Ast AnalyzerCAUTION
By transforming source code into a queryable Semantic Graph and a structured AST, this tool bridges the gap between "reading text" and "understanding structure." For an AI assistant, it provides the "spatial" awareness needed to navigate deep dependencies without getting lost in large files.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
An MCP (Model Context Protocol) server that provides code structure and semantic analysis capabilities through Abstract Syntax Trees (AST) and Abstract Semantic Graphs (ASG).
Features
- Parse code into Abstract Syntax Trees (AST)
- Generate Abstract Semantic Graphs (ASG) from code
- Analyze code structure and complexity
- Support for multiple programming languages (Python, JavaScript, TypeScript, Go, Rust, C/C++, Java)
- Compatible with Claude Desktop and other MCP clients
- Incremental parsing for faster processing of large files
- Enhanced scope handling and more complete semantic analysis
- AST diffing to identify changes between code versions
- Resource caching for improved performance
Installation
Prerequisites
- Python 3.9 or higher
- uv package manager (recommended) or pip
Using uv (Recommended)
- Clone this repository:
git clone https://github.com/angrysky56/ast-mcp-server.git cd ast-mcp-server
- Install the project and dependencies:
# Install the project in development mode with all dependencies uv sync # Or install with specific optional dependencies uv sync --extra dev # Development tools uv sync --extra testing # Testing dependencies uv sync --extra docs # Documentation tools
- Build the tree-sitter parsers:
uv run build-parsers
Using pip (Alternative)
# Create and activate virtual environment python -m venv .venv source .venv/bin/activate # On Windows: .venv\Scripts\activate # Install dependencies pip install -e . # Build parsers python build_parsers.py
Usage with Claude Desktop
- Configure Claude Desktop to use the server by editing your configuration file:
Location of config file:
- macOS:
~/Library/Application Support/claude-desktop/claude_desktop_config.json - Linux:
~/.config/claude-desktop/claude_desktop_config.json - Windows:
%APPDATA%\claude-desktop\claude_desktop_config.json
- Add the AST M
7c59749259b1OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add ast-mcp-server --env NEO4J_PASSWORD=${NEO4J_PASSWORD} --env OPENROUTER_API_KEY=${OPENROUTER_API_KEY} -- uvx ast-mcp-server{
"mcpServers": {
"ast-mcp-server": {
"command": "uvx",
"args": [
"ast-mcp-server"
],
"env": {
"NEO4J_PASSWORD": "${NEO4J_PASSWORD}",
"OPENROUTER_API_KEY": "${OPENROUTER_API_KEY}"
}
}
}
}Exposed tools (2)
0 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
analyze_project | write | Recursively analyze a project, generate reports, and optionaly sync to Graph DB. |
analyze_source_file | write | Analyze a single source file, save reports to disk, and optionally generate an AI summary. |
Trust audit
CAUTIONgrade C · trust 79/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (3 observation(s))
- Shell
- declared (3 observation(s))
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (10)
importlib.import_module(module_name)
module = importlib.import_module(module_name)
module = importlib.import_module(module_name)
.markdownlint.yaml
.shellcheckrc
ast_id = hashlib.md5(
asg_id = hashlib.md5(
analysis_id = hashlib.md5(
func_id = hashlib.md5(
return hashlib.md5(code.encode("utf-8"), usedforsecurity=False).hexdigest()Gates applied: no_behavioural_pass.
7c59749259b1full audit observations/trust-audit/mcp-server/angrysky56__ast-analyzer.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | 7c59749259b1 | CAUTION | C | 79 | first audit |
Questions
What is the Ast Analyzer MCP server?
By transforming source code into a queryable Semantic Graph and a structured AST, this tool bridges the gap between "reading text" and "understanding structure." For an AI assistant, it provides the "spatial" awareness needed to navigate deep dependencies without getting lost in large files.
What tools does Ast Analyzer expose?
2 in total: 0 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Ast Analyzer safe to connect to an agent?
With care. The audit graded it C (79/100) and found 10 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does Ast Analyzer need?
It reads NEO4J_PASSWORD and OPENROUTER_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (7c59749259b1), read on 2026-10-08. The repository is watched and re-audited when it changes.