Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.aahlijia/dekko

PYPI · DEKKO · SCANNED SEP 20

Static code map generator: MAP.md + map.json for any repo, plus a Claude Code /map plugin

Available components

0 this week 84 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security100
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
  • 0 of 10 dependencies flagged as unhealthy. View diagnostics → Pass
Provenance & Transparency35
Schema Quality & AI Usability81
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 3230 tokens (~170/item across 19 items; 18 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 18 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 19 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the io.github.aahlijia/dekko MCP server?

io.github.aahlijia/dekko runs locally as a PyPI package, launched with uvx dekko. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

pypi · dekko

# add to Claude Code
claude mcp add aahlijia-dekko -- uvx dekko
// .cursor/mcp.json
{
  "mcpServers": {
    "aahlijia-dekko": {
      "command": "uvx",
      "args": [
        "dekko"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "aahlijia-dekko": {
      "command": "uvx",
      "args": [
        "dekko"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add aahlijia-dekko -- uvx dekko
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "aahlijia-dekko": {
      "type": "local",
      "command": [
        "uvx",
        "dekko"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add aahlijia-dekko --command uvx --arg dekko
# ~/.hermes/config.yaml
mcp_servers:
  aahlijia-dekko:
    command: "uvx"
    args: ["dekko"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "aahlijia-dekko": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "dekko"
      ]
    }
  }
}
# add to Vellum
assistant mcp add aahlijia-dekko -t stdio -c uvx -a dekko
// mcp.json
{
  "mcpServers": {
    "aahlijia-dekko": {
      "command": "uvx",
      "args": [
        "dekko"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 20 Sept 26 +1
    • Stability: 0.97 → pass security
  • 18 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

  • 16 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 14 Sept 26 −3
    • Stability: pass → 0.80 functional
  • 13 Sept 26 +1
    • Stability: 0.97 → pass security
  • 12 Sept 26 −1
    • Stability: pass → 0.97 functional
  • 11 Sept 26 +1
    • Stability: 0.97 → pass security
  • 9 Sept 26 +1
    • Stability: 0.90 → unverified security
    • Tool safety: pass → unverified security
    • Capabilities: pass → unverified functional
    • Tool coverage: 100 → unverified functional
    • Schema quality: 100 → unverified functional
    • Package version: 0.43.45 → 0.43.49 functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed pypi/dekko@0.43.49

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem pypi

Background: How many MCP packages publish verified provenance →

Install scripts 1 script
Hook Tier Command
build_backend allowlisted hatchling.build

Background: Why install scripts are a supply-chain risk →

Dependencies 10 packages
Packages resolved 10
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 18 exposed · ~3,209 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
add_note ~156

Anchor a durable note to a symbol. Notes are committed to .dekko/notes.json and shown on the symbol's card and in its context pack. Use after a non-obvious change so the rationale survives.

NameTypeReqDescription
rootstringRepo root containing map.json (default: server cwd)
symbolstringyesSymbol: name, Class.method, or file.py:name. If the reply says the target is ambiguous (an overload set sharing the same file+name), append ':LINE' from one of the printed candidate rows, e.g. file.p…
textstringyesThe note text

No output schema declared.

No examples provided.

check_ambiguous ~146

Repo-wide resolver-trust summary: total ambiguous call sites, the ambiguous rate, and the top colliding names/files. Run this before leaning on get_callers/get_callees/workset for an impact-analysis decision on a repo with generic/common method names — a low ambiguous rate means the call graph is trustworthy as-is; a high one concentrated in a few files means spot-check those files' call sites by hand before trusting the graph there.

NameTypeReqDescription
budgetintegerApprox token budget (default 500)
rootstringRepo root containing map.json (default: server cwd)
topintegerTop-N entries per ranking (default 5)

No output schema declared.

No examples provided.

find_type_usages ~218

Every function/method that uses a type as a parameter or return type — for 'what breaks if I change this struct/class's shape' questions the call graph alone can't answer, since a function can use a type without calling anything on it. Matches the bare type name inside wrapper syntax (Optional[Config], Vec<Config>, Config | None all match 'Config') unless exact=true. Only functions/methods carry typed params/returns — struct/class fields typed with the target type are not covered.

NameTypeReqDescription
budgetintegerApproximate token budget (default 800); lowest-relevance rows are dropped to fit and a cost footer is appended
exactbooleanMatch the declared type text exactly instead of the bare identifier inside wrapper syntax (default false)
limitintegerMax result lines (default 50)
rootstringRepo root containing map.json (default: server cwd)
typestringyesType/class/struct/interface name to search for, e.g. 'Config'

No output schema declared.

No examples provided.

find_usages ~162

List the symbols that reference an external (out-of-repo) name, e.g. a stdlib or third-party function, with call sites — one call gets every real call site across the repo, where grepping the bare name also pulls in imports, comments, and unrelated same-named locals you'd have to hand-filter.

NameTypeReqDescription
budgetintegerApproximate token budget (default 800); lowest-relevance rows are dropped to fit and a cost footer is appended
limitintegerMax result lines (default 50)
namestringyesBase identifier of the external reference (e.g. 'run' for subprocess.run, 'Path')
rootstringRepo root containing map.json (default: server cwd)

No output schema declared.

No examples provided.

get_callees ~210

Every in-repo symbol a symbol calls (set sites=true for call-site lines) — what this code depends on, without reading its body. Walks the resolved call graph directly instead of grepping the body for names that look like calls.

NameTypeReqDescription
budgetintegerApproximate token budget (default 800); lowest-relevance rows are dropped to fit and a cost footer is appended
rootstringRepo root containing map.json (default: server cwd)
sitesbooleanOne row per call site (path:line of each call expression) instead of one per definition
symbolstringyesSymbol: name, Class.method, or file.py:name. If the reply says the target is ambiguous (an overload set sharing the same file+name), append ':LINE' from one of the printed candidate rows, e.g. file.p…

No output schema declared.

No examples provided.

get_callers ~262

Every symbol (and module-level site) that calls a symbol — exact call edges, unlike grep, which can't tell a call from a same-named string. Set sites=true for the precise path:line of each call. Use for impact analysis before a change. Test-file callers are excluded by default — set include_tests=true to see them.

NameTypeReqDescription
budgetintegerApproximate token budget (default 800); lowest-relevance rows are dropped to fit and a cost footer is appended
include_testsbooleanInclude results from test files (default: false — test-file callers are usually noise for impact analysis; set true to include them)
rootstringRepo root containing map.json (default: server cwd)
sitesbooleanOne row per call site (path:line of each call expression) instead of one per definition
symbolstringyesSymbol: name, Class.method, or file.py:name. If the reply says the target is ambiguous (an overload set sharing the same file+name), append ':LINE' from one of the printed candidate rows, e.g. file.p…

No output schema declared.

No examples provided.

get_context_pack ~159

Compact signature neighborhood (callers/callees within N hops) for editing a symbol or file. Token-budgetable. Example: target="awardXp", task="who calls this".

NameTypeReqDescription
budgetintegerApprox token budget for the pack (default 800)
hopsintegerNeighborhood radius (default 1)
rootstringRepo root containing map.json (default: server cwd)
targetstringyesSymbol or repo-relative file path
taskstringRank output by relevance to this task description, blended with structural centrality and the working diff
with_sourcebooleanInline the target's source body and hop-1 call-site lines (default false; counts against budget)

No output schema declared.

No examples provided.

get_subtypes ~311

What extends, implements, or is impl'd for a class/interface/struct/trait — the 'if I change this, who's affected' blast-radius question for type declarations. Set transitive=true for every direct and indirect implementor, not just direct ones. Does not include each implementor's own callers — pair with get_callers on individual results for that. Test-file subtypes are excluded by default — set include_tests=true to see them.

NameTypeReqDescription
budgetintegerApproximate token budget (default 800); lowest-relevance rows are dropped to fit and a cost footer is appended
include_testsbooleanInclude results from test files (default: false — test-file callers are usually noise for impact analysis; set true to include them)
relationstringFilter to one heritage-relation kind ('embeds' is Go struct embedding, not extracted, and never appears in current results)
rootstringRepo root containing map.json (default: server cwd)
symbolstringyesSymbol: name, Class.method, or file.py:name. If the reply says the target is ambiguous (an overload set sharing the same file+name), append ':LINE' from one of the printed candidate rows, e.g. file.p…
transitivebooleanEvery direct and indirect implementor instead of just direct ones (default false)

No output schema declared.

No examples provided.

get_supertypes ~330

What a class/interface/struct/trait extends, implements, or is impl'd for — its own declared heritage. Set transitive=true for the full ancestor chain/DAG (multiple inheritance and multi-interface implementation both fan out, not a single line). Covers Python/JavaScript/TypeScript/Java/Rust/C++. Go struct embedding is not extracted (only answers composition, not interface satisfaction, so not worth the confusion) and Go's structural interface satisfaction has no declaring syntax to extract at all — no tree-sitter query can see it.

NameTypeReqDescription
budgetintegerApproximate token budget (default 800); lowest-relevance rows are dropped to fit and a cost footer is appended
include_testsbooleanInclude results from test files (default: false — test-file callers are usually noise for impact analysis; set true to include them)
relationstringFilter to one heritage-relation kind ('embeds' is Go struct embedding, not extracted, and never appears in current results)
rootstringRepo root containing map.json (default: server cwd)
symbolstringyesSymbol: name, Class.method, or file.py:name. If the reply says the target is ambiguous (an overload set sharing the same file+name), append ':LINE' from one of the printed candidate rows, e.g. file.p…
transitivebooleanFull ancestor chain/DAG instead of one hop (default false)

No output schema declared.

No examples provided.

impacted_tests ~163

Test files a runner should exercise after a change: reverse call-graph reachability from changed symbols plus an import-edge fallback (leads, not verdicts — static analysis misses fixtures and dynamic dispatch). More reliable than grepping test files for the changed symbol's name, which misses indirect callers and matches unrelated same-named text.

NameTypeReqDescription
budgetintegerApproximate token budget (default 800); lowest-relevance rows are dropped to fit and a cost footer is appended
limitintegerMax impacted symbols per test file (default 8)
revstringGit rev to compare against (default: the commit the map was generated at, else HEAD)
rootstringRepo root containing map.json (default: server cwd)

No output schema declared.

No examples provided.

list_notes ~61

List notes anchored to a symbol, or every note in the repo when no symbol is given.

NameTypeReqDescription
rootstringRepo root containing map.json (default: server cwd)
symbolstringSymbol to list notes for (omit for all notes)

No output schema declared.

No examples provided.

map_status ~34

Report whether map.json is fresh or stale.

NameTypeReqDescription
rootstringRepo root containing map.json (default: server cwd)

No output schema declared.

No examples provided.

outline ~134

A file's (or directory's) structural outline — signatures + doc lines, no bodies — at roughly a tenth the cost of reading it. Prefer this before reading a file to learn what it contains.

NameTypeReqDescription
budgetintegerApproximate token budget (default 2000); lowest-relevance rows are dropped to fit and a cost footer is appended
limitintegerMax symbol rows (default 200)
rootstringRepo root containing map.json (default: server cwd)
targetstringyesMapped file path or directory (suffix-matched); a directory rolls up its files

No output schema declared.

No examples provided.

query_symbol ~135

Signature, kind, location, doc, fan-in/out, and notes for one symbol — the fast way to learn what a symbol is without reading its file.

NameTypeReqDescription
rootstringRepo root containing map.json (default: server cwd)
symbolstringyesSymbol: name, Class.method, or file.py:name. If the reply says the target is ambiguous (an overload set sharing the same file+name), append ':LINE' from one of the printed candidate rows, e.g. file.p…

No output schema declared.

No examples provided.

refresh_map ~60

Regenerate the map; set full=true to ignore the cache and re-parse every file.

NameTypeReqDescription
fullbooleanIgnore the .dekko cache (cold rebuild)
rootstringRepo root containing map.json (default: server cwd)

No output schema declared.

No examples provided.

search_code ~260

Rank symbols by free-text relevance to a natural-language description — for when you know what the code should do but not its name. Matches against names, signatures, and doc lines with BM25-style scoring, not substring matching. Falls back to zero hits (not an error) when nothing matches; try broader or different terms. Use query_symbol/get_callers instead once you have an exact name.

NameTypeReqDescription
budgetintegerToken budget for the output (default 800)
include_testsbooleanInclude test-path symbols (default: false)
kindstringComma-separated symbol kinds to restrict to (function, method, class, ...)
limitintegerMax hits (default 15)
querystringyesFree-text description of the code you're looking for
rootstringRepo root containing map.json (default: server cwd)
scorerstringRelevance scorer: 'lexical' (default, BM25, always available), 'embedding' (hashing-trick embedding), or 'both' (fuses lexical + embedding rankings via reciprocal rank fusion) — 'embedding' and 'both…

No output schema declared.

No examples provided.

summary ~95

Compact repo digest (~40 lines): counts, language mix, per-directory rollup with coupling and purpose, load-bearing/orchestrating symbols, entry points, parse errors. Read this before exploring an unfamiliar repo.

NameTypeReqDescription
budgetintegerApproximate token cap (default 2000); trailing sections are shed to fit and a footer reports the omission
rootstringRepo root containing map.json (default: server cwd)

No output schema declared.

No examples provided.

workset ~313

Task work-set: for a change (git rev) or a symbol, bundle the touched files' outlines plus call-graph packs for the most central touched symbols under one token budget. One call replaces affected + N outlines + N packs — and grepping a diff for touched names then reading each file whole to work it. Set type_impact=true when the target is a class/interface/struct/trait to also union in every type-usage site and implementor into the touched set — the full blast radius of changing a shared type's shape, not just its direct callers.

NameTypeReqDescription
budgetintegerShared token budget for the whole bundle (default 6000)
packsintegerTop-centrality touched symbols to deep-pack (default 5)
revstringGit rev to bundle changes against (default: the commit the map was generated at, else HEAD); omit when using 'symbol'
rootstringRepo root containing map.json (default: server cwd)
symbolstringSeed from a symbol instead of a diff (name, Class.method, file.py:name); not with 'rev'
taskstringRank output by relevance to this task description, blended with structural centrality and the working diff
type_impactbooleanAlso include type-usage sites and implementors in the touched set (only meaningful when 'symbol' is a class/interface/struct/trait; no-op otherwise). Requires 'symbol'. default false

No output schema declared.

No examples provided.

Common questions

What is the io.github.aahlijia/dekko MCP server?

io.github.aahlijia/dekko is an MCP server listed in the public MCP registry as io.github.aahlijia/dekko. Static code map generator: MAP.md + map.json for any repo, plus a Claude Code /map plugin. This page covers its PyPI package (dekko).

Is the io.github.aahlijia/dekko MCP server safe to use?

io.github.aahlijia/dekko scores 84 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.aahlijia/dekko MCP server expose?

io.github.aahlijia/dekko exposes 18 tools: search_code, query_symbol, get_callers, get_callees, find_usages, and 13 more. Their descriptions and schemas cost roughly 3,209 tokens of context every time the server is loaded.

Is the io.github.aahlijia/dekko MCP server still maintained?

io.github.aahlijia/dekko is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.