Codecanvas MCP server

Read from the package source without running it. The installed server may list more.

• analyze_impact

  Assess the blast radius of a change — given a diff or git ref, list the changed functions and which entry points/public surfaces they affect (HTTP routes, scripts, or public function fallbacks). Reach for this when reviewing a PR or before merging, to see what a set of edits could break downstream.

• call_tree

  Trace everything a function reaches downstream — the forward transitive call tree, N hops deep, in one call instead of hopping node-by-node. Reach for this to see what a function ends up doing and which side effects it triggers transitively. The complement of `who_calls`, which walks the opposite direction (upstream, who calls it).

• find_symbols

  Find project functions, methods, and classes by name, qualified name, scope, acronym, or docstring meaning. Results explain matched tokens, character spans, and likely symbol role. Continue with `next_cursor`; choose `search_mode` name, semantic, or hybrid.

• function_flow

  Understand how a function works internally without reading the full source. `flow` is a structured branch tree with explicit `subject`, `scope`, `condition`, and `nested_subjects`; `outline` is a compatibility rendering. For exact return/raise guards, use `reaching_conditions`. `function` accepts a qualified name, bare name, file:line, or scope-skipping suffix.

• list_entrypoints

  Map where a codebase starts — list its API/HTTP routes, CLI scripts, public library exports, and entry-point functions. Reach for this first to get the lay of an unfamiliar project: what endpoints exist, which handler serves each route, where execution begins.

• logic_flow

  Start here to understand an unfamiliar function's logic in one compact call. Combines symbol resolution, signature and summary, branch outline, guarded outcomes, downstream project calls, effects, and repository-relative citation locations. Prefer this over separately calling `find_symbols`, `what_does`, `function_flow`, `reaching_conditions`, and `call_tree`; use those only when this response is

• project_status

  Inspect the active analysis root, Python file count, disk-cache state, and nested Python project roots. Use this when results look polluted or incomplete and you may need a narrower `project_path`.

• reaching_conditions

  Find out under what conditions a function reaches each of its returns and raises — the guard/path conditions (the enclosing if/elif/else, except, and loop tests) leading to each outcome. Reach for this when hunting a bug in branching logic or asking "why does this hit the error path?": it surfaces error-path vs success-path asymmetries (e.g. a success response returned from an except handler), plu

• simulate_state_transitionwrite action

  Execute focused state-transition repro cases in isolated processes.

• validate_state_schema

  Check a function's state dict/object usage against expected fields.

• verify_claim

  Verify a qualified reachability claim before summarizing it.

• what_does

  Get a quick summary of what a function does without reading its source — its signature, docstring, side effects (whether it touches the database or makes HTTP calls), the exceptions it can raise, and a risk rating. Use it to triage an unfamiliar function before deciding whether to dig into `function_flow` or the full source. `function` = qualified name, bare name, file:line, or a scope-skipping su

• who_calls

  Find the callers of a function — who calls it, its upstream usages and references, the reverse call graph, and what would break if you change its signature. Complements `call_tree`, which walks the opposite direction (downstream, what the function reaches).

• Code scan32 source files scanned25/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitylocal package, no credentials required12/15
• Maintenancelast push 7 days ago15/15
• Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Grade history

• 2026-09-19restoreB → Ascore 92

Codecanvas: common questions

Is Codecanvas MCP server safe?

Yes, by our scan: it is graded A (92/100). Read the Codecanvas safety report

How do I install Codecanvas?

It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.

Does Codecanvas need an API key?

Not as far as the registry entry and our scan can tell: no credentials are declared or required.

Is Codecanvas maintained?

The last commit was 8 days ago (2026-09-12). The latest release is v0.1.20.