mcpField
S
safe-fix-mcp

safe-fix-mcp

Local
github.com/pamela-0Developer Tools1Updated 10w ago
Repository

About safe-fix-mcp

safe-fix-mcp is an MCP server for Python repository maintainers that scans for dead code and dependency issues. It can propose a test-gated branch and PR for high-confidence unused imports, while other findings remain report-only and humans retain merge control.

Key features

  1. 01Scan dead code and dependencies
  2. 02Report findings without changes
  3. 03Remove qualifying unused imports
  4. 04Run the repository test suite
  5. 05Create and push a branch; attempt a PR

Use cases

  1. 01Review dead-code findings in a Python project
  2. 02Propose removal of high-confidence unused imports
  3. 03Keep code changes gated on passing tests

MCP support

Exposes `scan_dead_code` and `propose_removal_pr` tools to MCP clients.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "pamela-0-safe-fix": {
      "command": "uvx",
      "args": [
        "safe-fix-mcp"
      ]
    }
  }
}
Run commanduvx safe-fix-mcp

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
pypisafe-fix-mcp0.1.1

Tools

2

Saved tool list · updated 2w ago

ParameterTypeRequiredDescription
repo_pathstringNo
min_confidenceintegerNo

Details

From the project README

safe-fix-mcp

PyPI License: MIT

A real MCP server that finds dead code in a Python repository and proposes a branch + PR for the one class of finding that's actually safe to auto-remove: unused imports on a single-name import line. Everything else it finds — unused functions, classes, unused dependencies — stays report-only. A human always merges. This tool never merges anything itself.

Why this exists

Most "dead code" tools stop at reporting. The ones that go further usually delete with no safety net. This does neither: it drafts a real, minimal, reviewable PR, gated on the target repo's own full test suite actually passing after the removal — not a heuristic, a real pytest run. If the suite fails, nothing is committed or pushed; the repo is left exactly as it started.

Tools

scan_dead_code(repo_path=".", min_confidence=60)

Read-only. Runs vulture (dead code) and deptry (dependency issues) and returns a human-readable list of findings. Never modifies anything.

propose_removal_pr(repo_path=".")
  • Refuses on a dirty working tree — never edits on top of uncommitted work.
  • Filters to unused imports at ≥90% vulture confidence, on single-name import lines only (from x import y, z is skipped — removing the whole line would silently remove z too).
  • Creates a real branch, removes the qualifying imports, runs the repo's real full test suite.
  • Only on a real pass: commits, pushes, and tries to open a PR via gh pr create.
  • If gh isn't installed/authenticated, the branch is still committed and pushed for real — only PR creation degrades, with the real error returned so you can open it manually.

Install

pip install safe-fix-mcp

Add to your MCP client config (e.g. Claude Code):

claude mcp add safe-fix-mcp -- safe-fix-mcp

Or run directly for local testing:

python -m safe_fix_mcp.server

Installing from source instead of PyPI:

pip install -e .

Skill

A SKILL.md ships inside this same package — not a separate download — and teaches Claude when and how to use the two tools correctly (e.g. that propose_removal_pr only ever auto-removes single-name unused imports, never functions/classes/dependencies). Install it into your project:

safe-fix-mcp-install-skill

Run it from the project root you want the skill active in — it writes to .claude/skills/safe-fix-mcp/SKILL.md relative to your current directory.

Requirements

  • Python ≥ 3.10
  • git on PATH
  • gh (GitHub CLI) on PATH and authenticated, if you want propose_removal_pr to actually open the PR — without it, the branch still gets pushed for real, and the tool tells you to open the PR by hand.

Development

pip install -e ".[dev]"
pytest

Known limitation

vulture flags scan_dead_code/propose_removal_pr themselves as "unused" — a known false-positive class, not a real bug: they're dispatched by the @mcp.tool() decorator at runtime, not called directly anywhere in the source, so static call-graph analysis can't see the real caller (the MCP framework itself).

Verifying it for real

scripts/verify_real_client.py launches the packaged server as a real subprocess and talks to it with the real mcp.client.ClientSession — the same path a real MCP client uses. Useful as a smoke test after any change:

python scripts/verify_real_client.py

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.