Atlas / MCP servers / harshkedia177 / Axon

AxonSAFE

Name: Axon
Author: harshkedia177

mcp/harshkedia177/axon-1

MCP server by harshkedia177 · claude code · code analysis · code intelligence · Audited 2026-09-27

Graph-powered code intelligence engine — indexes codebases into a knowledge graph, exposed via MCP tools for AI agents and a CLI for developers.

Verdict

SAFE

Grade

Trust score

89 /100

Exposed tools

11 9r · 2w · 0d

Transport

stdio · streamable-http

License

—

Stars

813

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://pypi.org/project/axoniq/) [](https://pepy.tech/projects/axoniq) [](https://pepy.tech/projects/axoniq) [](https://github.com/harshkedia177/axon) [](https://github.com/harshkedia177/axon/blob/main/LICENSE)

The knowledge graph for your codebase — explore it visually, or let your AI agent query it.

Indexes any codebase into a structural knowledge graph — every dependency, call chain, cluster, and execution flow. Explore it through an interactive web dashboard with force-directed graph visualization, or expose it through MCP tools so AI agents get full structural understanding in every tool call.

$ axon analyze .

Walking files...               142 files found
Parsing code...                142/142
Tracing calls...               847 calls resolved
Analyzing types...             234 type relationships
Detecting communities...       8 clusters found
Detecting execution flows...   34 processes found
Finding dead code...           12 unreachable symbols
Analyzing git history...       18 coupled file pairs
Generating embeddings...       623 vectors stored

Done in 4.2s — 623 symbols, 1,847 edges, 8 clusters, 34 flows

Then explore your codebase visually:

axon ui                      # Opens interactive dashboard at localhost:8420

Three views, one command:

Explorer — Interactive force-directed graph (Sigma.js + WebGL). Click any node to see its code, callers, callees, impact radius, and community. Community hull overlays show architectural clusters at a glance.
Analysis

Read from source at commit 460d4952f770OBSERVED · 2026-09-27

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code

claude mcp add axon-ui -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "axon-ui": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}

Exposed tools (11)

9 read · 2 write · 0 destructive.

Tool	Risk	Description
`analysis`	read	Switch to Analysis view
`axon_cypher`	write	Execute a raw Cypher query against the knowledge graph.
`axon_dead_code`	read	List all symbols detected as dead (unreachable) code.
`axon_list_repos`	read	List all indexed repositories with their stats.
`communities`	read	Open Communities tab
`cypher`	read	Switch to Cypher view
`dead-code`	read	Open Dead Code tab
`explorer`	read	Switch to Explorer view
`hulls`	read	Toggle community hulls
`minimap`	read	Toggle minimap
`reindex`	write	Trigger reindex

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (3 observation(s))
Network: declared (4 observation(s))
Shell: none-observed
Dependencies: not all pinned
Secrets in source: none-found

Findings (8)

LOWInventory / provenance · inv.no_license · CWE-1104

Why it matters. no LICENSE file and no repo licence

Fix. add a licence

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

tests/web/test_routes.py:734

response = client.get("/file?path=../../etc/passwd")