Deterministic cross-repo contract analysis for AI agents: frontend calls vs backend endpoints.
MCPpedia last refreshed this data
io.github.eezz4/zzop is an MCP server that deterministic cross-repo contract analysis for AI agents: frontend calls vs backend endpoints. Its tool list has not been published yet over stdio, sse and http, requires no API key, and scores 39/100 on MCPpedia's security, maintenance and efficiency rubric.
Config is the same across clients — only the file and path differ.
{
"mcpServers": {
"io-github-eezz4-zzop": {
"command": "<see-readme>",
"args": []
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
zzop is built for an AI agent working in one repo — say the frontend — that needs to verify or understand the other side of a contract (the backend) without reading it whole; a human reviewing the same cross-repo change is the identical use case. Its core move is a cross-repo join: it parses each repo into a language-neutral IR, exact-matches frontend fetch calls against backend routes across the repo boundary, and names near-misses (a typo'd path segment, a version drift, a method mismatch) ins
No automated test available for this server. Check the GitHub README for setup instructions.
Five weighted categories — click any category to see the underlying evidence.
No known CVEs.
No package registry to scan.
Be the first to review
Have you used this server?
Share your experience — it helps other developers decide.
Sign in to write a review.
Others in ai-ml / legal
MCP client bridge: connects to MCP servers and registers their tools on ctx.tools
The official MCP server implementation for the Perplexity API Platform
Workspace template + MCP server for Claude Code, Codex CLI, Cursor & Windsurf. Multi-agent knowledge engine (ag-refresh / ag-ask) that turns any codebase into a queryable AI assistant.
Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration
MCP Security Weekly
Get CVE alerts and security updates for io.github.eezz4/zzop and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
Your AI coding agent can't read your whole codebase. zzop reads it — and answers the same way every time.
Point zzop at one repository, or at your frontend and backend together, and it returns a single JSON document describing what is actually there: which frontend calls reach which backend routes and which reach nothing, what looks risky, what is dead, where to refactor first — and what this run could not see. An agent starts from that instead of guessing from the handful of files it had room to open.
zzop does not write code. It makes the understanding a code generator works from accurate and repeatable — same commit in, byte-identical findings out — so what your agent writes rests on what your code does rather than on what it inferred from a partial read. The thing being improved is comprehension, not capability.
Break a route is the whole product in one change: rename one backend route in a frontend/backend pair that share no code and no types. The frontend still compiles, its tests still pass — and zzop names both ends of the break, file and line (abridged here; the demo page shows the run's own format):
=== unprovided consumes ===
"PUT /api/user" @ fe-vite src/pages/Settings.jsx:19 ← the call now hits nothing
=== unconsumed provides ===
"PUT /api/users/me" @ be-express src/app/routes/auth/auth.controller.ts:61 ← the route nobody calls
That page is a narrated walkthrough: every command and the output it produced are written out, so it
reads end to end without you running anything. The script behind it, docs/demo/break-a-route.sh, is a
maintainer tool rather than a first-run command — it builds a cargo example (so it needs a source
checkout, not a released binary) and analyzes two repositories you supply at
corpus/oss/fe-vite and corpus/oss/be-express. corpus/oss/ is gitignored and nothing in this repo
ships those trees — they are third-party checkouts, not ours to redistribute; see
CONTRIBUTING.md on bringing your own corpus. (The synthetic corpus we did write
is committed, at cases/ — every file of it but one, a fixture
that has to carry a live vendor-token literal and so cannot be committed at all; its README says what
that costs the benchmark score.)
zzop ships as two Node-free binaries. Decide which one you need before you install anything:
| If you want | Use | How you drive it |
|---|---|---|
| An AI agent (Claude Code, Claude Desktop, any MCP client) to answer questions about your repos | zzop-mcp — an MCP server over stdio | Install the plugin or the .mcpb bundle and the agent calls the tools. You run no commands. → Use in Claude Code |
| To run analyses yourself — a terminal, a CI job, a script | zzop — a plain CLI | zzop init once per tree, then zzop analyze . or zzop cross --config …. JSON to stdout. → Use in a terminal or CI |
Both binaries dispatch to the same shared handlers over the same engine, so a tool call and a CLI run against the same path give the identical answer. Neither one makes a network request of any kind — they carry no HTTP dependency at all (privacy).
site-src/, generated by scripts/gen-site.mjs; site/ is the committed output — a guard rejects hand edits to it)docs/README.md](do