Scopewalker MCP server

Scopewalker MCP

AI agents will happily create 1000+ line source files and add a 20th parameter to a function call, even if there's a rule file telling them not to. Scopewalker exists to enforce stricter codebase standards.

It's a local MCP server (open source, runs over stdio, makes no network calls) that exposes 9 read-only tools:

• getlinecounts - per-file line counts (total, code, blank, comment) with sorting, extension filters, and project-wide totals
• getfunctions - function and method detection; per-file counts, or per-function line metrics via detail=lines with a minlines filter for hunting oversized functions
• getcomplexitymetrics - max/average nesting depth and parameter counts (JSX props included), import counts, a per-file cognitive-complexity score, and per-function cyclomatic complexity with high/extreme severity bands, plus hotspots flagged for deeply nested or over-parameterized functions
• check_thresholds - flags files and functions exceeding size thresholds (defaults: 300 lines per file, 100 per function)
• getcodeinventory - classes with their methods, functions, interfaces/types, enums, and constants, each marked exported or not; private symbols hidden by default
• getdocumentationcoverage - coverage percentage plus every function, class, or method missing a doc comment (JSDoc, Python docstrings, Rust ///, and other per-language formats)
• getcodesmells - TODO/FIXME/HACK/XXX/BUG/UNUSED/DEPRECATED markers found by scanning actual comments via the AST (no false positives from string literals), plus as unknown as / as any as double casts in TypeScript
• getpropdrilling - parameter names threaded through many functions and files, with forwarding evidence and a high/medium/low risk rating
• finddeadcode - unreferenced top-level symbols and private methods, split into certain deadcode and human-judgment unreferencedexports

It's tree-sitter (parsing) + tokei (line counting) + fast-glob (file discovery) under the hood; nothing is custom-parsed. Tested on macOS with Claude Code, but should work with Cursor, VS Code, Windsurf, Antigravity CLI, Codex, or anything else that speaks MCP.

See TOOLS.md for the quick reference, docs/ for per-tool parameters and example responses, and docs/usage-examples.md for a guide to wiring Scopewalker into skills, subagents, and AGENTS.md.

Safety Defaults

• No network access: All analysis runs locally over stdio: no data leaves your machine, no API keys or external services involved.
• Path scoping: All tools only operate inside allowed roots (defaults: current working directory and system temp). Override with SCOPEWALKERALLOWEDROOTS=/abs/path1,/abs/path2.
• Large file guard: AST-based tools skip files larger than 1 MB to avoid excessive memory/CPU use. Tokei-based line counts do not enforce this limit.
• Input ceilings: maxfiles caps at 10000, maxdepth at 64, limit at 5000.
• Symlinks: Directory scans do not follow symbolic links.
• Output limits: Tools default to returning 20 files/items unless limit is set.
• Comment redaction: getcodesmells redacts comment text by default; pass include_text: true to return snippets explicitly.

Requirements

• Node.js 22+
• tokei - Install via brew install tokei or cargo install tokei

Installation

Scopewalker is published to npm as scopewalker-mcp; no clone or build needed. Configure your MCP client to run it via npx (examples below), or install it globally with npm install -g scopewalker-mcp.

To build from source instead, see Development.

Shortened. The full README is on GitHub.