Point it at a project and it returns findings with a file, a line and a severity, produced on your own machine rather than by shipping the code out to a model to read. The other half is the guardrail: a save point before the agent starts, a rollback when it goes wrong, and a frozen-file list that a Claude Code hook enforces rather than merely asks for.
A scanner for the codebase an AI coding assistant is working in, exposed to that assistant as an MCP server with 29 tools. It reads what is already on disk — source files, git history, config files, dependency manifests — and returns findings that each carry a file, a line, a severity and a suggested fix. The health scan runs in 9 phases and the security scan in 10 modules, and both run locally: the analysis makes no API calls and the code is not sent anywhere.
- A full pass with `run_health_scan`, or any single phase on its own — `get_unused_code`, `get_tech_debt`, `get_security_issues`, `get_complexity_report`, `get_git_health`, `get_test_coverage`, `get_docs_quality`, `get_ui_issues`, `get_framework_check`, `get_outdated_deps`, `get_config_map`
- `get_health_summary` for a compact score-and-top-issues read before committing to a full scan, and `generate_health_report` when you want the findings as markdown
- Orientation without opening the repo yourself: `detect_project_stack`, `get_module_graph`, `get_status`, `get_activity`, and `search_code` for a regex sweep narrowed by a glob
- A git-backed undo — `create_save_point` before risky work, `list_save_points` to see what is there, `rollback_save_point` to put the tree back
- Files the agent is not allowed to edit — `freeze_file`, `unfreeze_file`, `list_frozen`. A frozen path is written into CLAUDE.md for any agent to read, and on Claude Code a PreToolUse hook rejects the write outright
- `install_context7` and `uninstall_context7` to wire in Context7, which is what attaches version-specific documentation snippets to findings instead of generic advice
- `build_prompt` and `list_prompts` — hand the current findings, frozen files and priority order back to the assistant as a prompt
No credentials for the scanning itself — it runs against files on disk, with no API calls and no telemetry. `npx fartrun@latest install` fetches the binary for your platform and writes the MCP entry into Claude Code, Cursor and Windsurf; `--claude`, `--cursor` or `--windsurf` limits it to one. Prebuilt binaries cover Linux and macOS on x64 and arm64 and Windows on x64, and an unsupported pairing such as Windows on ARM exits with an error rather than installing. A key only enters the picture for the optional AI tips: `ANTHROPIC_API_KEY` by default, or an OpenAI-compatible provider set under `[ai]` in `config.toml`. Save points and rollback are git operations, so the project has to be a git repository, and rollback refuses to run on a dirty working tree. Building from source is Python 3.11+, with Node.js 18+ behind the npm installer and `maturin` for the Rust modules. The documentation-backed fix suggestions only appear once Context7 MCP is installed. On accuracy the project publishes its own measurements — 99% on TypeScript and React, 91% on Django and DRF — so dead-code findings on a Django project are the ones to verify by hand, since ORM signals and receivers create usage the parser cannot see.
One command — npx fartrun@latest install