MCP.Market

Django Chainsaw MCP server

by syrian963·io.github.syrian963/django-chainsaw-mcp·v0.1.5
No reviews yet

Finds what will hurt in a Django project: cascades, N+1, unsafe migrations, tenant leaks.

A92/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A92/100

full report

Adoption
Growing

0 stars107 downloads/wk

Reviews

Write one

Nobody has reviewed Django Chainsaw yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Django Chainsaw tools (37, 4 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • amplification

    Endpoints anyone can call that cost a great deal to answer.

  • api_contract

    The shape every serializer currently promises its clients.

  • api_contract_check

    What this branch changes about the API, and who it breaks.

  • blocking_in_async

    Synchronous calls that run on the event loop.

  • bypassed_effects

    Bulk writes that skip everything the model's save() chain promised.

  • celery_arguments

    Model instances handed to Celery tasks, and calls whose arity is wrong.

  • checkwrite action

    Run every analysis and return one severity-sorted list.

  • choice_typos

    Literals compared against a field whose `choices` will never match them.

  • dangling_references

    URL names and template names that nothing will resolve.

  • datetime_audit

    Naive datetimes in code, and ambiguous defaults on model fields.

  • defeated_prefetches

    Relations that were prefetched and then re-queried anyway.

  • delete_impactwrite action

    Show what deleting one row of a model would take with it.

  • deploy_safetywrite action

    Is a pending destructive migration safe to deploy yet?

  • endpoint_cost

    How many queries one request to each endpoint will cost.

  • escaping_side_effects

    Calls inside a transaction whose effect cannot be rolled back.

  • explain_model

    Everything known about one model, and the risks only visible combined.

  • fastapi_exposure
  • find_n_plus_one

    Find relation traversals in a template that each cost a query.

  • find_unscoped_queries

    Find querysets that read tenant-scoped data without scoping the query.

  • list_models

    List the project's models with their fields and relations.

  • migration_risk

    Rate migrations by what they do to a live database.

  • missing_indexes

    Fields the code filters or sorts on that carry no index.

  • money_precision

    Places where a decimal amount stops being exact.

  • multiplied_aggregates

    Aggregates whose numbers are wrong because a join multiplied the rows.

  • open_endpoints

    Endpoints anyone can call, crossed with what their serializer exposes.

  • project_info

    Check that the target Django project loads, and report what it is.

  • project_profile

    What this project is built on, without needing Django to boot.

  • queries_in_loops

    Database work written inside a loop, split by what the fix is.

  • race_conditions

    Read-modify-save races, and row locks taken outside any transaction.

  • request_impact

    Every finding, grouped by the entry points that actually reach it.

  • scan_templateswrite action

    Run the N+1 analysis over every template in a directory.

  • serializer_exposure

    What each DRF ModelSerializer exposes, and what looks unintended.

  • serializer_nplusone

    N+1 queries in DRF serializers, with the queryset fix for each.

  • sqlalchemy_nplusone
  • suggest_fixes

    Findings turned into code, grouped by how safe each one is to apply.

  • unused_eager_loading

    select_related and prefetch_related the serializer never reads.

  • what_happens_on

    Follow the signal chain a save or delete actually triggers.

Public scan report

scanner v0.1.10 · 2026-10-02 · same rubric, same numbers if you re-run it

no findings
  • Code scan51 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 18 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 92/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Django Chainsaw compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
92/100
higher than 93% of 48,243 servers
Tools
37
the typical server has 7
Tools that change things
11%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
107
more than 64% of 12,306 servers with a package

What its tools let an agent do: 32 read · 1 create · 2 change · 1 delete · 1 run or deploy

Install Django Chainsaw in Claude Code, Cursor or VS Code

claude mcp add django-chainsaw-mcp -- uvx django-chainsaw-mcp
Add to Cursor

What the publisher says

From the Django Chainsaw repository's README, as published. We do not edit it. Read it on GitHub

django-chainsaw-mcp

An MCP server and CLI that analyses a Django project rather than describing it. Not what is in here — what will hurt: what a delete takes with it, which migration breaks the pods still running, which query returns another tenant's row, what a save() sets off three hops away.

There is no model in the loop. Every answer comes from the AST and Django's own app registry, so the same input gives the same output, and nothing leaves the machine. It is an MCP server so an assistant can ask it questions, and a CLI so CI can gate on the answers.

22 checks: 19 need the app registry (16 Django, three of those DRF as well), one needs only Python, one reads FastAPI, one reads SQLAlchemy. Why this exists →

Install

It has to run in an interpreter that can import your project. Everything here reads the app registry, which means django.setup(), your settings and your apps:

/path/to/project/.venv/bin/python -m pip install django-chainsaw-mcp

A plain uvx django-chainsaw-mcp starts and then fails every check, because uvx gives it an isolated environment with no trace of your project. To avoid installing, hand uv the dependencies instead:

uvx --with-requirements requirements.txt --from django-chainsaw-mcp django-chainsaw check

Two environment variables point it at the project:

django-chainsaw project-info proves the setup before anything else, and says which half is missing. Five minutes end to end →

mcp-name: io.github.syrian963/django-chainsaw-mcp

One command

django-chainsaw check --tenant-root myapp.Organisation
44 finding(s): 1 critical, 14 high, 29 medium

CRITICAL
--------
  [deploy-safety] RemoveField drops 'legacy_code' while code still uses it
      shop/0002_remove_product_legacy_code
      During a rolling deploy the old pods keep running against the new
      schema and will fail.
      fix: Ship a release that stops using it, deploy that everywhere,
           then ship this migration.

Every analysis, merged, worst first, one exit code.

On a pull request

This is the part that decides whether a tool like this survives. Point tenancy at a five year old project and it returns two hundred candidates; nobody reads two hundred candidates, somebody adds continue-on-error, and it runs forever with nobody looking.

django-chainsaw tenancy --since main     # only what this branch changed
django-chainsaw tenancy --baseline       # everything old, ratcheted
django-chainsaw check --sarif out.json   # annotate the diff, on the line

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Django Chainsaw: common questions

Is Django Chainsaw MCP server safe?
Yes, by our scan: it is graded A (92/100). Read the Django Chainsaw safety report
How do I install Django Chainsaw?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Django Chainsaw need an API key?
No secret keys are declared. It reads 2 settings from the environment.
Is Django Chainsaw maintained?
The last commit was 53 days ago (2026-09-14). The latest release is v0.1.5.
How does Django Chainsaw compare with other MCP servers?
safety score 92/100 (higher than 93% of 48,243 servers); tools 37 (the typical server has 7); tools that change things 11% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.