Is Ferret Mcp safe to install?

SaferSkills independently audited Ferret Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

README.md · 1 file

README.md4.7 KB · Markdown

Ferret MCP

An MCP server that extracts complete knowledge from any codebase — architecture, patterns, dependencies, API surface. Combines static analysis with AI-powered deep interpretation.

Works with any MCP client: Claude Code, Claude Desktop, Cursor, and more.

Give it a repo, get a senior engineer's analysis in 30 seconds for ~$0.09.

Quickstart

Install & run with uvx (no clone needed)

uvx ferret-mcp

Or install with pip

pip install ferret-mcp

MCP Client Setup

Claude Code

claude mcp add ferret -- uvx ferret-mcp

To enable AI-powered tools (deep, ask), set your API key:

claude mcp add ferret -e FERRET_LLM_API_KEY=sk-ant-... -- uvx ferret-mcp

Claude Desktop / Cursor / Windsurf / any MCP client

Add to your MCP config file (claude_desktop_config.json, .cursor/mcp.json, etc.):

{
  "mcpServers": {
    "ferret": {
      "command": "uvx",
      "args": ["ferret-mcp"],
      "env": {
        "FERRET_LLM_API_KEY": "sk-ant-..."
      }
    }
  }
}

Local development

git clone https://github.com/fabdendev/ferret-mcp.git
cd ferret-mcp
cp .env.example .env   # Add your API key
uv sync
uv run ferret-mcp

Tools

Static Analysis (free, no LLM required)

Tool	Description
`scan`	Repository overview — languages, structure, entry points, config files
`dependencies`	External packages + internal import graph with core modules
`architecture`	Layers, architectural patterns, module breakdown
`patterns`	Design patterns, naming conventions, testing, error handling
`api_surface`	REST endpoints, MCP tools, CLI commands, GraphQL, gRPC, exports
`full_extraction`	All of the above in one comprehensive report

AI-Powered (~$0.09/report with Haiku)

Tool	Description
`deep`	Comprehensive Knowledge Extraction Report — 10-section expert analysis covering architecture, data flow, strengths, risks, and learning takeaways
`ask`	Ask any question about a repo, answered with full codebase context

All tools take a path argument — the absolute path to the repository root directory.

Configuration

AI-powered tools (deep, ask) require an LLM. Configure via environment variables:

Env Var	Default	Description
`FERRET_LLM_PROVIDER`	`anthropic`	`anthropic` or `openai` (for Ollama, vLLM, LM Studio)
`FERRET_LLM_MODEL`	`claude-haiku-4-5-20251001`	Model name
`FERRET_LLM_API_KEY`	—	API key (required for Anthropic; `ollama` for local)
`FERRET_LLM_BASE_URL`	`http://localhost:11434/v1`	Base URL for OpenAI-compatible providers

Use with a local LLM (Ollama)

claude mcp add ferret \
  -e FERRET_LLM_PROVIDER=openai \
  -e FERRET_LLM_BASE_URL=http://localhost:11434/v1 \
  -e FERRET_LLM_MODEL=qwen3:8b \
  -- uvx ferret-mcp

Example Output

The deep tool produces a ~1000-line Knowledge Extraction Report covering:

Executive Summary — what it is, what stage, honest assessment
Architecture Deep Dive — patterns, modules, dependency direction, God Objects
Technology Stack & Rationale — why each choice was made
Data & Control Flow — ASCII diagrams, execution model
Design Patterns & Conventions — with file references
API & Interface Contracts — REST, CLI, MCP, auth model
Key Files Reading Guide — ordered reading path for new contributors
Strengths — what's genuinely well-designed
Risks & Technical Debt — brutal, specific, with fixes
Learning Takeaways — what to steal, what to avoid

Limitations

.gitignore parsing only reads the root-level file (nested .gitignore files are not honored)
Maximum 15,000 files scanned per repository
File content analysis limited to files under 512 KB
AI analysis quality depends on the LLM model used (Haiku is fast/cheap, Sonnet/Opus for deeper analysis)

License

MIT

Ferret Mcp— agent skill

Is Ferret Mcp safe to install?

Ferret MCP

Quickstart

Install & run with uvx (no clone needed)

Or install with pip

MCP Client Setup

Claude Code

Claude Desktop / Cursor / Windsurf / any MCP client

Local development

Tools

Static Analysis (free, no LLM required)

AI-Powered (~$0.09/report with Haiku)

Configuration

Use with a local LLM (Ollama)

Example Output

Limitations

License

Audit the pieces. Scan the whole. Decide.