@berkayderin/nextscan

nextscan

MCP server that scans Next.js projects and returns a compact summary. One tool call → full project overview.

What it does

Without nextscan	With nextscan
Manual file-by-file exploration	Single scan call
Multiple tool calls to understand routes	Compact route tree with flags
Missing security issues	Hardcoded secrets + env leak detection
Unknown API coverage	Auth + validation status per endpoint
Schema guesswork	Prisma/Drizzle relation mapping

Quick Install

# Clone and build
cd nextscan
npm install
npm run build

# Add to Claude Code
claude mcp add nextscan -- node /path/to/nextscan/dist/index.js

Tool: scan

Parameter	Type	Required	Description
path	string	Yes	Absolute path to Next.js project root
focus	enum	No	routes | api | schema | security

Example Output

nextscan — my-app
────────────────────────────────────────
Root: /Users/dev/my-app
   src/ : yes  app/ : yes  middleware: yes
   ORM  : prisma

Routes
   Pages: 12  Layouts: 3  API: 5
   Dynamic: 4  Static: 8
   Client: 3  Server: 9
   Groups: (marketing), (auth)
   Matchers: /dashboard/:path*, /api/:path*
   ┌─ Pages
   ├─ /
   ├─ /about
   ├─ /dashboard [client]
   ├─ /blog/[slug] [dyn,SSG]
   └─ /settings [client]

API Endpoints
   Total: 5  Unprotected: 1
   ├─ GET,POST /api/users [auth:next-auth | val:zod]
   ├─ GET /api/health [no-auth,no-rate-limit]
   └─ POST /api/webhook [no-auth,no-validation]

Schema
   Models: 5  Relations: 4
   Orphans: AuditLog
   User ─< Post (1:N)
   User ─ Profile (1:1)
   Post >─< Tag (N:N)

Security
   Score: 75/100  Headers: yes  Middleware: yes
   [high] API route /api/health has no auth: [GET]
   [medium] No rate limiting on /api/users

Example Prompts

• "Scan my Next.js project at /Users/dev/my-app"
• "Check the security of my Next.js app"
• "Show me the route structure"
• "Analyze the database schema"

Architecture

src/
├── index.ts              # MCP server entry point
├── tools/scan.ts         # Orchestrator
├── analyzers/
│   ├── routes.ts         # App router analysis
│   ├── api.ts            # API endpoint analysis
│   ├── schema.ts         # Schema orchestration
│   └── security.ts       # Security scanning
├── parsers/
│   ├── typescript.ts     # ts-morph utilities
│   ├── prisma.ts         # Regex-based Prisma parser
│   └── drizzle.ts        # AST-based Drizzle parser
├── formatters/
│   └── compact.ts        # Unicode tree formatter
└── utils/
    ├── fs.ts             # File system utilities
    └── detect.ts         # Project detection

Requirements

• Node.js 18+
• An MCP-compatible client (Claude Code, Claude Desktop, etc.)

Development

npm install
npm run build
npm test
npm run test:coverage

Author

Berkay Derin — github.com/berkayderin

License

MIT