The blast-radius and trace tools are the part an assistant cannot fake: before changing a function it can ask what actually calls it, instead of searching for the name and hoping the matches are the whole story.
A Rust static-analysis toolkit that runs as an MCP server by default and as a CLI when you want it. It builds a call graph rather than searching text, which is what lets it say whether a function is actually connected to anything.
- `scan_all` — dead code, clones and scaffolding in a single pass
- `analyze_dead_code` with a configurable confidence floor, and `detect_clones` covering Type 1 exact, Type 2 renamed and Type 3 structural duplicates
- `fossil_detect_scaffolding` — phased comments, TODO and FIXME markers, placeholder bodies, and `temp_` / `backup_` / `old_` files left in the tree
- `fossil_inspect` for the call graph, data flow, control flow or blast radius around a function, and `fossil_trace` for the call paths between two of them
- `fossil_explain_finding` for context on a single result, and `fossil_refresh` for fast incremental re-analysis after edits
- 16 languages, with framework presets auto-detected — React, Next.js, Express, Django, Flask, Spring, Axum, Actix, Angular — so lifecycle methods are not reported as dead
- Cross-file resolution through imports, barrel re-exports and class hierarchies, so dead code is found across module boundaries
- The same analyses from the CLI with `--format sarif` for GitHub code scanning, `--diff <BRANCH>` to look only at what a PR touched, and thresholds that fail a build
A single binary with no runtime dependencies — install script, `cargo binstall fossil-mcp`, `cargo install fossil-mcp`, or a release archive for Linux, macOS or Windows. Running `fossil-mcp` with no arguments starts the MCP server. Configuration is optional; entry points and framework presets can be declared when auto-detection needs help. MIT or Apache-2.0.
One command — curl -fsSL fossil-mcp.com/install.sh | sh