Mcp Ast Grep — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp Ast Grep (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Model Context Protocol (MCP) server that provides ast-grep integration for Claude Code, enabling powerful structural code search and refactoring across 20+ programming languages.
npm install -g @ast-grep/cliInstall both prerequisites and configure Claude Code in one go:
# Install ast-grep CLI
npm install -g @ast-grep/cli
# Clone and build the MCP server
git clone <repository-url>
cd mcp-ast-grep
npm install
npm run build
# Add to Claude Code using the MCP CLI tool
claude mcp install ast-grep node ./dist/index.js#### Option 1: npm install (if published)
npm install -g mcp-ast-grep
claude mcp install ast-grep mcp-ast-grep#### Option 2: Build from source
git clone <repository-url>
cd mcp-ast-grep
npm install
npm run buildThe easiest way to add this server to Claude Code is using the claude mcp CLI tool:
# Add the server (from built source)
claude mcp install ast-grep node /path/to/mcp-ast-grep/dist/index.js
# Or if installed globally
claude mcp install ast-grep mcp-ast-grep
# Verify installation
claude mcp list
# Remove if needed
claude mcp remove ast-grepIf you prefer manual configuration, add the server to your Claude Code MCP settings:
#### macOS ~/Library/Application Support/Claude/claude_desktop_config.json
#### Windows %APPDATA%/Claude/claude_desktop_config.json
#### Linux ~/.config/claude/claude_desktop_config.json
Add this configuration:
{
"mcpServers": {
"ast-grep": {
"command": "mcp-ast-grep",
"args": []
}
}
}Or if building from source:
{
"mcpServers": {
"ast-grep": {
"command": "node",
"args": ["/path/to/mcp-ast-grep/dist/index.js"]
}
}
}Restart Claude Code after adding the configuration.
Once installed, Claude Code will have access to the ast_grep tool. Here are some examples:
// Find all console.log calls
ast_grep({
pattern: "console.log($msg)"
})// Find console.log only in JavaScript files
ast_grep({
pattern: "console.log($msg)",
glob: "**/*.js",
language: "javascript"
})// Preview replacing console.log with logger.info
ast_grep({
pattern: "console.log($msg)",
replacement: "logger.info($msg)",
dry_run: true // default
})// Actually apply the replacement
ast_grep({
pattern: "console.log($msg)",
replacement: "logger.info($msg)",
dry_run: false
})// Convert function declarations to arrow functions
ast_grep({
pattern: "function $name($args) { $$$body }",
replacement: "const $name = ($args) => { $$$body }",
language: "javascript"
})// Count occurrences
ast_grep({
pattern: "console.log($msg)",
mode: "count"
})| Parameter | Type | Description | Required | ||
|---|---|---|---|---|---|
pattern | string | AST pattern to search for | ✅ | ||
replacement | string | Replacement pattern (enables replace mode) | ❌ | ||
path | string | File or directory to search (default: cwd) | ❌ | ||
glob | string | File glob pattern (e.g., **/*.js) | ❌ | ||
language | string | Target language for parsing | ❌ | ||
mode | "search" \ | "replace" \ | "count" | Operation mode | ❌ |
context | number | Lines of context around matches (0-20) | ❌ | ||
dry_run | boolean | Preview mode (default: true for replacements) | ❌ | ||
head_limit | number | Limit results to first N matches (1-1000) | ❌ |
JavaScript, TypeScript, Python, Rust, Go, Java, C, C++, C#, HTML, CSS, JSON, YAML, Bash, Lua, PHP, Ruby, Swift, Kotlin, Dart, Scala
ast-grep uses powerful pattern matching syntax:
$VAR - matches any single AST node$$$VAR - matches multiple AST nodes (like function body)console.log($msg) - matches console.log with any argumentfunction $name($args) { $$$body } - matches any function declarationFor more details, see the ast-grep documentation.
The server provides helpful error messages for common issues:
npm install -g @ast-grep/cli# Install dependencies
npm install
# Run in development mode
npm run dev
# Build for production
npm run build
# Start production server
npm startclaude mcp list (should show "ast-grep")ast-grep --version# List all installed MCP servers
claude mcp list
# Check if ast-grep is installed
claude mcp status ast-grep
# Reinstall if there are issues
claude mcp remove ast-grep
claude mcp install ast-grep node /path/to/mcp-ast-grep/dist/index.js
# View Claude Code MCP configuration
claude mcp configMake sure the server has read/write access to the target files and directories.
MIT
Contributions welcome! Please open issues for bugs or feature requests.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.