io.github.aahlijia/dekko
PYPI · DEKKO
Static code map generator: MAP.md + map.json for any repo, plus a Claude Code /map plugin
Available components
Last scanned (36 minutes ago)
Scores higher than 99% of PyPI servers
Category Developer Tools
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- 0 of 11 dependencies flagged as unhealthy. View diagnostics → Pass
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to aahlijia/dekko). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 26 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability81
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3233 tokens (~170/item across 19 items; 18 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 18 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 19 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 1 Nov 26 +15
- Malware scan: unverified → pass ▲ security
- 31 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- 29 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 23 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- 22 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 19 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- 17 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 16 Oct 26 −14
- Malware scan: pass → unverified ▼ security
- Stability: 0.97 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed pypi/dekko@1.9.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | pypi |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | aahlijia/dekko |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/aahlijia/dekko/.github/workflows/release.yml@refs/tags/v1.9.0 |
| Rekor log index | 3168012778 |
| Predicate type | PyPI publish attestation https://docs.pypi.org/attestations/publish/v1 |
| Subject digest | sha256:0a817c0f43418bf8a0a1ee8822d2301752c400afd18064d3eff3258e4fbb3212 |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 11 packages
| Packages resolved | 11 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_note ~171
Anchor a durable note to a symbol. Notes are committed to .dekko/notes.json and shown on the symbol's card and in its context pack. Use after a non-obvious change so the rationale survives.
| Name | Type | Req | Description |
|---|---|---|---|
| root | string | – | Repo root containing map.json (default: server cwd) |
| symbol | string | yes | Symbol: name, Class.method, file.py:name, or a symbol id a reply printed (Foo.java::Foo.run#2). If the reply says the target is ambiguous, append ':LINE' from a printed candidate row (file.py:Class.m… |
| text | string | yes | The note text |
No output schema declared.
No examples provided.
check_ambiguous ~132
Repo-wide resolver-trust summary: ambiguous call-site count and rate, top colliding names/files. Run before an impact decision built on get_callers/get_callees/workset in a repo with common method names: a low rate means trust the graph; a high rate concentrated in a few files means spot-check those call sites by hand.
| Name | Type | Req | Description |
|---|---|---|---|
| budget | integer | – | Approx token budget (default 500; 0 = no cap) |
| root | string | – | Repo root containing map.json (default: server cwd) |
| top | integer | – | Top-N entries per ranking (default 5) |
No output schema declared.
No examples provided.
find_type_usages ~224
Every parameter or return annotation that uses a type — 'what breaks if I change this struct/class's shape', which the call graph can't answer since code can use a type without calling it. Covers named functions/methods plus TS callbacks and interface method signatures. Not covered: fields, generic arguments, JSX.
| Name | Type | Req | Description |
|---|---|---|---|
| budget | integer | – | Approximate token budget (default 800; 0 = no cap); lowest-relevance rows are dropped to fit and a cost footer is appended |
| exact | boolean | – | Match the declared type text exactly; by default the bare name matches inside wrappers (Optional[Config], Vec<Config>, Config | None all match 'Config'). Default false |
| limit | integer | – | Max result lines (default 50) |
| root | string | – | Repo root containing map.json (default: server cwd) |
| type | string | yes | Type/class/struct/interface name to search for, e.g. 'Config'. 'symbol', 'name' and 'target' are also accepted; two with different values is an error. |
No output schema declared.
No examples provided.
find_usages ~201
The symbols that call into an external (out-of-repo) name — a function, an imported binding, or a whole module — with call sites and a summary line. Calls only: type positions, JSX and property reads are not recorded; the summary's importing-file count shows what a low count leaves out.
| Name | Type | Req | Description |
|---|---|---|---|
| budget | integer | – | Approximate token budget (default 800; 0 = no cap); lowest-relevance rows are dropped to fit and a cost footer is appended |
| limit | integer | – | Max result lines (default 50) |
| name | string | yes | An external name: a function's own name ('run'), an imported binding ('chalk', 'np', 'React'), or a module ('numpy', 'node:path'). 'symbol', 'target' and 'type' are also accepted; two with different… |
| root | string | – | Repo root containing map.json (default: server cwd) |
No output schema declared.
No examples provided.
get_callees ~218
Every in-repo symbol a symbol calls — what this code depends on, without reading its body. Resolved call edges, not a grep of the body for call-shaped names.
| Name | Type | Req | Description |
|---|---|---|---|
| budget | integer | – | Approximate token budget (default 800; 0 = no cap); lowest-relevance rows are dropped to fit and a cost footer is appended |
| root | string | – | Repo root containing map.json (default: server cwd) |
| sites | boolean | – | One row per call site (path:line of each call expression) instead of one per definition |
| symbol | string | yes | Symbol: name, Class.method, file.py:name, or a symbol id a reply printed (Foo.java::Foo.run#2). If the reply says the target is ambiguous, append ':LINE' from a printed candidate row (file.py:Class.m… |
No output schema declared.
No examples provided.
get_callers ~254
Every symbol (and module-level site) that calls a symbol — exact call edges, unlike grep, which can't tell a call from a same-named string. Use for impact analysis before a change.
| Name | Type | Req | Description |
|---|---|---|---|
| budget | integer | – | Approximate token budget (default 800; 0 = no cap); lowest-relevance rows are dropped to fit and a cost footer is appended |
| include_tests | boolean | – | Include results from test files (default: false — test-file callers are usually noise for impact analysis; set true to include them) |
| root | string | – | Repo root containing map.json (default: server cwd) |
| sites | boolean | – | One row per call site (path:line of each call expression) instead of one per definition |
| symbol | string | yes | Symbol: name, Class.method, file.py:name, or a symbol id a reply printed (Foo.java::Foo.run#2). If the reply says the target is ambiguous, append ':LINE' from a printed candidate row (file.py:Class.m… |
No output schema declared.
No examples provided.
get_context_pack ~187
Compact signature neighborhood (callers/callees within N hops) for editing a symbol or file. Token-budgetable. Example: target="awardXp", task="who calls this".
| Name | Type | Req | Description |
|---|---|---|---|
| budget | integer | – | Approx token budget for the pack (default 800; 0 = no cap) |
| hops | integer | – | Neighborhood radius (default 1) |
| root | string | – | Repo root containing map.json (default: server cwd) |
| target | string | yes | Symbol or repo-relative file path. 'symbol', 'name' and 'type' are also accepted; two with different values is an error. |
| task | string | – | Rank output by relevance to this task description, blended with structural centrality and the working diff |
| with_source | boolean | – | Inline the target's source body and hop-1 call-site lines (default false; counts against budget) |
No output schema declared.
No examples provided.
get_subtypes ~282
What extends, implements, or is impl'd for a class/interface/struct/trait — the blast radius of changing a type declaration. Does not include each implementor's own callers; pair with get_callers for that.
| Name | Type | Req | Description |
|---|---|---|---|
| budget | integer | – | Approximate token budget (default 800; 0 = no cap); lowest-relevance rows are dropped to fit and a cost footer is appended |
| include_tests | boolean | – | Include results from test files (default: false — test-file callers are usually noise for impact analysis; set true to include them) |
| relation | string | – | Filter to one heritage-relation kind ('embeds' never appears: Go struct embedding is not extracted) |
| root | string | – | Repo root containing map.json (default: server cwd) |
| symbol | string | yes | Symbol: name, Class.method, file.py:name, or a symbol id a reply printed (Foo.java::Foo.run#2). If the reply says the target is ambiguous, append ':LINE' from a printed candidate row (file.py:Class.m… |
| transitive | boolean | – | Every direct and indirect implementor instead of just direct ones (default false) |
No output schema declared.
No examples provided.
get_supertypes ~289
What a class/interface/struct/trait extends, implements, or is impl'd for — its own declared heritage (Python/JS/TS/Java/Rust/C++). Go is not covered: struct embedding is not extracted and structural interface satisfaction has no declaring syntax to see.
| Name | Type | Req | Description |
|---|---|---|---|
| budget | integer | – | Approximate token budget (default 800; 0 = no cap); lowest-relevance rows are dropped to fit and a cost footer is appended |
| include_tests | boolean | – | Include results from test files (default: true; set false to drop test-path types from the index first) |
| relation | string | – | Filter to one heritage-relation kind ('embeds' never appears: Go struct embedding is not extracted) |
| root | string | – | Repo root containing map.json (default: server cwd) |
| symbol | string | yes | Symbol: name, Class.method, file.py:name, or a symbol id a reply printed (Foo.java::Foo.run#2). If the reply says the target is ambiguous, append ':LINE' from a printed candidate row (file.py:Class.m… |
| transitive | boolean | – | Full ancestor chain/DAG instead of one hop (default false) |
No output schema declared.
No examples provided.
impacted_tests ~152
Test files a runner should exercise after a change: reverse call-graph reachability from changed symbols plus an import-edge fallback. Leads, not verdicts (static analysis misses fixtures and dynamic dispatch), but it finds the indirect callers a grep for the changed name misses.
| Name | Type | Req | Description |
|---|---|---|---|
| budget | integer | – | Approximate token budget (default 6000; 0 = no cap); weakest-tier test files are dropped first to fit |
| limit | integer | – | Max impacted symbols per test file (default 8) |
| rev | string | – | Git rev to compare against (default: the commit the map was generated at, else HEAD) |
| root | string | – | Repo root containing map.json (default: server cwd) |
No output schema declared.
No examples provided.
list_notes ~61
List notes anchored to a symbol, or every note in the repo when no symbol is given.
| Name | Type | Req | Description |
|---|---|---|---|
| root | string | – | Repo root containing map.json (default: server cwd) |
| symbol | string | – | Symbol to list notes for (omit for all notes) |
No output schema declared.
No examples provided.
map_status ~34
Report whether map.json is fresh or stale.
| Name | Type | Req | Description |
|---|---|---|---|
| root | string | – | Repo root containing map.json (default: server cwd) |
No output schema declared.
No examples provided.
outline ~183
A file's (or directory's) structural outline — signatures + doc lines, no bodies — at roughly a tenth the cost of reading it. Prefer this before reading a file to learn what it contains.
| Name | Type | Req | Description |
|---|---|---|---|
| budget | integer | – | Approximate token budget (default 2000; 0 = no cap); lowest-relevance rows are dropped to fit and a cost footer is appended |
| limit | integer | – | Max symbol rows (default 200; if omitted and budget is set explicitly, budget governs instead — the 200 default doesn't stack with it) |
| root | string | – | Repo root containing map.json (default: server cwd) |
| target | string | yes | Mapped file path or directory (suffix-matched); a directory rolls up its files. 'symbol', 'name' and 'type' are also accepted; two with different values is an error. |
No output schema declared.
No examples provided.
query_symbol ~150
Signature, kind, location, doc, fan-in/out, and notes for one symbol — the fast way to learn what a symbol is without reading its file.
| Name | Type | Req | Description |
|---|---|---|---|
| root | string | – | Repo root containing map.json (default: server cwd) |
| symbol | string | yes | Symbol: name, Class.method, file.py:name, or a symbol id a reply printed (Foo.java::Foo.run#2). If the reply says the target is ambiguous, append ':LINE' from a printed candidate row (file.py:Class.m… |
No output schema declared.
No examples provided.
refresh_map ~60
Regenerate the map; set full=true to ignore the cache and re-parse every file.
| Name | Type | Req | Description |
|---|---|---|---|
| full | boolean | – | Ignore the .dekko cache (cold rebuild) |
| root | string | – | Repo root containing map.json (default: server cwd) |
No output schema declared.
No examples provided.
search_code ~249
Rank symbols by free-text relevance (BM25 over names, signatures and doc lines, not substring matching) — for when you know what the code should do but not its name. Zero hits is not an error: try broader terms. Once you have an exact name, use query_symbol/get_callers instead.
| Name | Type | Req | Description |
|---|---|---|---|
| budget | integer | – | Token budget for the output (default 800; 0 = no cap) |
| include_tests | boolean | – | Include test-path symbols (default: false) |
| kind | string | – | Comma-separated symbol kinds to restrict to (function, method, class, ...) |
| limit | integer | – | Max hits (default 15) |
| query | string | yes | Free-text description of the code you're looking for |
| root | string | – | Repo root containing map.json (default: server cwd) |
| scorer | string | – | Relevance scorer: 'lexical' (default, BM25, always available), 'embedding' (hashing-trick embedding), or 'both' (fuses lexical + embedding rankings via reciprocal rank fusion) — 'embedding' and 'both… |
No output schema declared.
No examples provided.
summary ~101
Compact repo digest (~40 lines): counts, language mix, per-directory rollup with coupling and purpose, load-bearing/orchestrating symbols, entry points, parse errors. Read this before exploring an unfamiliar repo.
| Name | Type | Req | Description |
|---|---|---|---|
| budget | integer | – | Approximate token cap (default 2000; 0 = no cap); trailing sections are shed to fit and a footer reports the omission |
| root | string | – | Repo root containing map.json (default: server cwd) |
No output schema declared.
No examples provided.
workset ~264
Task work-set: for a change (git rev) or a symbol, bundle the touched files' outlines plus call-graph packs for the most central touched symbols under one token budget. One call replaces impacted_tests + N outlines + N packs when starting on a change.
| Name | Type | Req | Description |
|---|---|---|---|
| budget | integer | – | Shared token budget for the whole bundle (default 6000; 0 = no cap) |
| packs | integer | – | Top-centrality touched symbols to deep-pack (default 5) |
| rev | string | – | Git rev to bundle changes against (default: the commit the map was generated at, else HEAD); omit when using 'symbol' |
| root | string | – | Repo root containing map.json (default: server cwd) |
| symbol | string | – | Seed from a symbol instead of a diff (name, Class.method, file.py:name); not with 'rev' |
| task | string | – | Rank output by relevance to this task description, blended with structural centrality and the working diff |
| type_impact | boolean | – | Also union every type-usage site and implementor into the touched set: the full blast radius of changing a shared type's shape. Requires 'symbol' naming a class/interface/struct/trait (no-op otherwis… |
No output schema declared.
No examples provided.
How do I install the io.github.aahlijia/dekko MCP server?
io.github.aahlijia/dekko runs locally as a PyPI package, launched with uvx dekko. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · dekko
claude mcp add aahlijia-dekko -- uvx dekko
What is the io.github.aahlijia/dekko MCP server?
io.github.aahlijia/dekko is an MCP server listed in the public MCP registry as io.github.aahlijia/dekko. Static code map generator: MAP.md + map.json for any repo, plus a Claude Code /map plugin. This page covers its PyPI package (dekko).
Is the io.github.aahlijia/dekko MCP server safe to use?
io.github.aahlijia/dekko scores 97 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.aahlijia/dekko MCP server expose?
io.github.aahlijia/dekko exposes 18 tools: search_code, query_symbol, get_callers, get_callees, find_usages, and 13 more. Their descriptions and schemas cost roughly 3,212 tokens of context every time the server is loaded.
Is the io.github.aahlijia/dekko MCP server still maintained?
io.github.aahlijia/dekko is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.aahlijia/dekko MCP server under?
io.github.aahlijia/dekko declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.