crapkit MCP server
io.github.JeanFrancoisGagne/crapkit·v0.8.1·1 starsTwelve tools to inspect CRAP scores, find work, and check edited functions against their ceiling.
1 stars221 downloads/wk
Reviews
Write oneNobody has reviewed crapkit yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
crapkit tools
No tool declarations could be read from the package source. They show once the server is installed.
Public scan report
scanner v0.1.10 · 2026-10-15 · same rubric, same numbers if you re-run it
- Code scan107 source files scanned20/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitylocal package, no credentials required12/15
- Maintenancelast push 9 days ago15/15
- Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Findings (1)
- mediumsubprocess with shell=True
exec.shell-truecrapkit-0.8.1/src/crapkit/config.py: …imeout", }) # Lane commands run under shell=True: sh on POSIX, cmd.exe on Windows. The o…
How crapkit compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 85/100
- higher than 70% of 48,255 servers
- GitHub stars
- 1
- more than 65% of 28,688 servers
- Downloads a week
- 221
- more than 76% of 12,191 servers with a package
Release history: 4 versions in the registry since 2026-09-16, latest 2026-10-01, typically one every 5 days.
Install crapkit in Claude Code, Cursor or VS Code
claude mcp add crapkit -- uvx crapkit
What the publisher says
From the crapkit repository's README, as published. We do not edit it. Read it on GitHub
crapkit
<!-- mcp-name: io.github.JeanFrancoisGagne/crapkit -->
crapkit scores every function in your repo on complexity times uncovered risk, ranks the worst ones by how often the file changes, and blocks commits that add more. It reads Python, TypeScript, TSX, JavaScript, Swift, Go, Rust, shell, PowerShell, C and C++, Objective-C, Vue, Java and Zig through lizard, and joins per-function branch coverage from the istanbul or coverage.py artifact your own test command already writes. JSON commands use sorted keys and a versioned schema for scripts, coding agents and the optional MCP server.
CRAP = ccn^2 * (1 - cov)^3 + ccnThe name is not ours: C.R.A.P. (Change Risk Anti-Patterns) was coined for crap4j by Alberto Savoia and Bob Evans in 2007.
ccn is the smaller of standard and modified cyclomatic complexity, both read off one lizard pass. cov is branch coverage inside the function's span; with no branches it falls back to statement coverage, and with no statements to invoked-or-not, so a half-executed straight-line function never reads as fully covered.
Above the ceiling, coverage cannot save you. Decompose. At the default target of 6, a function at ccn 7 with 100% coverage still scores 7 and still fails the gate. The only move that clears it is splitting the function.
Why 6 and not 30. crap4j's conventional threshold of 30 is a CRAP score: it lets an untested ccn 5 through (25 + 5 = 30) and a fully covered ccn 30 too. crapkit's default is a complexity ceiling, because coverage can at best collapse CRAP to ccn, and a function you cannot cover past ccn 6 is one you decompose. Set target = 30 in crapkit.toml if you want the crap4j number. A repo with existing debt does not need to: ratchet seed marks today's over-ceiling functions at today's score, the gate then judges only the functions a change touches, and marks may only fall, so adoption never starts with a wall of red. Next to crap4py, radon, xenon, wily and SonarQube: docs/comparison.md.
crapkit scores git-tracked files only. Source you have not git added is invisible to it.
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Grade history
- 2026-09-19restoreC → Ascore 85: subprocess with shell=True
crapkit: common questions
- Is crapkit MCP server safe?
- Yes, by our scan: it is graded A (85/100). Read the crapkit safety report
- How do I install crapkit?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does crapkit need an API key?
- Not as far as the registry entry and our scan can tell: no credentials are declared or required.
- Is crapkit maintained?
- The last commit was 29 days ago (2026-10-06). The latest release is v0.8.1.
- How does crapkit compare with other MCP servers?
- safety score 85/100 (higher than 70% of 48,255 servers); github stars 1 (more than 65% of 28,688 servers); downloads a week 221 (more than 76% of 12,191 servers with a package). Full comparison.