io.github.aahlijia/dekko
PYPI · DEKKO · SCANNED SEP 20
Static code map generator: MAP.md + map.json for any repo, plus a Claude Code /map plugin
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
- 0 of 10 dependencies flagged as unhealthy. View diagnostics → Pass
Provenance & Transparency35
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: no license is declared. See how to fix → Fail
- Actively maintained (last published 10 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability81
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3230 tokens (~170/item across 19 items; 18 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 18 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 19 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.aahlijia/dekko MCP server?
io.github.aahlijia/dekko runs locally as a PyPI package, launched with uvx dekko. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · dekko
claude mcp add aahlijia-dekko -- uvx dekko
{
"mcpServers": {
"aahlijia-dekko": {
"command": "uvx",
"args": [
"dekko"
]
}
}
} {
"servers": {
"aahlijia-dekko": {
"command": "uvx",
"args": [
"dekko"
]
}
}
} codex mcp add aahlijia-dekko -- uvx dekko
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"aahlijia-dekko": {
"type": "local",
"command": [
"uvx",
"dekko"
],
"enabled": true
}
}
} openclaw mcp add aahlijia-dekko --command uvx --arg dekko
mcp_servers:
aahlijia-dekko:
command: "uvx"
args: ["dekko"] {
"McpServers": {
"aahlijia-dekko": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"dekko"
]
}
}
} assistant mcp add aahlijia-dekko -t stdio -c uvx -a dekko
{
"mcpServers": {
"aahlijia-dekko": {
"command": "uvx",
"args": [
"dekko"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
- Stability: 0.97 → pass security
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Sept 26 −3
- Stability: pass → 0.80 functional
- 13 Sept 26 +1
- Stability: 0.97 → pass security
- 12 Sept 26 −1
- Stability: pass → 0.97 functional
- 11 Sept 26 +1
- Stability: 0.97 → pass security
- 9 Sept 26 +1
- Stability: 0.90 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Package version: 0.43.45 → 0.43.49 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed pypi/dekko@0.43.49
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 10 packages
| Packages resolved | 10 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_note ~156
Anchor a durable note to a symbol. Notes are committed to .dekko/notes.json and shown on the symbol's card and in its context pack. Use after a non-obvious change so the rationale survives.
| Name | Type | Req | Description |
|---|---|---|---|
| root | string | – | Repo root containing map.json (default: server cwd) |
| symbol | string | yes | Symbol: name, Class.method, or file.py:name. If the reply says the target is ambiguous (an overload set sharing the same file+name), append ':LINE' from one of the printed candidate rows, e.g. file.p… |
| text | string | yes | The note text |
No output schema declared.
No examples provided.
check_ambiguous ~146
Repo-wide resolver-trust summary: total ambiguous call sites, the ambiguous rate, and the top colliding names/files. Run this before leaning on get_callers/get_callees/workset for an impact-analysis decision on a repo with generic/common method names — a low ambiguous rate means the call graph is trustworthy as-is; a high one concentrated in a few files means spot-check those files' call sites by hand before trusting the graph there.
| Name | Type | Req | Description |
|---|---|---|---|
| budget | integer | – | Approx token budget (default 500) |
| root | string | – | Repo root containing map.json (default: server cwd) |
| top | integer | – | Top-N entries per ranking (default 5) |
No output schema declared.
No examples provided.
find_type_usages ~218
Every function/method that uses a type as a parameter or return type — for 'what breaks if I change this struct/class's shape' questions the call graph alone can't answer, since a function can use a type without calling anything on it. Matches the bare type name inside wrapper syntax (Optional[Config], Vec<Config>, Config | None all match 'Config') unless exact=true. Only functions/methods carry typed params/returns — struct/class fields typed with the target type are not covered.
| Name | Type | Req | Description |
|---|---|---|---|
| budget | integer | – | Approximate token budget (default 800); lowest-relevance rows are dropped to fit and a cost footer is appended |
| exact | boolean | – | Match the declared type text exactly instead of the bare identifier inside wrapper syntax (default false) |
| limit | integer | – | Max result lines (default 50) |
| root | string | – | Repo root containing map.json (default: server cwd) |
| type | string | yes | Type/class/struct/interface name to search for, e.g. 'Config' |
No output schema declared.
No examples provided.
find_usages ~162
List the symbols that reference an external (out-of-repo) name, e.g. a stdlib or third-party function, with call sites — one call gets every real call site across the repo, where grepping the bare name also pulls in imports, comments, and unrelated same-named locals you'd have to hand-filter.
| Name | Type | Req | Description |
|---|---|---|---|
| budget | integer | – | Approximate token budget (default 800); lowest-relevance rows are dropped to fit and a cost footer is appended |
| limit | integer | – | Max result lines (default 50) |
| name | string | yes | Base identifier of the external reference (e.g. 'run' for subprocess.run, 'Path') |
| root | string | – | Repo root containing map.json (default: server cwd) |
No output schema declared.
No examples provided.
get_callees ~210
Every in-repo symbol a symbol calls (set sites=true for call-site lines) — what this code depends on, without reading its body. Walks the resolved call graph directly instead of grepping the body for names that look like calls.
| Name | Type | Req | Description |
|---|---|---|---|
| budget | integer | – | Approximate token budget (default 800); lowest-relevance rows are dropped to fit and a cost footer is appended |
| root | string | – | Repo root containing map.json (default: server cwd) |
| sites | boolean | – | One row per call site (path:line of each call expression) instead of one per definition |
| symbol | string | yes | Symbol: name, Class.method, or file.py:name. If the reply says the target is ambiguous (an overload set sharing the same file+name), append ':LINE' from one of the printed candidate rows, e.g. file.p… |
No output schema declared.
No examples provided.
get_callers ~262
Every symbol (and module-level site) that calls a symbol — exact call edges, unlike grep, which can't tell a call from a same-named string. Set sites=true for the precise path:line of each call. Use for impact analysis before a change. Test-file callers are excluded by default — set include_tests=true to see them.
| Name | Type | Req | Description |
|---|---|---|---|
| budget | integer | – | Approximate token budget (default 800); lowest-relevance rows are dropped to fit and a cost footer is appended |
| include_tests | boolean | – | Include results from test files (default: false — test-file callers are usually noise for impact analysis; set true to include them) |
| root | string | – | Repo root containing map.json (default: server cwd) |
| sites | boolean | – | One row per call site (path:line of each call expression) instead of one per definition |
| symbol | string | yes | Symbol: name, Class.method, or file.py:name. If the reply says the target is ambiguous (an overload set sharing the same file+name), append ':LINE' from one of the printed candidate rows, e.g. file.p… |
No output schema declared.
No examples provided.
get_context_pack ~159
Compact signature neighborhood (callers/callees within N hops) for editing a symbol or file. Token-budgetable. Example: target="awardXp", task="who calls this".
| Name | Type | Req | Description |
|---|---|---|---|
| budget | integer | – | Approx token budget for the pack (default 800) |
| hops | integer | – | Neighborhood radius (default 1) |
| root | string | – | Repo root containing map.json (default: server cwd) |
| target | string | yes | Symbol or repo-relative file path |
| task | string | – | Rank output by relevance to this task description, blended with structural centrality and the working diff |
| with_source | boolean | – | Inline the target's source body and hop-1 call-site lines (default false; counts against budget) |
No output schema declared.
No examples provided.
get_subtypes ~311
What extends, implements, or is impl'd for a class/interface/struct/trait — the 'if I change this, who's affected' blast-radius question for type declarations. Set transitive=true for every direct and indirect implementor, not just direct ones. Does not include each implementor's own callers — pair with get_callers on individual results for that. Test-file subtypes are excluded by default — set include_tests=true to see them.
| Name | Type | Req | Description |
|---|---|---|---|
| budget | integer | – | Approximate token budget (default 800); lowest-relevance rows are dropped to fit and a cost footer is appended |
| include_tests | boolean | – | Include results from test files (default: false — test-file callers are usually noise for impact analysis; set true to include them) |
| relation | string | – | Filter to one heritage-relation kind ('embeds' is Go struct embedding, not extracted, and never appears in current results) |
| root | string | – | Repo root containing map.json (default: server cwd) |
| symbol | string | yes | Symbol: name, Class.method, or file.py:name. If the reply says the target is ambiguous (an overload set sharing the same file+name), append ':LINE' from one of the printed candidate rows, e.g. file.p… |
| transitive | boolean | – | Every direct and indirect implementor instead of just direct ones (default false) |
No output schema declared.
No examples provided.
get_supertypes ~330
What a class/interface/struct/trait extends, implements, or is impl'd for — its own declared heritage. Set transitive=true for the full ancestor chain/DAG (multiple inheritance and multi-interface implementation both fan out, not a single line). Covers Python/JavaScript/TypeScript/Java/Rust/C++. Go struct embedding is not extracted (only answers composition, not interface satisfaction, so not worth the confusion) and Go's structural interface satisfaction has no declaring syntax to extract at all — no tree-sitter query can see it.
| Name | Type | Req | Description |
|---|---|---|---|
| budget | integer | – | Approximate token budget (default 800); lowest-relevance rows are dropped to fit and a cost footer is appended |
| include_tests | boolean | – | Include results from test files (default: false — test-file callers are usually noise for impact analysis; set true to include them) |
| relation | string | – | Filter to one heritage-relation kind ('embeds' is Go struct embedding, not extracted, and never appears in current results) |
| root | string | – | Repo root containing map.json (default: server cwd) |
| symbol | string | yes | Symbol: name, Class.method, or file.py:name. If the reply says the target is ambiguous (an overload set sharing the same file+name), append ':LINE' from one of the printed candidate rows, e.g. file.p… |
| transitive | boolean | – | Full ancestor chain/DAG instead of one hop (default false) |
No output schema declared.
No examples provided.
impacted_tests ~163
Test files a runner should exercise after a change: reverse call-graph reachability from changed symbols plus an import-edge fallback (leads, not verdicts — static analysis misses fixtures and dynamic dispatch). More reliable than grepping test files for the changed symbol's name, which misses indirect callers and matches unrelated same-named text.
| Name | Type | Req | Description |
|---|---|---|---|
| budget | integer | – | Approximate token budget (default 800); lowest-relevance rows are dropped to fit and a cost footer is appended |
| limit | integer | – | Max impacted symbols per test file (default 8) |
| rev | string | – | Git rev to compare against (default: the commit the map was generated at, else HEAD) |
| root | string | – | Repo root containing map.json (default: server cwd) |
No output schema declared.
No examples provided.
list_notes ~61
List notes anchored to a symbol, or every note in the repo when no symbol is given.
| Name | Type | Req | Description |
|---|---|---|---|
| root | string | – | Repo root containing map.json (default: server cwd) |
| symbol | string | – | Symbol to list notes for (omit for all notes) |
No output schema declared.
No examples provided.
map_status ~34
Report whether map.json is fresh or stale.
| Name | Type | Req | Description |
|---|---|---|---|
| root | string | – | Repo root containing map.json (default: server cwd) |
No output schema declared.
No examples provided.
outline ~134
A file's (or directory's) structural outline — signatures + doc lines, no bodies — at roughly a tenth the cost of reading it. Prefer this before reading a file to learn what it contains.
| Name | Type | Req | Description |
|---|---|---|---|
| budget | integer | – | Approximate token budget (default 2000); lowest-relevance rows are dropped to fit and a cost footer is appended |
| limit | integer | – | Max symbol rows (default 200) |
| root | string | – | Repo root containing map.json (default: server cwd) |
| target | string | yes | Mapped file path or directory (suffix-matched); a directory rolls up its files |
No output schema declared.
No examples provided.
query_symbol ~135
Signature, kind, location, doc, fan-in/out, and notes for one symbol — the fast way to learn what a symbol is without reading its file.
| Name | Type | Req | Description |
|---|---|---|---|
| root | string | – | Repo root containing map.json (default: server cwd) |
| symbol | string | yes | Symbol: name, Class.method, or file.py:name. If the reply says the target is ambiguous (an overload set sharing the same file+name), append ':LINE' from one of the printed candidate rows, e.g. file.p… |
No output schema declared.
No examples provided.
refresh_map ~60
Regenerate the map; set full=true to ignore the cache and re-parse every file.
| Name | Type | Req | Description |
|---|---|---|---|
| full | boolean | – | Ignore the .dekko cache (cold rebuild) |
| root | string | – | Repo root containing map.json (default: server cwd) |
No output schema declared.
No examples provided.
search_code ~260
Rank symbols by free-text relevance to a natural-language description — for when you know what the code should do but not its name. Matches against names, signatures, and doc lines with BM25-style scoring, not substring matching. Falls back to zero hits (not an error) when nothing matches; try broader or different terms. Use query_symbol/get_callers instead once you have an exact name.
| Name | Type | Req | Description |
|---|---|---|---|
| budget | integer | – | Token budget for the output (default 800) |
| include_tests | boolean | – | Include test-path symbols (default: false) |
| kind | string | – | Comma-separated symbol kinds to restrict to (function, method, class, ...) |
| limit | integer | – | Max hits (default 15) |
| query | string | yes | Free-text description of the code you're looking for |
| root | string | – | Repo root containing map.json (default: server cwd) |
| scorer | string | – | Relevance scorer: 'lexical' (default, BM25, always available), 'embedding' (hashing-trick embedding), or 'both' (fuses lexical + embedding rankings via reciprocal rank fusion) — 'embedding' and 'both… |
No output schema declared.
No examples provided.
summary ~95
Compact repo digest (~40 lines): counts, language mix, per-directory rollup with coupling and purpose, load-bearing/orchestrating symbols, entry points, parse errors. Read this before exploring an unfamiliar repo.
| Name | Type | Req | Description |
|---|---|---|---|
| budget | integer | – | Approximate token cap (default 2000); trailing sections are shed to fit and a footer reports the omission |
| root | string | – | Repo root containing map.json (default: server cwd) |
No output schema declared.
No examples provided.
workset ~313
Task work-set: for a change (git rev) or a symbol, bundle the touched files' outlines plus call-graph packs for the most central touched symbols under one token budget. One call replaces affected + N outlines + N packs — and grepping a diff for touched names then reading each file whole to work it. Set type_impact=true when the target is a class/interface/struct/trait to also union in every type-usage site and implementor into the touched set — the full blast radius of changing a shared type's shape, not just its direct callers.
| Name | Type | Req | Description |
|---|---|---|---|
| budget | integer | – | Shared token budget for the whole bundle (default 6000) |
| packs | integer | – | Top-centrality touched symbols to deep-pack (default 5) |
| rev | string | – | Git rev to bundle changes against (default: the commit the map was generated at, else HEAD); omit when using 'symbol' |
| root | string | – | Repo root containing map.json (default: server cwd) |
| symbol | string | – | Seed from a symbol instead of a diff (name, Class.method, file.py:name); not with 'rev' |
| task | string | – | Rank output by relevance to this task description, blended with structural centrality and the working diff |
| type_impact | boolean | – | Also include type-usage sites and implementors in the touched set (only meaningful when 'symbol' is a class/interface/struct/trait; no-op otherwise). Requires 'symbol'. default false |
No output schema declared.
No examples provided.
What is the io.github.aahlijia/dekko MCP server?
io.github.aahlijia/dekko is an MCP server listed in the public MCP registry as io.github.aahlijia/dekko. Static code map generator: MAP.md + map.json for any repo, plus a Claude Code /map plugin. This page covers its PyPI package (dekko).
Is the io.github.aahlijia/dekko MCP server safe to use?
io.github.aahlijia/dekko scores 84 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.aahlijia/dekko MCP server expose?
io.github.aahlijia/dekko exposes 18 tools: search_code, query_symbol, get_callers, get_callees, find_usages, and 13 more. Their descriptions and schemas cost roughly 3,209 tokens of context every time the server is loaded.
Is the io.github.aahlijia/dekko MCP server still maintained?
io.github.aahlijia/dekko is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.