Project Scope
About
A production-ready MCP server that gives AI agents deep codebase understanding. Features AST-based semantic analysis, context-aware security scanning (zero false positives on source code), safe refactoring tools with previews, and comprehensive Git operations.
Details
- Author
- adityasasidhar
- Downloads
- 698
- Categories
- Developer Tools, Security
Jump to
- Semantic repository analysis using Tree-sitter AST parsing
- Context-aware security scanning with zero false positives
- Safe refactoring tools with mandatory preview before apply
- Git-native operations for status, history, and comparison
- Defense-in-depth security with prompt injection detection
- Fully local execution with no external dependencies
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Project ScopeCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
To use Project Scope, configure your AI agent’s MCP client to connect to this server. You can then invoke its tools, such as get_repo_structure for repository analysis, scan_repo_for_threats for security scanning, refactor_rename for refactoring, and git_status for Git operations.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"project scope": {
"project-scope": {
"command": "npx",
"args": [
"-y",
"@adityasasidhar/project-scope-mcp"
]
}
}
}
}McpServers
{
"project-scope": {
"command": "npx",
"args": [
"-y",
"@adityasasidhar/project-scope-mcp"
]
}
}Project Scope MCP
Semantic code intelligence and safe repository control for AI agents. Project Scope is a production-grade MCP server that gives AI agents deep, structural understanding of codebases and the ability to modify them safely. It goes beyond file reading by combining AST analysis, context-aware security scanning, safe refactoring, and Git operations. Built for real-world agentic development workflows. ---What it does
Project Scope enables AI agents to: Understand code semantically, not textually Analyze dependency graphs and change impact Perform safe, preview-first refactors Scan repositories for real security risks without false positives Interact with Git repositories programmatically Operate under strict security controls ---Core features
Semantic repository analysis Uses Tree-sitter to parse source code into ASTs and build symbol graphs, dependency maps, and reference trees. Context-aware security scanning Security engine understands where code lives and how it is used. Skips source code syntax that resembles attacks Strictly validates runtime inputs Zero false positives on legitimate code Safe refactoring tools Symbol rename across project via AST Function extraction with syntax guarantees Mandatory preview before apply Git-native operations Repository status and history Branch comparison Initialization and inspection Designed for agent-driven workflows Defense-in-depth security Prompt injection detection Regex + heuristic guards Optional LLM Guard integration File access and execution boundaries ---Why Project Scope
Eliminates naive regex-based security scanners Prevents agents from breaking builds during refactors Makes large codebases understandable to LLMs Designed for autonomous and semi-autonomous agents MCP-native and language-agnostic at the protocol level ---Available tools
Repository analysisget_repo_structure, analyze_impact
Security
scan_repo_for_threats, scan_file_for_threats, validate_shell_input
Refactoring
refactor_rename, refactor_extract_function
Git
git_status, git_commit_history, git_compare_branches, git_init
---
Security model
Project Scope uses context-sensitive scanning instead of blanket rules. Source code is parsed, not pattern-matched Comments, imports, and definitions are ignored safely Runtime inputs are strictly validated Configurable strict and advisory modes Optional integration with Meta Llama Prompt Guard 2 for advanced prompt injection detection. ---Use cases
Large codebase understanding Safe autonomous refactoring Secure agent-driven code changes Repository audits Change impact analysis AI-assisted code reviews ---Tech stack
TypeScript Node.js Tree-sitter FastMCP Fully local execution ---Status
Stable. Security-focused. ISC licensed. ---Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
