{"name":"ai.papyruslabs/seshat-mcp","slug":"papyruslabs-seshat-mcp","title":null,"description":"Structural code intelligence for AI agents: real call graphs, blast radius, and change history.","url":"https://mcp.market/server/papyruslabs-seshat-mcp","rating":null,"grade":"B","score":80,"certified":false,"status":"active","category":"other","tags":[],"presence":{"score":20,"stars":0,"forks":0,"downloads_week":2,"last_push_at":"2026-10-02T01:40:42.000Z","license":"MIT"},"uptime":null,"claimed":false,"transport":"npm","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/papyruslabs-ai/seshat-mcp","website":"https://seshat.papyruslabs.ai","version":"0.20.2","remotes":[],"packages":[{"registryType":"npm","identifier":"@papyruslabsai/seshat-mcp","version":"0.20.2","transport":{"type":"stdio"},"environmentVariables":[{"description":"Your Seshat API key. Get one free at https://seshat.papyruslabs.ai","isRequired":true,"isSecret":true,"name":"SESHAT_API_KEY"}]}],"tools":[{"name":"conflict_matrix","description":"Given multiple planned tasks, check which ones can run in parallel safely. Classifies every task pair: Tier 1 (different files, safe), Tier 2 (same file different symbols, careful), Tier 3 (same symbol, must sequence). Returns a matrix and suggested execution order.","write_action":false,"price_micros":0,"input_schema":null},{"name":"create_symbol","description":"Register a planned new symbol in the graph before it exists on disk. This lets simulate_mutation and conflict_matrix reason about code you haven't written yet. Nothing is written to disk.","write_action":true,"price_micros":0,"input_schema":null},{"name":"diff_bundle","description":"Compare a worktree against the loaded project to see what changed structurally — not a line diff, but which symbols were added, removed, or had their signatures/dependencies changed. Use this after making changes to verify the structural impact.","write_action":false,"price_micros":0,"input_schema":null},{"name":"estimate_task_cost","description":"Before starting a code change, estimate how many tokens it will consume. Computes the blast radius, sums source tokens across all affected symbols, and projects total burn including iteration cycles. Use this to check if a task fits your context budget before committing to it.","write_action":false,"price_micros":0,"input_schema":null},{"name":"find_by_constraint","description":"Find every function with a specific syntactic constraint tag — AUTH (requires authentication), DB_ACCESS (touches database), THROWS (explicit throw statement), PURE (no side effects), NETWORK_IO (makes HTTP calls), VALIDATED (has input validation). Also supports table-level queries: pass table=\"walks\" to find every function that reads or writes the walks table (answers \"what touches this table?\" f","write_action":false,"price_micros":0,"input_schema":null},{"name":"find_dead_code","description":"Find functions that nothing calls. Walks the call graph from all entry points (routes, exports, tests) and flags symbols that are unreachable. Use this during cleanup or before a release to find safe deletion candidates.","write_action":false,"price_micros":0,"input_schema":null},{"name":"find_entry_points","description":"List the ways into the system: route/controller handlers, test entries, framework plugin registrations, and exported symbols (the public API surface), classified by kind and ranked by reach. Call it first when orienting in an unfamiliar codebase — it answers \"where does execution start, and what is the public surface?\" Complements list_modules (structure) and find_dead_code (its exact inverse: the","write_action":false,"price_micros":0,"input_schema":null},{"name":"find_error_gaps","description":"Find crash risks: functions that throw or have network/DB side effects whose callers don't catch errors. Returns the specific caller→callee pairs where exceptions can propagate unhandled. Use this before shipping to find missing error handling.","write_action":false,"price_micros":0,"input_schema":null},{"name":"find_exposure_leaks","description":"Find places where public/API code directly accesses private internals, bypassing the intended abstraction boundary. Use this during API design reviews or before extracting a module.","write_action":false,"price_micros":0,"input_schema":null},{"name":"find_layer_violations","description":"Find places where the architecture is broken — a database repository calling a route handler, a utility importing a component. Returns every backward or skip-layer dependency that violates clean architecture.","write_action":false,"price_micros":0,"input_schema":null},{"name":"find_ownership_violations","description":"Find memory and lifecycle issues — entities with complex ownership, unsafe blocks, escaping references, or illegal mutability on borrowed data. Returns 0 for most JS/Python codebases — a non-zero result in those languages indicates a serious boundary violation worth investigating. Most detailed results for Rust and C++.","write_action":false,"price_micros":0,"input_schema":null},{"name":"find_semantic_clones","description":"Find duplicated logic across the codebase. Normalizes variable names and compares code structure to catch identical algorithms in different files — even across different languages. Use this before a DRY refactor.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_account_status","description":"See your current plan, available tools, and credit balance. Call this if a tool returns a tier error or you want to know what tools are available.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_auth_matrix","description":"Audit authentication coverage. Shows which API routes and controllers require auth and which don't, plus inconsistencies like database access without auth checks. For large codebases, use the module parameter to drill into a specific module/directory. Most useful for backend codebases with middleware-based auth. Frontend frameworks (React, Vue) handle auth via component wrappers, which this tool w","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_blast_radius","description":"Before modifying a function, call this to see everything that could break. Returns all transitively affected symbols — both upstream callers and downstream callees — with distance from the change point. Like git log --follow but for runtime impact. Designed for repeated use: as you discover new symbols with other tools, call this again on them to expand your understanding of the affected surface.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_co_change_clusters","description":"The codebase's hidden modules: groups of symbols that historically change together (≥3 shared commits, sweep commits excluded), computed from real commit history. Clusters that span multiple directories reveal coupling the file tree doesn't show. Call it when planning a change or splitting work across agents — touching one member of a cluster usually means touching the rest, even when no static de","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_coupling_metrics","description":"Measure how tangled your code is. Returns coupling (cross-boundary dependencies), cohesion (within-group dependencies), and instability scores. High coupling + low cohesion = refactoring candidates. Start with group_by: \"layer\" for the architectural health view (\"are my controllers more coupled than my services?\"), then drill into group_by: \"module\" for specific hotspots.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_data_flow","description":"See what data a function reads, returns, and mutates (DB writes, state changes). Use this when debugging data bugs or when you need to verify whether a function has side effects before refactoring it.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_dependencies","description":"Trace who calls a function and what it calls, up to N levels deep. Use this instead of grep-for-function-name when you need the actual call chain — returns the dependency graph, not text matches. Covers callers (upstream), callees (downstream), or both.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_entity","description":"Get everything about one function or class — its signature, callers, callees, data flow, constraints, source location, and database operations (which tables it reads/writes). Use this when you need to deeply understand a single symbol before modifying it. Returns more than reading the source file because it includes the dependency context.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_hotspots","description":"Project-level change-history orientation: the most-changed entities (and what kind of change dominates each), low-survival thrash spots where changes don't stick, heavily-depended-on entities that haven't changed all window (interface freeze), and directories with no recent changes. Call it after list_modules when orienting in a codebase — it answers \"where does development actually happen, and wh","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_lineage","description":"The change history of one symbol, typed by what kind of change each commit made (body, calls, data, signature, constraints…), with CI verdicts, reverts, rename tracking, co-change partners, and rejected PRs that touched it. Call before modifying anything load-bearing: it answers \"how does this entity usually change, and what happened last time someone tried?\" — which no text diff can. Complements ","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_optimal_context","description":"Before working on a function, call this to get the most relevant related code ranked by importance and fitted to a token budget. Returns a prioritized reading list of symbols you should understand — better than guessing which files to open. Designed for iterative use: call it on your target, read the top results, then call it again on any surprising dependencies to build a complete picture.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_test_coverage","description":"See which production functions are actually exercised by tests via the call graph — semantic coverage, not line coverage. Optionally ranks uncovered functions by blast radius so you know which missing tests are riskiest.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_topology","description":"Get the full API surface map in one call — all routes, middleware, auth patterns, and database tables. Use this when you need to understand the overall architecture without reading every file. Returns the information you'd normally piece together from dozens of file reads.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_modules","description":"Get a bird's-eye view of how the codebase is organized. Groups all symbols by architectural layer (route/service/component), module, file, or language with counts. Use this to orient yourself in an unfamiliar codebase before diving into specifics.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_projects","description":"Start here. Returns all synced codebases with their size, language, and project name. You need the project name for every other tool. If this returns empty, use sync_project to import the current repo.","write_action":false,"price_micros":0,"input_schema":null},{"name":"query_data_targets","description":"Find every function that reads from or writes to a specific database table, state object, or data source. Use this when you need to understand all the code paths that touch a particular data store.","write_action":false,"price_micros":0,"input_schema":null},{"name":"query_entities","description":"Like grep but for code structure. Find functions, classes, and routes by name, architectural layer (route/service/component), or module. Returns matching symbols with their type, file, and layer — use this instead of grep when you need to find code by what it does, not by text content.","write_action":false,"price_micros":0,"input_schema":null},{"name":"query_traits","description":"Find functions by inferred behavioral trait — \"fallible\" (can fail, including transitively via callees that throw), \"asyncContext\" (carries async state), \"generator\" (yields values). Traits are semantic properties inferred from the call graph, not just syntax. Use this when you need to find all code with a specific capability. For syntactic tags (explicit throw statements, DB access), use find_by_","write_action":false,"price_micros":0,"input_schema":null},{"name":"simulate_mutation","description":"Simulate a hypothetical code change without writing anything. Five mutation dimensions: constraints/traits (behavioral tags — who upstream breaks), edges (add/remove calls — orphaned callees, inherited error handling and data contracts), data (add/remove table access — which co-tenants of the table must be reviewed), signature (param changes — which call sites break). Use this to plan a change bef","write_action":false,"price_micros":0,"input_schema":null},{"name":"sync_project","description":"Import a public GitHub repo into Seshat for structural analysis. Call this when list_projects returns empty or when the user wants to analyze a new repo. Detects the git remote automatically if no URL is provided. Extraction typically takes 5-30 seconds. After syncing, call list_projects to confirm the project is available. Use force: true to re-extract even if a cached snapshot exists (useful aft","write_action":false,"price_micros":0,"input_schema":null},{"name":"trace_boundaries","description":"Identify the boundary surface of one or two codebases — entities that face outward (expose an API, accept network input, make network calls). When given two projects, surfaces both boundary sets so you can trace the handshake between a backend and frontend, detect orphaned routes with no consumer, or find frontend calls with no matching backend handler. Works across any language — boundaries are d","write_action":false,"price_micros":0,"input_schema":null},{"name":"trace_data_path","description":"Follow data from one function through the call graph to its sinks. From a start entity it walks callees, records the data each hop consumes/produces/mutates, and reports the chain from the start to every sink the data reaches — database writes, network egress, filesystem writes — plus the tables touched. Call it before changing a function that handles real data: it answers \"where does this data en","write_action":false,"price_micros":0,"input_schema":null}],"scan":{"score":80,"grade":"B","scanned_at":"2026-10-02T06:05:59.026Z","report":{"scannerVersion":"0.1.10","scannedAt":"2026-10-02T06:05:59.081Z","components":{"code":{"score":25,"max":25,"notes":["2 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":6,"max":15,"notes":["static API keys via environment variables"]},"maintenance":{"score":15,"max":15,"notes":["last push 0 days ago"]},"identity":{"score":6,"max":10,"notes":["namespace and repository owner differ","website matches verified namespace"]}},"findings":[],"inputs":{"packages":[{"registryType":"npm","identifier":"@papyruslabsai/seshat-mcp","version":"0.20.2","found":true,"license":"MIT","hasInstallScripts":false,"dependencyCount":1,"publishedAt":"2026-10-02T01:44:40.500Z","repositoryUrl":"git+https://github.com/papyruslabs-ai/seshat-mcp.git","weeklyDownloads":2}],"repo":{"found":true,"owner":"papyruslabs-ai","repo":"seshat-mcp","archived":false,"pushedAt":"2026-10-02T01:40:42Z","stars":0,"forks":0,"openIssues":0,"ownerType":"Organization","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/244227193?v=4","ownerCreatedAt":"2025-11-15T18:50:49Z","license":"MIT"},"icon":{"url":null,"source":"none"},"presence":{"stars":0,"forks":0,"downloadsWeek":2,"license":"MIT","lastPushAt":"2026-10-02T01:40:42.000Z","score":20}}}},"grade_history":[],"reviews":[]}