Codecanvas MCP server

by donggyun112·io.github.donggyun112/codecanvas·v0.1.20·2 stars

No reviews yet

Python code intelligence for coding agents: call paths, control flow, and change impact.

A88/100grade A

Write a review Install

What users say

No reviews yet

Be the first

Safety scan

A88/100

full report

Adoption

Growing

2 stars52 downloads/wk

Reviews

Write one

Nobody has reviewed Codecanvas yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Codecanvas tools (13, 1 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

analyze_impact
Assess the blast radius of a change — given a diff or git ref, list the changed functions and which entry points/public surfaces they affect (HTTP routes, scripts, or public function fallbacks). Reach for this when reviewing a PR or before merging, to see what a set of edits could break downstream.
call_tree
Trace everything a function reaches downstream — the forward transitive call tree, N hops deep, in one call instead of hopping node-by-node. Reach for this to see what a function ends up doing and which side effects it triggers transitively. The complement of `who_calls`, which walks the opposite direction (upstream, who calls it).
find_symbols
Find project functions, methods, and classes by name, qualified name, scope, acronym, or docstring meaning. Results explain matched tokens, character spans, and likely symbol role. Continue with `next_cursor`; choose `search_mode` name, semantic, or hybrid.
function_flow
Understand how a function works internally without reading the full source. `flow` is a structured branch tree with explicit `subject`, `scope`, `condition`, and `nested_subjects`; `outline` is a compatibility rendering. For exact return/raise guards, use `reaching_conditions`. `function` accepts a qualified name, bare name, file:line, or scope-skipping suffix.
list_entrypoints
Map where a codebase starts — list its API/HTTP routes, CLI scripts, public library exports, and entry-point functions. Reach for this first to get the lay of an unfamiliar project: what endpoints exist, which handler serves each route, where execution begins.
logic_flow
Start here to understand an unfamiliar function's logic in one compact call. Combines symbol resolution, signature and summary, branch outline, guarded outcomes, downstream project calls, effects, and repository-relative citation locations. Prefer this over separately calling `find_symbols`, `what_does`, `function_flow`, `reaching_conditions`, and `call_tree`; use those only when this response is
project_status
Inspect the active analysis root, Python file count, disk-cache state, and nested Python project roots. Use this when results look polluted or incomplete and you may need a narrower `project_path`.
reaching_conditions
Find out under what conditions a function reaches each of its returns and raises — the guard/path conditions (the enclosing if/elif/else, except, and loop tests) leading to each outcome. Reach for this when hunting a bug in branching logic or asking "why does this hit the error path?": it surfaces error-path vs success-path asymmetries (e.g. a success response returned from an except handler), plu
simulate_state_transitionwrite action
Execute focused state-transition repro cases in isolated processes.
validate_state_schema
Check a function's state dict/object usage against expected fields.
verify_claim
Verify a qualified reachability claim before summarizing it.
what_does
Get a quick summary of what a function does without reading its source — its signature, docstring, side effects (whether it touches the database or makes HTTP calls), the exceptions it can raise, and a risk rating. Use it to triage an unfamiliar function before deciding whether to dig into `function_flow` or the full source. `function` = qualified name, bare name, file:line, or a scope-skipping su
who_calls
Find the callers of a function — who calls it, its upstream usages and references, the reverse call graph, and what would break if you change its signature. Complements `call_tree`, which walks the opposite direction (downstream, what the function reaches).

Public scan report

scanner v0.1.10 · 2026-10-15 · same rubric, same numbers if you re-run it

no findings

Code scan32 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenancelast push 33 days ago12/15
Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Overall 88/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

How Codecanvas compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 88/100; higher than 75% of 48,243 servers
Tools: 13; the typical server has 7
Tools that change things: 8%; typical: 0%. Fewer write tools means less an agent can break
GitHub stars: 2; more than 75% of 28,706 servers
Downloads a week: 52; more than 42% of 12,306 servers with a package

What its tools let an agent do: 12 read · 1 change

Install Codecanvas in Claude Code, Cursor or VS Code

claude mcp add codecanvas -- uvx codecanvas-mcp

Add to Cursor

What the publisher says

From the Codecanvas repository's README, as published. We do not edit it. Read it on GitHub

CodeCanvas MCP

Understand an unfamiliar Python system before spending thousands of tokens reading it file by file.

CodeCanvas is a local static-analysis Model Context Protocol server for Python. It turns project-wide call paths and control flow into compact, citation-ready answers about branches, callers, callees, side effects, and change impact.

The benchmark now spans pinned revisions of Google ADK, LangGraph, and FastAPI. On an Apple M4 Pro, measured cold analysis ranged from 4.38s to 61.62s, and median warm findsymbols latency ranged from 48.264ms to 293.778ms across those repositories. In a controlled 54-session agent suite, both conditions kept the same built-in code-search tools; the treatment added only logicflow. That single addition used a median 22.95% fewer total tokens across three paired repetitions, demonstrating meaningful incremental value on top of ordinary code exploration. Uncached tokens increased by 0.78%, and the answers are not yet blind-graded. See the methodology, full tables, and limitations.

Use it to answer questions such as:

Who calls this function, directly or transitively?
What can this function reach, and where do side effects happen?
Under which guards can this return or exception occur?
Does this source really reach that target in the requested mode?
Which API routes, scripts, or public exports are affected by a diff?

CodeCanvas is Python-only and requires Python 3.10 or newer.

See the difference

Ask one question:

Use logic_flow on UserService.update_user. Show its branches, outcomes,
downstream effects, and evidence quality.

Excerpt from the actual response on the included FastAPI sample:

{
  "function": "app.services.user_service.UserService.update_user",
  "source": "app/services/user_service.py:13",
  "flow": [
    "15  user = await self.user_repo.find_by_id(...)",
    "16  if user is None:",
    "17      → return None",
    "18  → return await self.user_repo.update(user_id, user)"
  ],
  "outcomes": [
    {"at": 17, "detail": "None", "guards": ["user is None"]},
    {"at": 18, "detail": "await self.user_repo.update(user_id, user)", "guards": []}
  ],
  "downstream": [
    {
      "function": "app.repositories.user_repo.UserRepository.find_by_id",
      "location": "app/repositories/user_repo.py:13",
      "effects": ["db"]
    },
    {
      "function": "app.repositories.user_repo.UserRepository.update",
      "location": "app/repositories/user_repo.py:18",
      "effects": ["db"]
    }
  ],
  "evidence_grade": "inferred",
  "safe_to_summarize": false,
  "response_guidance": "Do not turn inferred call edges into unconditional claims."
}

That single response exposes the early return, success path, downstream database work, exact source locations, and how cautiously the agent may summarize the result.

Quick start

Install uv if uvx is not already available. The repository includes one shared plugin package with native manifests for both Claude Code and Codex. Install it from the CodeCanvas marketplace:

# Claude Code
claude plugin marketplace add donggyun112/codecanvas
claude plugin install codecanvas@codecanvas

# Codex
codex plugin marketplace add donggyun112/codecanvas
codex plugin add codecanvas@codecanvas

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Grade history

2026-09-19restoreB → Ascore 92

Codecanvas: common questions

Is Codecanvas MCP server safe?: Yes, by our scan: it is graded A (88/100). Read the Codecanvas safety report
How do I install Codecanvas?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Codecanvas need an API key?: Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Codecanvas maintained?: The last commit was 54 days ago (2026-09-12). The latest release is v0.1.20.
What can I use instead of Codecanvas?: Servers from other publishers that do the same job: Sem MCP server and node9 MCP server.
How does Codecanvas compare with other MCP servers?: safety score 88/100 (higher than 75% of 48,243 servers); tools 13 (the typical server has 7); tools that change things 8% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Codecanvas

Same job from other publishers: the closest match first, then the best rated.

Sem
Entity-level code intelligence: semantic diff, impact analysis, blame, and context for AI agents
not reviewed
Widely used
B
node9
Access control for AI agents and MCP servers: allow, hold for approval, or block each tool call
not reviewed
Established
A