/ 100

1 month ago

glama

grasp-mcp-server

36 tools for codebase dependency analysis, architecture mapping, circular deps, security scanning, dead code, git timeline, and CI tracking. Works with GitHub repos and local directories.

→ ashfordeOU/grasp · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama PulseMCP npm

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

⚠️

Tool annotations don’t match behaviour

3 read-only tools perform write/delete/exec — grasp_req_trace (line 3775: tagRe.exec(line)); grasp_mro (line 6926: pyClass.exec(content)); grasp_detect_changes (line 8393: execSync(`${gitCmd} --unified=0`, { cwd: repoPath, maxBuffer: 10 * 1024 * 1024 }))

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 14 credentials: BITBUCKET_PASSWORD, GHE_TOKEN, GH_TOKEN, GITEA_TOKEN, GITHUB_APP_TOKEN, GITHUB_CLIENT_SECRET, GITHUB_TOKEN, GITHUB_WEBHOOK_SECRET, GITLAB_OAUTH_CLIENT_SECRET, GITLAB_TOKEN, GRASP_NVD_API_KEY, JIRA_TOKEN, LINEAR_API_KEY, WEBHOOK_SECRET

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configAZURE_DEVOPS_PAT

🔐 secretBITBUCKET_PASSWORD

configBITBUCKET_USERNAME

configBROWSER_EXT_E2E

🔐 secretGHE_TOKEN

🔐 secretGH_TOKEN

🔐 secretGITEA_TOKEN

🔐 secretGITHUB_APP_TOKEN

configGITHUB_CLIENT_ID

🔐 secretGITHUB_CLIENT_SECRET

🔐 secretGITHUB_TOKEN— github-token: ${{ secrets. }}

🔐 secretGITHUB_WEBHOOK_SECRET

configGITLAB_HOST

configGITLAB_OAUTH_CLIENT_ID

🔐 secretGITLAB_OAUTH_CLIENT_SECRET

configGITLAB_OAUTH_REDIRECT_URI

🔐 secretGITLAB_TOKEN

configGRASP_DB

configGRASP_DB_DIR

configGRASP_DISABLE_EMBEDDINGS— grasp_semantic_search slow on first call Embedding model is downloading (~30 MB) First call takes 30-60s; subsequent calls instant. Or set =1 for fallback

configGRASP_EMBED_INIT_TIMEOUT_MS

configGRASP_HOST

🔐 secretGRASP_NVD_API_KEY

configGRASP_PORT

configGRASP_SEMANTIC_MAX_SIGS

configJIRA_BASE_URL

configJIRA_EMAIL

🔐 secretJIRA_TOKEN

🔐 secretLINEAR_API_KEY

configMCP_DIST_PATH

configPORT

configSTRIPE_PRO_PRICE_ID

🔐 secretWEBHOOK_SECRET

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/ashfordeou-grasp-vhx20k)](https://m8ven.ai/mcp/ashfordeou-grasp-vhx20k)

commit: 35ee8ea9c97174cf26e3b593627ac77293b16921

code hash: aadfcc4eb5d60a1e2224b4174c2855e0948da750023a84634715b3ebc3c2468f

verified: 6/10/2026, 10:49:11 AM

view raw JSON →