scan_allLABSCO SUMMARY
A graph, where the agent had only grep.
The blast-radius and trace tools are the part an assistant cannot fake: before changing a function it can ask what actually calls it, instead of searching for the name and hoping the matches are the whole story.
What it is
A Rust static-analysis toolkit that runs as an MCP server by default and as a CLI when you want it. It builds a call graph rather than searching text, which is what lets it say whether a function is actually connected to anything.
What you get
scan_all— dead code, clones and scaffolding in a single passanalyze_dead_codewith a configurable confidence floor, anddetect_clonescovering Type 1 exact, Type 2 renamed and Type 3 structural duplicatesfossil_detect_scaffolding— phased comments, TODO and FIXME markers, placeholder bodies, andtemp_/backup_/old_files left in the treefossil_inspectfor the call graph, data flow, control flow or blast radius around a function, andfossil_tracefor the call paths between two of themfossil_explain_findingfor context on a single result, andfossil_refreshfor fast incremental re-analysis after edits- 16 languages, with framework presets auto-detected — React, Next.js, Express, Django, Flask, Spring, Axum, Actix, Angular — so lifecycle methods are not reported as dead
- Cross-file resolution through imports, barrel re-exports and class hierarchies, so dead code is found across module boundaries
- The same analyses from the CLI with
--format sariffor GitHub code scanning,--diff <YOUR_BRANCH>to look only at what a PR touched, and thresholds that fail a build
Requirements
A single binary with no runtime dependencies — install script, cargo binstall fossil-mcp, cargo install fossil-mcp, or a release archive for Linux, macOS or Windows. Running fossil-mcp with no arguments starts the MCP server. Configuration is optional; entry points and framework presets can be declared when auto-detection needs help. MIT or Apache-2.0.
Setup effort
One command — curl -fsSL fossil-mcp.com/install.sh | sh
USE CASES
01
Cleaning up after a week of fast iteration
One pass reports the dead code, the duplicated logic and the scaffolding markers together, ranked by confidence.
02
Deciding whether a change is safe
Ask for the blast radius around the function first, so you know what breaks before you touch it.
03
Working out how two parts of the code connect
Trace the call paths between two functions instead of reading every file between them.
04
Catching a regression in a pull request
Run in diff mode against the base branch and fail the build when the thresholds are exceeded.
05
Getting findings into GitHub code scanning
Emit SARIF and the results appear as annotations rather than in a log nobody opens.
06
Letting the agent check its own output
It runs the scan itself after writing code, then re-runs incrementally as it fixes what came back.
8 tools
Listed in project docs. Your client may show a different list.
analyze_dead_codedetect_clonesfossil_refreshfossil_inspectfossil_tracefossil_explain_findingfossil_detect_scaffoldingBEFORE YOU INSTALL
What to know first
Tools you get
8 tools named in the project's documentation.
Requires
fossil-mcp on PATH
INSTALLATION
Connect your client
Server setup
TERMINAL
curl -fsSL fossil-mcp.com/install.sh | shMCP Clients
Claude Code
CLAUDE CODE · TERMINAL
claude mcp add fossil fossil-mcpCursor, Windsurf, Claude Desktop
JSON
{
"mcpServers": {
"fossil": {
"command": "fossil-mcp"
}
}
}VS Code, VS Code Insiders
JSON
{
"servers": {
"fossil": {
"command": "fossil-mcp"
}
}
}
