Fossil MCP — Static Analysis for AI-Generated Code

The code quality toolkit for the vibe coding era. Rust-powered static analysis that finds the mess vibe coding leaves behind — dead code, duplicated logic, scaffolding artifacts, and disconnected functions — across 15 languages.

The Vibe Coding Problem

AI-assisted coding is fine — you review the code, you understand the architecture, you stay in control. Vibe coding is different. You describe what you want, the AI writes it, and you ship it without reading every line. Tools like Claude Code, Cursor, GitHub Copilot, and Windsurf make this workflow fast and productive. But over days and weeks, vibe-coded projects accumulate a specific class of problems that traditional linters don't catch:

Dead code piles up fast

When the AI refactors a function, it writes the new version but often forgets to remove the old one. You don't notice because you didn't read the diff line by line. Over multiple sessions, unused functions, unreachable branches, and orphaned utilities pile up — the codebase grows but nothing gets pruned.

Duplication spreads silently

Each AI session has limited context window. It generates a utility function that already exists elsewhere, or solves the same problem with a slightly different implementation three files over. Traditional duplicate detection focuses on copy-paste — vibe coding duplication is structural: similar logic, different names, scattered across modules.

// Phase 1, // TODO, // Step 2 — everywhere

AI agents work in phases. They leave behind scaffolding markers that were meant to be temporary: Phase 1: Setup, TODO: implement error handling, placeholder function bodies with pass or todo!(), and phased naming like process_data_v2. In vibe coding, nobody goes back to clean these up.

Functions exist that nothing calls

The AI writes a helper function, uses it, then in a later session rewrites the caller to use a different approach — but the helper stays. Without a call graph, neither you nor the AI can tell which functions are actually connected to the rest of the codebase.

Temp files accumulate in the repo

AI sessions create temp_, backup_, old_, phase_1_ files and directories. In vibe coding, you don't audit your file tree after each session. These artifacts persist across commits.

What Fossil Detects

  • Dead Code — Unreachable functions, unused exports, orphaned methods. AI rewrites a caller but forgets to delete the old helper.
  • Code Clones — Type 1 (exact), Type 2 (renamed), Type 3 (structural) duplicates. Each AI session reinvents utilities that already exist.
  • Scaffolding — Phase N / Step N comments, TODO/FIXME markers, placeholder bodies. AI leaves temporary markers that never get cleaned up.
  • Temp Files — temp_*, backup_*, old_*, phase_* files and directories that persist because nobody audits the file tree.
  • Code Graph — Trace paths between any two functions, blast radius analysis, call graph traversal. AI tools navigate by text search — Fossil gives them a graph.

Installation

From crates.io:

cargo install fossil-mcp

From source:

git clone https://github.com/yfedoseev/fossil-mcp.git
cd fossil-mcp
cargo build --release

Supported Languages (15)

  • Python (.py)
  • JavaScript (.js, .jsx, .mjs)
  • TypeScript (.ts, .tsx)
  • Rust (.rs)
  • Go (.go)
  • Java (.java)
  • C# (.cs)
  • C/C++ (.c, .h, .cpp, .cc, .cxx, .hpp)
  • Ruby (.rb)
  • PHP (.php)
  • Swift (.swift)
  • Kotlin (.kt)
  • Scala (.scala)
  • Bash (.sh, .bash)
  • Lua (.lua)

MCP Server Setup

Fossil runs as an MCP server by default — just run fossil-mcp with no arguments. Connect it to your AI coding tool:

Claude Code

claude mcp add fossil fossil-mcp

OpenAI Codex

{"mcpServers": {"fossil": {"command": "fossil-mcp"}}}

Cursor

Add to ~/.cursor/mcp.json:

{"mcpServers": {"fossil": {"command": "fossil-mcp"}}}

VS Code

Add to .vscode/mcp.json:

{"mcp": {"servers": {"fossil": {"command": "fossil-mcp"}}}}

Windsurf

Add to ~/.codeium/windsurf/mcp_config.json:

{"mcpServers": {"fossil": {"command": "fossil-mcp"}}}

Claude Desktop

Add to claude_desktop_config.json:

{"mcpServers": {"fossil": {"command": "fossil-mcp"}}}

Zed

Add to Zed settings:

{"context_servers": {"fossil": {"command": {"path": "fossil-mcp"}}}}

JetBrains IDEs

Enable MCP in Settings, add via @jetbrains/mcp-proxy or direct stdio configuration.

Amazon Q

Add to ~/.aws/amazonq/default.json:

{"mcpServers": {"fossil": {"command": "fossil-mcp"}}}

GitHub Copilot

Configure via VS Code MCP settings.

MCP Tools Reference

  • scan_all — Run all analyses (dead code + clones) on a project
  • analyze_dead_code — Detect unreachable code with configurable confidence
  • detect_clones — Find duplicated code (Type 1/2/3 clones)
  • fossil_refresh — Incremental re-analysis after file changes (fast)
  • fossil_inspect — Inspect call graph, data flow, control flow, or blast radius for any function
  • fossil_trace — Find call paths between two functions
  • fossil_explain_finding — Get rich context about a specific finding
  • fossil_detect_scaffolding — Find AI scaffolding: phased comments, TODOs, placeholders, and temp files

CLI Usage

fossil-mcp scan /path/to/project
fossil-mcp dead-code /path/to/project
fossil-mcp clones /path/to/project
fossil-mcp dead-code /path/to/project --min-confidence high
fossil-mcp scan /path/to/project --format sarif -o results.sarif