Server data from the Official MCP Registry
Detect when AI code changes exceed declared task scope (MCP server).
Detect when AI code changes exceed declared task scope (MCP server).
This MCP server is well-designed with clean, focused code and appropriate security practices. It has no authentication (not needed—it's a stateless analysis tool), no credentials, no dangerous operations, and minimal permissions. The server correctly uses fnmatch for safe pattern matching and JSON for serialization. Minor code quality observations do not affect the overall security posture. Supply chain analysis found 4 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.
8 files analyzed · 8 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
This plugin requests these system permissions. Most are normal for its category.
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-choreoatlas-over-reach-detector": {
"args": [
"over-reach-detector"
],
"command": "uvx"
}
}
}From the project's GitHub README.
Detect and report when AI coding agents change files outside their declared task scope. Designed to plug into Cursor, Claude Code, and other MCP-compatible AI coding agents via the standard stdio transport.
Compares two things:
If the actual diff exceeds the declared scope, the tool returns status=over_reach and lists the offending files and categories.
over-reach-detector is an audit/disclosure tool, not a sandbox and not a blocker.
It compares a declared task scope with the actual files/categories changed by an AI coding agent. If the actual changes exceed the declared scope, it reports that mismatch.
It does not prevent file writes by itself. It does not decide whether to revert, approve, or block a change. The caller remains responsible for enforcement, rollback, or human review.
From PyPI:
pip install over-reach-detector
From source:
git clone https://github.com/choreoatlas/over_reach_detector
cd over_reach_detector
pip install -e .
Run all tests: python -m pytest -v
Try the CLI directly: python -m over_reach_detector.detector --input fixtures/example_pr_1.json --format markdown
Start the server (stdio transport): over-reach-detector (or python -m over_reach_detector.server from source)
Register with your AI agent:
~/.cursor/mcp.json, add (after pip install over-reach-detector):{
"mcpServers": {
"over-reach-detector": {
"command": "over-reach-detector"
}
}
}
Dev / from source: use "command": "python", "args": ["-m", "over_reach_detector.server"] (run from repo root).
pip install over-reach-detector, run claude mcp add over-reach-detector over-reach-detector (writes to ~/.claude.json). Dev / from source: claude mcp add over-reach-detector /absolute/path/to/python -m over_reach_detector.server.check_scope_tool takes:
declared_files: list of fnmatch globs (e.g. ["docs/*.md", "tests/*.py"])declared_categories: subset of ["tests", "docs", "infra", "config", "code"]actual_files: list of file paths the AI modifiedoutput_format: "json" (default) or "markdown"Returns a report with:
status: in_scope (within declared scope) | over_reach (reported mismatch) | emptyfile_overreach: files not matching any declared globcategory_overreach: inferred categories outside the declared setCurrent scope: CLI + MCP stdio server + 1 tool. Python only. fnmatch-based globs.
Out of scope (forbidden): code quality review, security audit, completeness governance, languages other than Python, multi-tool MCP servers, HTTP/SSE transport, GitHub Actions integration. These are deliberately deferred to later versions or never.
Call check_scope_tool directly from Python (same logic the MCP server exposes):
import json
from over_reach_detector import server
result = server.check_scope_tool(
declared_files=["docs/*.md"],
declared_categories=["docs"],
actual_files=["docs/a.md", "scripts/extra.py"],
output_format="json",
)
report = json.loads(result)
print(report["status"]) # "over_reach"
print(report["file_overreach"]) # ["scripts/extra.py"]
MIT — see LICENSE.
Be the first to review this server!
by Modelcontextprotocol · Developer Tools
Web content fetching and conversion for efficient LLM usage
by Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
by Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.