@lazymac/repo-health-mcp

One call. One score. Know if a repo is worth touching.

A Model Context Protocol (MCP) server that gives Claude Desktop and Claude Code a single, opinionated repository health score across six dimensions — dependencies, secrets, licenses, code quality, security, and structure — plus drill-down tools for each slice.

Why

Every time you open an unfamiliar repo, you run the same five checks in your head:

1. Are dependencies outdated or vulnerable?
2. Any committed secrets or .env leaks?
3. License compatible with what I'm building?
4. Is the code actually tested and documented?
5. Any obvious security smells — eval, innerHTML, disabled SSL?

repo-health-mcp runs all of them in parallel and returns a single 0-100 score, an A-F grade, and a ranked list of issues. Drop it into Claude and ask "is this repo safe to fork?" — the agent does the rest.

Designed for:

• AI agents that need a quick verdict before codegen / PR review
• Engineers triaging third-party repos, acquisitions, or inherited projects
• Security teams running bulk audits across monorepos

Install

# Run directly (no install)
npx -y @lazymac/repo-health-mcp

# Or install globally
npm install -g @lazymac/repo-health-mcp

Claude Desktop configuration

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "repo-health": {
      "command": "npx",
      "args": ["-y", "@lazymac/repo-health-mcp"]
    }
  }
}

Claude Code

claude mcp add repo-health -- npx -y @lazymac/repo-health-mcp

Restart Claude and the six tools below will appear.

Tools

| Tool | Input | Description | |---|---|---| | analyze_repo | repo_path: string | Full health analysis. Returns overall score (0-100), A-F grade, and sub-scores for deps / security / license / quality. Start here. | | check_dependencies | repo_path: string | Outdated packages, npm audit vulnerabilities, unused deps, lock file presence, version pinning. Node.js and Python. | | scan_secrets | repo_path: string, patterns?: string[] | Finds exposed API keys, tokens, private keys, DB URLs, committed .env. Pattern + entropy analysis. Scans git history too. | | audit_licenses | repo_path: string, allowed?: string[] | Flags copyleft (GPL/AGPL/LGPL), unknown, and non-compliant licenses against an allowlist. Defaults to MIT / Apache-2.0 / BSD / ISC. | | code_metrics | repo_path: string | LOC by language, file size distribution, largest files, test-to-code ratio, doc coverage, quality sub-score. | | check_security | repo_path: string | .gitignore completeness, unsafe patterns (eval, innerHTML, SQL concat), Docker hygiene, HTTPS enforcement, security headers. |

Examples

1. Triage a forked project before using it

"Run analyze_repo on /Users/me/forks/cool-cli. Summarize the top three blockers."

Claude calls analyze_repo and returns e.g. Score 58 / D — 2 critical secrets in git history, 14 outdated deps, 1 GPL-3.0 transitive dep blocks MIT redistribution.

2. Gate a PR on license compliance

"Our product is proprietary. Run audit_licenses on . with allowed MIT, Apache-2.0, BSD, ISC. Fail if anything else appears."

3. Pre-commit secret sweep

"Before I commit, run scan_secrets on my working copy and list every finding with file and line."

한국어 요약

@lazymac/repo-health-mcp 은 Claude용 MCP 서버로, 아무 저장소나 0-100점 건강도 + A-F 등급으로 즉시 평가합니다. 의존성, 시크릿 유출, 라이선스, 코드 품질, 보안 관행을 한 번에 검사해서 "이 레포, 지금 건드려도 되나?" 에 대한 답을 줍니다. npx -y @lazymac/repo-health-mcp 한 줄이면 끝. Claude Desktop / Claude Code 설정 예시는 위 Install 섹션 참고.

포함된 도구 6종:

• analyze_repo — 종합 점수
• check_dependencies — 의존성 감사
• scan_secrets — 시크릿 스캔 (git history 포함)
• audit_licenses — 라이선스 호환성
• code_metrics — LOC / 테스트 비율 / 문서화
• check_security — eval, innerHTML, SSL, Docker 등 위험 패턴

License

MIT © 2026 Dany