Everything else follows from that — the call graph tells the assistant which function to extract, symbol references tell it what a rename would touch, and simulate_refactor shows the effect before anything changes. The analysis runs on your machine, so the code does not leave it; the tier system decides how deep the scanning and symbolic execution go.
A local code-analysis server. It parses source into ASTs and program-dependence graphs, extracts precise slices instead of whole files, and layers security scanning, symbolic execution and policy checks on top.
- extract_code and get_file_context — pull one function or a scoped region rather than the whole file
- analyze_code — structure and complexity analysis for a file or snippet
- crawl_project and get_project_map — walk a repository and build a map of it
- get_call_graph, get_graph_neighborhood, get_cross_file_dependencies — who calls what, and across which files
- get_symbol_references, rename_symbol, update_symbol — find every reference to a symbol and change it
- simulate_refactor — see the effect of a refactor before committing to it
- security_scan, cross_file_security_scan, unified_sink_detect, type_evaporation_scan — vulnerability scanning within and across files
- scan_dependencies — check the dependency set
- symbolic_execute — explore paths symbolically rather than by running the code
- generate_unit_tests — produce tests for the code you extracted
- code_policy_check and verify_policy_integrity — enforce policy and confirm the policy itself has not been tampered with
- validate_paths and get_capabilities — check the paths it may read and what the current tier exposes
- Language coverage spans Python, JavaScript, TypeScript, Java, Go, Kotlin, PHP, Ruby, Swift, Rust, C, C++ and C#, with graph tools strongest on Python
Runs locally. Register it in Claude Code with a single mcp add command using uvx, or install from PyPI as codescalpel and start it with the mcp subcommand. Python 3.10 or later for the pip path; the uvx path manages its own environment. Optional extras cover the agent, web and polyglot features.
One command plus a key — claude mcp add codescalpel uvx codescalpel mcp, then supply credentials