io.github.berkayderin/nextscan
MCP server that scans Next.js projects and returns a compact summary
Install
Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).
@berkayderin/nextscanclaude mcp add nextscan -- npx -y @berkayderin/nextscan@1.0.1{
"mcpServers": {
"nextscan": {
"command": "npx",
"args": [
"-y",
"@berkayderin/nextscan@1.0.1"
]
}
}
}Documentation
From the project's README on GitHub, refreshed weekly. Links open on GitHub.
Contents
nextscan
MCP server that scans Next.js projects and returns a compact summary. One tool call → full project overview.
What it does
| Without nextscan | With nextscan |
|---|---|
| Manual file-by-file exploration | Single scan call |
| Multiple tool calls to understand routes | Compact route tree with flags |
| Missing security issues | Hardcoded secrets + env leak detection |
| Unknown API coverage | Auth + validation status per endpoint |
| Schema guesswork | Prisma/Drizzle relation mapping |
Quick Install
# Clone and build
cd nextscan
npm install
npm run build
# Add to Claude Code
claude mcp add nextscan -- node /path/to/nextscan/dist/index.jsTool: scan
| Parameter | Type | Required | Description | |||
|---|---|---|---|---|---|---|
path | string | Yes | Absolute path to Next.js project root | |||
focus | enum | No | routes \ | api \ | schema \ | security |
Example Output
nextscan — my-app
────────────────────────────────────────
Root: /Users/dev/my-app
src/ : yes app/ : yes middleware: yes
ORM : prisma
Routes
Pages: 12 Layouts: 3 API: 5
Dynamic: 4 Static: 8
Client: 3 Server: 9
Groups: (marketing), (auth)
Matchers: /dashboard/:path*, /api/:path*
┌─ Pages
├─ /
├─ /about
├─ /dashboard [client]
├─ /blog/[slug] [dyn,SSG]
└─ /settings [client]
API Endpoints
Total: 5 Unprotected: 1
├─ GET,POST /api/users [auth:next-auth | val:zod]
├─ GET /api/health [no-auth,no-rate-limit]
└─ POST /api/webhook [no-auth,no-validation]
Schema
Models: 5 Relations: 4
Orphans: AuditLog
User ─< Post (1:N)
User ─ Profile (1:1)
Post >─< Tag (N:N)
Security
Score: 75/100 Headers: yes Middleware: yes
[high] API route /api/health has no auth: [GET]
[medium] No rate limiting on /api/usersExample Prompts
- "Scan my Next.js project at /Users/dev/my-app"
- "Check the security of my Next.js app"
- "Show me the route structure"
- "Analyze the database schema"
Architecture
src/
├── index.ts # MCP server entry point
├── tools/scan.ts # Orchestrator
├── analyzers/
│ ├── routes.ts # App router analysis
│ ├── api.ts # API endpoint analysis
│ ├── schema.ts # Schema orchestration
│ └── security.ts # Security scanning
├── parsers/
│ ├── typescript.ts # ts-morph utilities
│ ├── prisma.ts # Regex-based Prisma parser
│ └── drizzle.ts # AST-based Drizzle parser
├── formatters/
│ └── compact.ts # Unicode tree formatter
└── utils/
├── fs.ts # File system utilities
└── detect.ts # Project detectionRequirements
- Node.js 18+
- An MCP-compatible client (Claude Code, Claude Desktop, etc.)
Development
npm install
npm run build
npm test
npm run test:coverageAuthor
Berkay Derin — github.com/berkayderin
License
MIT
Frequently asked questions
What is io.github.berkayderin/nextscan?
MCP server that scans Next.js projects and returns a compact summary
How do I install io.github.berkayderin/nextscan?
It runs on your machine. In Claude Code: claude mcp add nextscan -- npx -y @berkayderin/nextscan@1.0.1. For other clients, paste the JSON configuration from this page into their MCP settings.
Does io.github.berkayderin/nextscan need an API key?
Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.
Is io.github.berkayderin/nextscan open source?
Yes. Its code is on GitHub under the MIT license.
Who maintains io.github.berkayderin/nextscan?
It is published by berkayderin. AI.tn lists it but does not maintain or endorse it.
From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.