grasp-mcp-server a

+3 native AST languages— Bash, Elixir, and Julia take tree-sitter-backed function extraction, call counting, and complexity scoring to19 languages.

Optional MCP-over-HTTP bridge— setGRASP_HTTP_MCP=1to expose the MCP server over Streamable HTTP (bearer-token auth) so a whole team can share one Grasp instance instead of each running their own stdio server.

Previously in v3.20.0:Full security scanning suite —grasp_vulnerabilitiescovers5 threat vectors(OSV.dev dependency CVEs, NIST NVD container/runtime CVEs, local supply-chain integrity checks, Socket.dev behavioral analysis, and scheduledgrasp_vuln_watchmonitoring) withskip_container/skip_socket/skip_integrityfast-scan flags.

Previously in v3.19.0:Full visual + UX parity betweenteam-dashboard.htmlandindex.html— teal brand sweep, SVG icons, 7-provider auth, mobile More menu, keyboard shortcut popover.

Previously in v3.18.0:9 new MCP tools (graph analytics + LLM-context), 11 graph export formats, TypeScript path-alias + Python import resolvers, Claude Code slash commands, token-reduction eval harness (3,241× ongot@v14).

Total as of v3.21.0:150 MCP tools · 8 Resources · 2 Prompts · 35 languages · 11 graph export formats · 10 graph views · multimodal knowledge graph · 19 themes.

Graspturns any GitHub or GitLab repository — cloud or self-hosted — or local codebase into an interactive architecture map in seconds.150 MCP tools(plus 8 Resources and 2 guided Prompts) expose the full analysis engine to Claude Code, Cursor, and any MCP-compatible agent.

Paste URL / Open Folder → AST Analysis Engine → Architecture Map + 150 MCP Tools

Grasp is intentionally additive to whatever static-analysis or graph tool you already use. The axes that matter:

🕸️ Dependency Graph — see exactly how files connect

🏛️ Architecture Diagram — your codebase by layer

🏢 Team Dashboard — health across all your repos at a glance

git clone https://github.com/ashfordeOU/grasp.git open index.html # Main app open team-dashboard.html # Team Dashboard

No build step. Nonpm install.Two HTML files.

npm install -g grasp-mcp-server grasp ./my-project # Analyse a local folder grasp facebook/react # Analyse a GitHub repo grasp . # Analyse current directory grasp . --watch # Live mode — browser reloads on every file save grasp . --timeline # Time-travel — last 30 commits as a scrubber grasp . --report # Terminal-only report + JSON output grasp . --format=sarif # Export SARIF for GitHub Code Scanning grasp . --pr-comment # Print GitHub PR comment markdown to stdout grasp . --check # Enforce grasp.yml architecture rules (CI gate)

A floatingGraspbutton appears on every GitHub and GitLab page. Supports self-hosted GitLab, GitHub Enterprise, and any custom host via on-demand permission grants.

Every tagged release auto-publishes to all channels:

AI-tool integrations(Grasp called by your assistant via MCP or extension)

curl -sL https://github.com/ashfordeOU/grasp/releases/latest/download/grasp-safari-extension.zip \ -o /tmp/grasp-safari.zip \ && unzip -q /tmp/grasp-safari.zip -d /tmp/grasp-safari \ && mv /tmp/grasp-safari/Grasp.app /Applications/ \ && open /Applications/Grasp.app

Then in Safari:Settings → Extensions → enable Grasp. If it doesn't appear, enableSafari → Develop → Allow Unsigned Extensionsfirst.

┌──────────────────────────────────────────────────────────────────┐ │ Input │ │ github.com/owner/repo · gitlab.com/ns/proj · ./local/path │ └────────────────────────────────┬─────────────────────────────────┘ ▼ ┌──────────────────────────────────────────────────────────────────┐ │ Analysis Pipeline (mcp/src/) │ │ │ │ 1. scan file enumeration + gitignore │ │ 2. parse tree-sitter AST · 35 languages · 19 native │ │ 3. resolvers tsconfig path-alias · Jedi-style Python imports │ │ 4. routes HTTP route detection (Express/FastAPI/Gin) │ │ 5. tools MCP/gRPC tool definition detection │ │ 6. orm ORM query tracking (Prisma/TypeORM/Sequelize/SA) │ │ 7. scope 3-tier call resolver (0.95 → 0.90 → 0.50) │ │ 8. types cross-file type propagation (Kahn topo-sort) │ │ 9. coverage test-file detection → TESTS/COVERS edges (v3) │ │ 10. communities Louvain community detection on import graph │ │ 11. processes BFS execution-flow tracing from entry points │ │ 12. analytics degree centrality · Brandes betweenness · │ │ surprising-edge rarity · knowledge-gap detection │ │ 13. vulns OSV.dev SCA scan (npm/PyPI/Go/Cargo/Maven) │ └───────────┬──────────────────────────┬────────────────────────────┘ │ │ ┌───────▼─────────┐ ┌───────────▼─────────────────┐ │ Browser App │ │ MCP Server (CLI) │ │ index.html │ │ grasp-mcp-server │ │ │ │ │ │ 10 graph views │ │ 150 tools · 8 Resources │ │ 16 color modes │ │ 2 guided Prompts │ │ AI Chat (11p) │ │ Brain + Kuzu Schema v3 │ │ Ask Grasp │ │ Hybrid search (BM25+vector) │ │ Coverage overlay│ │ Graph analytics (5 tools) │ │ VULN tab │ │ LLM-context (4 tools) │ │ Try-it chips │ │ Graph exports (GraphML / │ │ Token indicator │ │ Cypher / Obsidian) │ │ Snapshot URLs │ │ Slash commands (3 in │ │ Compare modal │ │ .claude/commands/) │ │ Mid-fetch retry │ │ grasp setup (5 editors) │ │ Mobile touch │ │ grasp vulns / drift / org │ └─────────────────┘ └──────────────────────────────┘

Analysis flow (v3.18.0):the pipeline is additive — phase 12 (graph analytics) runs after the dependency graph is built and produces the data backinggrasp_hub_nodes,grasp_bridge_nodes,grasp_surprising_connections,grasp_knowledge_gaps, andgrasp_suggested_questions. Phase 13 only runs when a manifest (package.json,requirements.txt,go.mod,Cargo.toml,pom.xml) is present. Both browser and MCP server share the exact same pipeline output via the~/.grasp/brain.db+~/.grasp/graph/pair so a CLIgrasp indexand a browser analyze of the same repo are interchangeable.

InstantA–F gradebased on dead code, circular dependencies, coupling metrics, and security issues. Displayed as a score (0–100) with a visual bar.

Automatic detection of hardcoded secrets & API keys, SQL injection risks, dangerouseval()usage, and debug statements left in production.

🛡️ Dependency & Container Security Scanner(v3.17.0, expanded v3.20.0)

Five-layer security scan viagrasp_vulnerabilities:

"If I change this file, what breaks?"— select any file and see every downstream file that would be affected, highlighted on the graph.

🧠 Multimodal Knowledge Graph(MCP server)

🎯 Connection Confidence Scoring(v3.16.0)

🔐 PII Detection & Security Subcategories(v3.16.0)

📸 Architecture Drift Detection(v3.17.0)

grasp snapshot ./my-project --name before-refactor # ... make changes ... grasp drift ./my-project # exits 1 if drift is CRITICAL (CI-friendly)

grasp_coverage_gaps # via MCP — returns uncovered_functions sorted by call_count DESC

The dependency graph gains a🧪 Coverage overlaytoggle — uncovered functions render in red, partially-covered in amber, covered in green. Coverage is estimated by static analysis: Grasp detects test files (.test.,.spec.,test_,_test.) and traces which source functions they reference.

Analyse an entire GitHub organisation in one command:

grasp org my-github-org --token ghp_xxx --format html # Self-contained HTML dashboard grasp org my-github-org --format json # CI-consumable JSON grasp org my-github-org --format md # Markdown for wikis

Aggregates health grades, security findings, most-churned files, and language distribution across all repos (up to 500, 5 concurrent). The HTML output embeds Chart.js inline — no external dependencies.

Add automated architectural impact analysis to every pull request:

# .github/workflows/grasp-pr-impact.yml - uses: ashfordeOU/grasp/.github/actions/grasp-pr-impact@main with: github-token: ${{ secrets.GITHUB_TOKEN }} min-risk-to-comment: LOW # LOW / MEDIUM / HIGH / CRITICAL fail-on-risk: CRITICAL # fail the CI check at this risk level

The action posts a structured PR comment showing:

- Risk badge(LOW / MEDIUM / HIGH / CRITICAL) with colour coding
- Changed files with function-level blast radius
- Affected execution processes (with step counts)
- Suggested reviewers fromgit blame(top 2 contributors per affected file)
- Test coverage gaps: which changed functions have no test file touching them

Built-in AI assistant that knows your entire codebase. Ask"why is auth.ts a hotspot?","which files are safest to refactor?", or"explain the security issues in this call chain"— answers reference your live dependency graph, security findings, and architectural layers.

- Multi-turn conversation memory — persisted inlocalStorageacross page refreshes
- Selected-file context — layer, functions, complexity, and issues injected automatically when a file is selected
- Rich codebase context — top 80 files with metadata, all issues, security findings, circular deps, layer breakdown
- Markdown rendering with syntax-highlighted code blocks
- API key stays in your browser only, never sent anywhere except the chosen provider

Grasp Brain — Persistent Architecture Intelligence(v3.16.0)

Grasp Brain combines two persistent stores that work together:

- SQLite Brain(~/.grasp/brain.db) — file metadata, coupling, security, and issue index. Includes a FTS5 full-text index over functions and an in-process 384D vector embedding store (Xenova/all-MiniLM-L6-v2 — no cloud dependency). Index once, query instantly.
- Kuzu Graph DB(~/.grasp/graph/) — native graph database with Cypher query support. Stores the full function call graph, file imports, and type relationships as a traversable property graph.