute MCP Security Scanner

Compuute

Scan-as-a-Service for MCP servers — HTTP+MCP wrapper around compuute-scan

Educational Python refactoring assistant with guided suggestions for AI assistants

Static code analyzer with MCP server. Gives AI agents access to complexity metrics, coupling analysis, community detection, risk scoring, and test quality, without reading every file.

Tech Debt Mcp

PierreJanineh

Static technical-debt analysis across 14 languages, exposed as MCP tools and resources

Repo Test Architect

RepoAssay

Local-first, read-only MCP server for evidence-backed repository test architecture audits and test planning.

Code Pathfinder

shivasurya

Code Pathfinder's MCP Server provides AI coding assistants like Claude Code with deep semantic understanding of codebases through call graph analysis, symbol search, and dependency tracking. It enables developers to ask natural language questions like "who calls this function?" i

PCI DSS MCP

shyshlakov

PCI DSS v4.0.1 static-analysis MCP server for Go payment service codebases. 12 scanners detect PAN/CVV exposure, weak crypto, missing audit logs, vulnerable deps, TLS misconfig, auth weaknesses, plus CycloneDX 1.6 SBOM generation. Each finding maps to the exact PCI requirement. A

Graphpilot

graphpilot-oss

GraphPilot gives coding agents persistent structural knowledge of a codebase. It parses TypeScript/JavaScript with tree-sitter into a graph of symbols and call edges, then exposes that graph over MCP so the agent can recall definitions, find callers, and trace change impact witho