MCP 服务器

context-ops-mcp

Gives your AI coding agent a bounded map of an unfamiliar TypeScript SaaS repo: where the code lives, what's risky to touch, and where the money / auth / user flows are. Provides eight MCP tools for orientation, task focus, risk assessment, and SaaS-specific observations without AST or type checking.

README

<br/>

</div>

context-ops-mcp

Gives your AI coding agent a bounded map of an unfamiliar TypeScript SaaS repo: where the code lives, what's risky to touch, and where the money / auth / user flows are. Without burning your context window on full-file reads.

Built for the agency, fractional-CTO, or consultancy dev lead who just inherited a TypeScript SaaS codebase and needs to go from zero to a credible map in one afternoon, inside Cursor or Claude Code.

What it does

Eight MCP tools your agent calls locally. All heuristic. Regex over file heads, filename rules, and one whole-file streaming pass in the relevance ranker. No AST. No type checker. No call graph.

Orientation: structure, top-of-file symbol hints, entry points, config files
Task focus: ranked candidate files for a task string, plus a step-ordered plan
Risk: files that often deserve extra care before edits
SaaS smells: observation-only flags for billing, auth, security patterns, debt markers, and risky deps

MCP tools exposed

Tool	What it returns
`get_project_structure`	Sorted POSIX paths of directories and files (skips node_modules, .git, dist, .next, .turbo, build, out, coverage, .svelte-kit, .vercel, .cache)
`get_semantic_summary`	First 50 lines of every .ts and .json file: detected exports, key functions, JSON top-level keys
`get_entry_points`	.ts files that look like bootstrap or route registration (filenames, folder hints, framework imports)
`get_relevant_files_for_task`	Up to 10 .ts files ranked against a task string (path, exports, key functions, plus a whole-file keyword pass)
`get_execution_plan_for_task`	Step-ordered list: inspect entries first, then a modify candidate, then supporting reads, plus an avoid list
`get_risky_files`	.ts files matching risky path segments, process.env, DB/auth imports, or startup patterns
`get_likely_config_files`	Manifests, tsconfig, .env, build/CI/tooling configs (filename pattern match, not content validation)
`get_saas_smells`	Observation-only scan (up to 500 lines per code file): billing keywords, auth imports, security regex hits, TODO/FIXME/HACK/XXX, any/@ts-ignore, risky deps from package.json. No scores. No severity ranking. No hour estimates.

What it will not claim

Not an audit, diagnosis, or analysis. The smell tool returns presence checks, not verdicts.
No /100 scores. No hour estimates on remediation.
No UI-layer claims. This reads code structure, not UX or conversion.
No AST, type-checker, or call-graph promises.
A determined engineer rebuilds the orientation core in an afternoon with grep and tree. The differentiator is MCP wiring, task-string ranking, and prose-narrated read order, not capability you cannot have.

Stack

TypeScript · MCP SDK · Node.js · stdio transport

Run locally

npm install
npm run build
npm run start

Wire it into Cursor or Claude Code as a local MCP server (stdio). No API keys required.

Built by

AboJad, Full Stack AI Engineer, Marrakesh

Secrets & API keys

Standing rule: one named API key per project per environment, living in exactly one location, never copied between projects. Give each environment its own distinctly named key (e.g. contextops-dev, contextops-prod) so rotating means replacing a single copy with none left to go stale. The recurring Anthropic key "exposures" across these repos were one key hand-copied between consumers, not a leak.

Local secrets live only in .env.local / .env (gitignored), never in a committed file.
Deployed secrets live only in the host env store (Vercel / Railway / etc.).
A pre-commit secrets scan (scripts/secrets_scan.py) blocks accidental commits; install it once per clone with powershell -ExecutionPolicy Bypass -File scripts/install_hooks.ps1.