# io.github.neogeweb3/code-health-suite (pypi · code-health-suite)

16 engines, 28 MCP tools for Python code quality. Zero external dependencies.

- Trust score: 21/100 (low)
- Change this week: −23
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- pypi · `code-health-suite`: 21/100 (this document), [markdown](https://verifymcp.io/servers/neogeweb3-code-health-suite/code-health-suite.md), [page](https://verifymcp.io/servers/neogeweb3-code-health-suite/code-health-suite)

## Channel facts

- Registry: `pypi`
- Package: `code-health-suite`
- Version: `0.8.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 50/100
  - Malware scan not yet available for this package.
  - No known CVEs affecting this package version or its production dependencies.
  - Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it.
  - No production dependencies, so there is no dependency health to assess.
- **Provenance & Transparency**: 32/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - License check failed: the license (MIT License) isn't a recognized OSI-approved license.
  - Actively maintained (last published 136 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 0/100
  - Schema quality not yet verified: our sandbox run of this package did not complete, so we have no schema to assess.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: our sandbox run of this package did not complete, so we have no schema to compare.
- **Tool Coverage**: 0/100
  - Tool coverage not yet verified: our sandbox run of this package did not complete, so we have no tool definitions to assess.
- **Capabilities**: 0/100
  - Protocol version not yet verified: our sandbox run of this package did not complete, so we never saw its MCP handshake.

**Unverified: 4 categories.** Categories scored 0 because our sandbox run of this package has not given us the schema these checks need to read. That is a gap on our side rather than a finding about the package, and we only credit what we can confirm, so the score stands at 0 until the capture succeeds. We are working through the fleet, so this normally clears without any action from you.

## Install

### Claude

```bash
claude mcp add neogeweb3-code-health-suite -- uvx code-health-suite
```

### Codex

```bash
codex mcp add neogeweb3-code-health-suite -- uvx code-health-suite
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "neogeweb3-code-health-suite": {
      "type": "local",
      "command": [
        "uvx",
        "code-health-suite"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add neogeweb3-code-health-suite --command uvx --arg code-health-suite
```

### Hermes

```yaml
mcp_servers:
  neogeweb3-code-health-suite:
    command: "uvx"
    args: ["code-health-suite"]
```

### Other

```json
{
  "mcpServers": {
    "neogeweb3-code-health-suite": {
      "command": "uvx",
      "args": [
        "code-health-suite"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 21, −15)

- [security regression] Malware scan: pass → unverified

### 2026-08-02 (score 36, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-07-31 (score 21, −5)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 26, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 44, 0)

- [functional] Tool coverage: Tool coverage not yet verified: our sandbox run of this package did not complete, so we have no tool definitions to assess.
- [functional] Schema quality: Schema quality not yet verified: our sandbox run of this package did not complete, so we have no schema to assess.

### 2026-07-26 (score 44)

First indexed and scored.

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

## MCP tools (28)

### `analyze_complexity` (~109 tokens)

Analyze Python code complexity for a file or directory. Returns per-function metrics: cyclomatic complexity (McCabe), cognitive complexity, nesting depth, function length, and letter grades (A-F).

Input parameters:

- `path` (string, required): File or directory path to analyze.
- `sort_by` (string): Sort metric (default: complexity).
- `threshold` (integer): Cyclomatic complexity threshold (default: 10).
- `top` (integer): Return only top N functions by complexity. 0 = all.

### `get_complexity_score` (~52 tokens)

Get an overall complexity health score (0-100) with letter grade (A-F), complexity profile classification, and top offenders. Quick project health check.

Input parameters:

- `path` (string, required): Directory path to analyze.

### `find_dead_code` (~77 tokens)

Detect unused imports, functions, variables, and arguments in Python code. Supports cross-module analysis to reduce false positives.

Input parameters:

- `category` (string): Filter by category. Omit for all categories.
- `min_severity` (string): Minimum severity level (default: info).
- `path` (string, required): File or directory path to scan.

### `security_scan` (~57 tokens)

Scan Python code for security vulnerabilities: command injection, SQL injection, path traversal, hardcoded secrets, unsafe deserialization, XSS, and more. Maps findings to CWE identifiers.

Input parameters:

- `path` (string, required): File or directory path to scan.

### `get_security_score` (~46 tokens)

Get an overall security health score (0-100) with grade, profile, and top vulnerability rules. Quick security posture assessment.

Input parameters:

- `path` (string, required): Directory path to scan.

### `analyze_imports` (~55 tokens)

Analyze Python import dependency graph. Returns module metrics, circular dependencies (cycles), orphan modules, hub modules, and instability scores. Use to understand project architecture.

Input parameters:

- `path` (string, required): Root directory of the Python project to analyze.

### `get_import_health` (~54 tokens)

Get an import graph health score (0-100) with grade. Penalizes circular dependencies, orphan modules, unstable modules, and hub concentration. Quick architecture health check.

Input parameters:

- `path` (string, required): Root directory to analyze.

### `find_clones` (~114 tokens)

Detect code clones (duplicated code blocks) in a Python project. Finds Type-1 (exact), Type-2 (renamed), and Type-3 (near-miss) clones. Returns clone pairs with similarity scores and cluster analysis.

Input parameters:

- `min_lines` (integer): Minimum function length to consider (default: 5).
- `path` (string, required): Directory path to scan for clones.
- `threshold` (number): Similarity threshold 0.0-1.0 (default: 0.8).

### `analyze_test_quality` (~80 tokens)

Analyze test suite quality: assertion density, test length, naming conventions, magic numbers, and more. Returns per-file and per-test metrics with a quality score (0-100) and grade.

Input parameters:

- `max_length` (integer): Max test function length before flagging (default: 50).
- `path` (string, required): Root directory containing test files.

### `find_hotspots` (~106 tokens)

Find code hotspots — files with high git churn AND high complexity. These are the riskiest files in a project: frequently changed AND hard to understand. Requires a git repository. Returns hotspot scores, risk levels, and churn/complexity breakdown.

Input parameters:

- `path` (string, required): Git repository root path.
- `since_days` (integer): Look back N days for churn data (default: 180).
- `top` (integer): Return top N hotspots (default: 20).

### `get_hotspot_score` (~53 tokens)

Get overall hotspot health score (0-100) with grade. Measures concentration of risk (churn x complexity). Lower scores indicate more hotspots that need attention.

Input parameters:

- `path` (string, required): Git repository root path.

### `audit_dependencies` (~63 tokens)

Audit Python project dependencies for outdated packages and known vulnerabilities. Reads requirements.txt and/or pyproject.toml. Returns per-dependency status, latest versions, and CVE/vulnerability details.

Input parameters:

- `path` (string, required): Project root directory containing requirements.txt or pyproject.toml.

### `analyze_change_impact` (~99 tokens)

Analyze the ripple effect of changing specific files. Shows direct dependents, transitive impact, affected tests, and an impact score (fraction of project affected). Use before refactoring to understand blast radius.

Input parameters:

- `changed_files` (array, required): List of file paths (relative to root) that are being changed.
- `max_depth` (integer): Max transitive dependency depth (default: 10).
- `path` (string, required): Project root directory.

### `analyze_coupling` (~63 tokens)

Analyze module coupling metrics: afferent coupling (Ca), efferent coupling (Ce), instability (Ce/(Ca+Ce)), and hub scores. Identifies tightly-coupled modules that may resist change.

Input parameters:

- `path` (string, required): Project root directory.

### `analyze_type_coverage` (~54 tokens)

Analyze Python type annotation coverage: function signatures, parameters, return types, Any usage, and type: ignore comments. Returns per-file metrics and coverage percentages.

Input parameters:

- `path` (string, required): File or directory path to analyze.

### `get_type_score` (~49 tokens)

Get overall type coverage health score (0-100) with grade. Measures annotation completeness, Any usage, and type: ignore density.

Input parameters:

- `path` (string, required): File or directory path to analyze.

### `audit_env_vars` (~59 tokens)

Audit environment variable usage: find undefined vars referenced in code, unused vars in .env files, secrets in templates, and missing .env.example entries. Supports Python, JavaScript, and shell scripts.

Input parameters:

- `path` (string, required): Project root directory.

### `audit_git_commits` (~153 tokens)

Audit recent git commits in a repository. Extracts changed files and runs static analysis (security scan, complexity) on each commit. Returns per-commit grades, security findings, and complexity violations.

Input parameters:

- `author` (string): Filter commits by author name.
- `commits` (integer): Number of recent commits to audit (default: 10).
- `repo` (string, required): Path to the git repository to audit.
- `severity` (string): Minimum security finding severity (default: low).
- `since` (string): Audit commits since date (e.g., '3 days ago', '2026-03-01').
- `threshold` (integer): Complexity threshold for flagging functions (default: 10).

### `get_git_audit_score` (~69 tokens)

Get a quick overall grade and score for recent commits in a repo. Returns the aggregate score, grade, commit count, and security summary.

Input parameters:

- `commits` (integer): Number of recent commits to audit (default: 10).
- `repo` (string, required): Path to the git repository.

### `check_naming` (~66 tokens)

Check Python naming conventions (PEP 8). Detects violations: functions/methods must be snake_case, classes must be CamelCase, constants must be UPPER_SNAKE_CASE. Returns violations with suggestions.

Input parameters:

- `path` (string, required): File or directory path to check.

### `get_naming_score` (~59 tokens)

Get a naming convention health score (0-100) with grade. Measures PEP 8 naming compliance: snake_case functions, CamelCase classes, UPPER_SNAKE_CASE constants.

Input parameters:

- `path` (string, required): Directory path to check.

### `scan_todos` (~128 tokens)

Scan source code for technical debt markers: TODO, FIXME, HACK, XXX, BUG, NOTE, OPTIMIZE, REFACTOR comments. Returns items with file, line, tag, severity, and message. Optionally enriches with git blame metadata.

Input parameters:

- `blame` (boolean): Enrich with git blame metadata (author, date). Slower.
- `path` (string, required): File or directory path to scan.
- `severity` (string): Filter by minimum severity level.
- `tag` (string): Filter by specific tag (e.g., TODO, FIXME, HACK).

### `get_todo_score` (~52 tokens)

Get a technical debt health score (0-100) with grade based on density and severity of TODO/FIXME/HACK markers. Shows hotspot files.

Input parameters:

- `path` (string, required): Directory path to scan.

### `detect_bugs` (~154 tokens)

Detect common Python semantic bugs using AST analysis. Finds 8 categories: missing f-strings, mutable class variables, late-binding closures, call-expression defaults (datetime.now()), mutable default arguments, assert-on-tuple, unreachable code, and unreachable exception handlers. Every finding indicates a likely real bug, not a style violation.

Input parameters:

- `min_severity` (string): Minimum severity to report (default: info).
- `path` (string, required): File or directory path to scan.
- `rules` (array): Filter by specific rules. Options: missing-fstring, mutable-class-var, late-binding-closure, call-default, mutable-default-arg, assert-tuple, unreachable-code, unreachable-except. Omit for all rules.

### `get_bug_score` (~64 tokens)

Get a bug detection health score (0-100) with grade (A-F), bug profile classification (clean/fstring_heavy/closure_heavy/etc.), and breakdown by rule and severity. Quick bug health check.

Input parameters:

- `path` (string, required): Directory path to scan.

### `audit_docstrings` (~62 tokens)

Audit Python docstring coverage and quality. Checks public functions, methods, classes, and modules for missing or low-quality docstrings. Returns per-entity coverage, missing docstrings, and quality issues.

Input parameters:

- `path` (string, required): File or directory path to audit.

### `get_docstring_score` (~57 tokens)

Get a docstring coverage health score (0-100) with grade. Measures what percentage of public entities have docstrings and penalizes low-quality docstrings. Shows worst files.

Input parameters:

- `path` (string, required): Directory path to audit.

### `full_health_check` (~105 tokens)

Run all analyses (complexity + dead code + security + imports + clones + test quality + type coverage + env audit + naming + TODO debt + bug detection + docstring coverage) on a Python project and return a combined health report with scores, grades, and top issues. Note: hotspot, dependency, and change impact require additional context (git repo, requirements files, changed files) so are excluded from this scan.

Input parameters:

- `path` (string, required): Directory path to analyze.

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Dependencies. The full working is on the page: https://verifymcp.io/servers/neogeweb3-code-health-suite/code-health-suite#diagnostics

## Score history

- 2026-08-03: 21
- 2026-08-02: 36
- 2026-08-01: 21
- 2026-07-31: 21
- 2026-07-30: 26
- 2026-07-28: 44
- 2026-07-27: 44
- 2026-07-26: 44

## Links

- PyPI project: https://pypi.org/project/code-health-suite/
- Socket report: https://socket.dev/pypi/package/code-health-suite
- Repository: https://github.com/neogeweb3/code-health-suite
- Changelog RSS feed: https://verifymcp.io/servers/neogeweb3-code-health-suite/code-health-suite/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/neogeweb3-code-health-suite/code-health-suite/changelog.json
- HTML version of this page: https://verifymcp.io/servers/neogeweb3-code-health-suite/code-health-suite