settings — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited settings (Hook) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
AI assistants struggle with codebase understanding. You get:
XRAY gives AI assistants code navigation capabilities. Add use XRAY tools to your prompt:
Analyze the UserService class and show me what would break if I change the authenticate method. use XRAY toolsFind all functions that call validate_user and show their dependencies. use XRAY toolsXRAY provides three focused tools:
explore_repo) - See project structure with symbol skeletonsfind_symbol) - Locate functions and classes with fuzzy searchwhat_breaks) - Find where a symbol is referenced# Install directly from PyPI with pip
pip install git-project-xray-mcp
# Or with uv (faster)
uv pip install git-project-xray-mcp
# Then run
git-project-xray-mcp# Install uv if you don't have it
curl -LsSf https://astral.sh/uv/install.sh | sh
# Install as a uv tool
uv tool install git-project-xray-mcp
# Then run from anywhere
git-project-xray-mcpFor the quickest setup, this script automates the uv installation process.
curl -fsSL https://raw.githubusercontent.com/Jamie-BitFlight/git-project-xray-mcp/main/install.sh | bashgit clone https://github.com/Jamie-BitFlight/git-project-xray-mcp.git
cd xray
uv tool install .# Get config for your tool
uv run python mcp-config-generator.py cursor local_python
uv run python mcp-config-generator.py claude docker
uv run python mcp-config-generator.py vscode sourceXRAY uses ast-grep, a tree-sitter powered structural search tool, providing accurate parsing for:
ast-grep ensures structural accuracy - it understands code syntax, not just text patterns.
# First: Get the big picture (directories only)
tree = explore_repo("/path/to/project")
# Returns:
# /path/to/project/
# ├── src/
# ├── tests/
# ├── docs/
# └── config/
# Then: Zoom into areas of interest with full details
tree = explore_repo("/path/to/project", focus_dirs=["src"], include_symbols=True)
# Returns:
# /path/to/project/
# └── src/
# ├── auth.py
# │ ├── class AuthService: # Handles user authentication
# │ ├── def authenticate(username, password): # Validates user credentials
# │ └── def logout(session_id): # Ends user session
# └── models.py
# ├── class User(BaseModel): # User account model
# └── ... and 3 more
# Or: Limit depth for large codebases
tree = explore_repo("/path/to/project", max_depth=2, include_symbols=True)# Find symbols matching "authenticate" (fuzzy search)
symbols = find_symbol("/path/to/project", "authenticate")
# Returns list of exact symbol objects with name, type, path, line numbers# Find where authenticate_user is used
symbol = symbols[0] # From find_symbol
result = what_breaks(symbol)
# Returns: {"references": [...], "total_count": 12,
# "note": "Found 12 potential references based on text search..."}FastMCP Server (mcp_server.py)
↓
Core Engine (src/xray/core/)
└── indexer.py # Orchestrates ast-grep for structural analysis
↓
ast-grep (external binary)
└── Tree-sitter powered structural searchStateless design - No database, no persistent index. Each operation runs fresh ast-grep queries for real-time accuracy.
Traditional grep searches text. ast-grep searches code structure:
def authenticate() or function authenticate() definitionsThis structural approach provides clean, accurate results essential for reliable code intelligence.
focus_dirs to zoom into specific parts of large codebasesXRAY helps AI assistants avoid information overload while providing deep code intelligence where needed.
XRAY performs on-demand structural analysis using ast-grep. There's no database to manage, no index to build, and no state to maintain. Each query runs fresh against your current code.
getting_started.md for modern installationexplore_repo("/path/to/project")find_symbol("/path/to/project", "UserService")what_breaks(symbol)XRAY bridges the gap between simple text search and complex LSP servers:
A simple tool that helps AI assistants navigate codebases more effectively than text search alone.
The current implementation of XRAY is the result of a rigorous evaluation of multiple code analysis methodologies. My journey involved prototyping and assessing several distinct approaches, each with its own set of trade-offs. Below is a summary of the considered architectures and the rationale for my final decision.
grep for symbol identification. While expedient, this method proved fundamentally inadequate due to its inability to differentiate between syntactical constructs and simple text occurrences (e.g., comments, strings, variable names). The high signal-to-noise ratio rendered it impractical for reliable code intelligence.tree-sitter was evaluated to leverage its powerful parsing capabilities. However, this path was fraught with significant implementation complexities, including intractable errors within the parser generation and binding layers. The maintenance overhead and steep learning curve for custom grammar development were deemed prohibitive for a lean, multi-language tool.Comby was explored for its structural search and replacement capabilities. Despite its promising feature set, I encountered significant runtime instability and idiosyncratic behavior that undermined its reliability for mission-critical code analysis. The tool's performance and consistency did not meet my stringent requirements for a production-ready system.ast-grep. This tool provides the optimal balance of structural awareness, performance, and ease of integration. By leveraging tree-sitter internally, it offers robust, syntactically-aware code analysis without the complexities of direct tree-sitter integration or the overhead of LSPs. Its reliability and rich feature set for structural querying made it the unequivocal choice for XRAY's core engine.XRAY is a minimal-dependency code intelligence system that enhances AI assistants' understanding of codebases. This guide shows how to install and use XRAY with the modern uv package manager.
# macOS/Linux
curl -LsSf https://astral.sh/uv/install.sh | sh
# Windows
powershell -c "irm https://astral.sh/uv/install.ps1 | iex"
# Or with pip
pip install uvFor the quickest setup, use the one-line installer from the README.md. This will handle everything for you.
curl -fsSL https://raw.githubusercontent.com/Jamie-BitFlight/git-project-xray-mcp/main/install.sh | bashRun XRAY directly without installation using uvx:
# Clone the repository
git clone https://github.com/Jamie-BitFlight/git-project-xray-mcp.git
cd xray
# Run XRAY directly with uvx
uvx --from . git-project-xray-mcpInstall XRAY as a persistent tool:
# Clone and install
git clone https://github.com/Jamie-BitFlight/git-project-xray-mcp.git
cd xray
# Install with uv
uv tool install .
# Now you can run git-project-xray-mcp from anywhere
git-project-xray-mcpFor contributing or modifying XRAY:
# Clone the repository
git clone https://github.com/Jamie-BitFlight/git-project-xray-mcp.git
cd xray
# Create and activate virtual environment with uv
uv venv
source .venv/bin/activate # On Windows: .venv\Scripts\activate
# Install in editable mode
uv pip install -e .
# Run the server
python -m xray.mcp_serverAfter installation, configure your AI assistant to use XRAY:
For easier configuration, use the mcp-config-generator.py script located in the XRAY repository. This script can generate the correct JSON configuration for various AI assistants and installation methods.
To use it:
cd /path/to/xraygit-project-xray-mcp script: python mcp-config-generator.py claude installed_scriptOr for VS Code with a local Python installation:
python mcp-config-generator.py vscode local_pythonThe script will print the JSON configuration and instructions on where to add it.
Available tools: cursor, claude, vscode Available methods: local_python, docker, source, installed_script (method availability varies by tool)
If you prefer to configure manually, here are examples for common AI assistants:
#### Claude CLI (Claude Code)
For Claude CLI users, simply run:
claude mcp add xray git-project-xray-mcp -s localThen verify it's connected:
claude mcp list | grep xray#### Claude Desktop
Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS):
{
"mcpServers": {
"xray": {
"command": "uvx",
"args": ["--from", "/path/to/xray", "git-project-xray-mcp"]
}
}
}Or if installed as a tool:
{
"mcpServers": {
"xray": {
"command": "git-project-xray-mcp"
}
}
}#### Cursor
Settings → Cursor Settings → MCP → Add new global MCP server:
{
"mcpServers": {
"xray": {
"command": "git-project-xray-mcp"
}
}
}One of XRAY's best features is its minimal dependency profile. You don't need to install a suite of language servers. XRAY uses:
This means you can start using XRAY immediately after installation with no complex setup!
# If installed as tool
git-project-xray-mcp --version
# If using uvx
uvx --from /path/to/xray git-project-xray-mcp --versionCreate a test file test_xray.py:
def hello_world():
print("Hello from XRAY test!")
def calculate_sum(a, b):
return a + b
class Calculator:
def multiply(self, x, y):
return x * yBuild the index for the current directory. use XRAY toolsExpected: Success message with files indexed
Find all functions containing "hello". use XRAY toolsExpected: Should find hello_world function
What would break if I change the multiply method? use XRAY toolsExpected: Impact analysis showing any dependencies
Once configured, use XRAY by adding "use XRAY tools" to your prompts:
# Index a codebase
"Index the src/ directory for analysis. use XRAY tools"
# Find symbols
"Find all classes that contain 'User' in their name. use XRAY tools"
# Impact analysis
"What breaks if I change the authenticate method in UserService? use XRAY tools"
# Dependency tracking
"What does the PaymentProcessor class depend on? use XRAY tools"
# Location queries
"What function is defined at line 125 in main.py? use XRAY tools"Make sure uv is in your PATH:
# Add to ~/.bashrc or ~/.zshrc
export PATH="$HOME/.cargo/bin:$PATH"On macOS/Linux, you might need to make the script executable:
chmod +x ~/.local/bin/git-project-xray-mcpXRAY requires Python 3.10+. Check your version:
python --version
# If needed, install Python 3.10+ with uv
uv python install 3.10git-project-xray-mcp --testSet the XRAY_DB_PATH environment variable:
export XRAY_DB_PATH="$HOME/.xray/databases"Enable debug logging:
export XRAY_DEBUG=1build_index - Visual file tree of your repositoryfind_symbol - Fuzzy search for functions, classes, and methodswhat_breaks - Find what code depends on a symbol (reverse dependencies)what_depends - Find what a symbol depends on (calls and imports)Note: Results may include matches from comments or strings. The AI assistant will intelligently filter based on context.
git clone https://github.com/Jamie-BitFlight/git-project-xray-mcp.git
cd git-project-xray-mcpuv syncThis installs XRAY in editable mode along with:
ruff - Fast linter and formatter (replaces flake8, black, isort)mypy - Static type checkerpytest - Testing frameworkpytest-cov - Code coverage plugin# Run all tests
uv run pytest tests/
# Run with coverage
uv run pytest tests/ --cov=xray --cov-report=term-missing
# Run specific test file
uv run pytest tests/test_indexer.py -vLinting:
# Check code with ruff
uv run ruff check src/ tests/
# Auto-fix issues
uv run ruff check --fix src/ tests/Formatting:
# Check formatting
uv run ruff format --check src/ tests/
# Format code
uv run ruff format src/ tests/Type Checking:
# Run mypy type checker
uv run mypy src/The project uses GitHub Actions for CI/CD:
CI runs automatically on:
main or develop branchesmain or develop branchesgit-project-xray-mcp/
├── src/xray/ # Main source code
│ ├── mcp_server.py # FastMCP server and tool definitions
│ └── core/
│ └── indexer.py # Core indexing engine
├── tests/ # Test suite
│ ├── test_indexer.py # Tests for indexer
│ └── test_mcp_server.py # Tests for MCP server
├── .github/workflows/ # GitHub Actions CI
│ └── ci.yml # Linting and testing workflow
└── pyproject.toml # Project configurationXRAY is designed for simplicity and ease of use. It relies on:
This approach avoids the complexity of setting up and managing multiple language servers, while still providing accurate, structural code intelligence.
Happy coding with XRAY! 🚀
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.