Treesitter Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Treesitter Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP server and CLI that uses Tree-sitter to parse and analyze code.
Requires Python 3.10+.
# Install directly
uv pip install treesitter-mcp
# Or install a specific version
uv pip install treesitter-mcp==2.1
# Or clone and install
git clone https://github.com/pwno-io/treesitter-mcp.git
cd treesitter-mcp
uv pip install -e .This installs both treesitter-mcp and ts-cli entry points.
Or run without installing:
uvx treesitter-mcpFor use with Claude Desktop or other MCP clients:
treesitter-mcpSee docs/MCP_USAGE.md for how to configure.
Run analysis directly from the terminal:
ts-cli path/to/file.py
ts-cli path/to/file.py --ast --max-depth 2
ts-cli path/to/file.py --find-function main --include-source
ts-cli --supported-languagesUse --output-file to write results to JSON files instead of stdout.
For testing or manual use:
treesitter-mcp --http --port 8000 --host 127.0.0.1Only expose certain tools with --tools:
treesitter-mcp --http --port 8000 --tools treesitter_analyze_file,treesitter_get_astOr via URL query param: http://127.0.0.1:8000?tools=treesitter_analyze_file,treesitter_get_ast
Tools available:
treesitter_analyze_file - Basic analysistreesitter_get_ast - Full ASTtreesitter_get_call_graph - Function callstreesitter_find_function - Find function definitionstreesitter_find_variable - Find variablestreesitter_get_source_for_range - Extract source code for a rangetreesitter_get_supported_languages - What's supportedtreesitter_get_node_at_point - AST node at a line/columntreesitter_get_node_for_range - AST node for a rangetreesitter_cursor_walk - Walk tree with contexttreesitter_run_query - Custom Tree-sitter queriestreesitter_find_usage - Find symbol usagestreesitter_get_dependencies - Extract imports/includesIf you don't specify --tools, everything is exposed.
All tools support an optional output_file parameter. When provided, the tool writes its result directly to the specified file (as pretty-printed JSON) instead of returning it. This is useful for large outputs like ASTs that could cause context overload in agents.
Example:
# Returns result to file, minimal response to agent
treesitter_get_ast(file_path="large_file.py", output_file="~/output/ast.json")
# Returns: {"status": "written", "output_file": "/home/user/output/ast.json", "bytes_written": 123456}The tool will:
~ to your home directoryThe treesitter_find_function and treesitter_find_variable tools support an optional include_source parameter. When set to True, each matched symbol includes its source code in the result:
treesitter_find_function(file_path="server.py", name="main", include_source=True)
# Returns: {"query": "main", "matches": [{"name": "main", ..., "source": "def main():\n ..."}]}| Language | analyze_file | get_ast | get_call_graph | find_function | find_variable | find_usage | get_dependencies |
|---|---|---|---|---|---|---|---|
| C | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| C++ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Python | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| JavaScript | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| TypeScript | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Go | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Java | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| PHP | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Rust | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Ruby | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Language | Extensions |
|---|---|
| C | .c |
| C++ | .cpp, .cc, .cxx, .h, .hpp |
| Python | .py |
| JavaScript | .js, .jsx, .mjs, .cjs |
| TypeScript | .ts, .tsx, .cts, .mts |
| Go | .go |
| Java | .java |
| PHP | .php, .phtml |
| Rust | .rs |
| Ruby | .rb |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.