Scc Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Scc Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP server that exposes boyter/scc — a fast code-counting and complexity tool — to LLM agents.
It wraps scc in a small set of read-only tools so an agent can count lines of code, find the largest or most complex files, break stats down by language, and estimate project cost without learning the scc CLI.
(it is an external binary, not a Python dependency, and is not installed for you). Verify with scc --version.
uv syncThe server speaks MCP over stdio:
uv run scc-mcpAll tools are read-only. They default to scanning the current working directory and return human-readable markdown, or structured JSON when response_format: "json" is passed. Most accept include/exclude extension and directory filters.
| Tool | Description |
|---|---|
scc_count_lines | CLOC (code/comment/blank/lines) per language, plus totals. |
scc_top_files | Top N files sorted by a metric (code, complexity, lines, ...). |
scc_by_extension | CLOC broken down per language/extension. |
scc_complexity_hotspots | Files ranked by cyclomatic complexity (refactor targets). |
scc_cost_estimate | COCOMO cost / schedule / people estimate. |
scc_file_metrics | Detailed per-file metrics for a file or filtered subset. |
scc_list_languages | Languages scc recognizes and their file extensions. |
This repo registers the server as a local MCP in opencode.json:
{
"mcp": {
"scc": {
"type": "local",
"command": ["uv", "run", "scc-mcp"],
"enabled": true
}
}
}For other MCP clients, point them at the same uv run scc-mcp command (stdio transport).
uv run pytest # run the test suite
make build # build sdist + wheel into dist/Tests that shell out to scc are skipped automatically when it is not on PATH. See AGENTS.md for module layout and conventions.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.