nextscan
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@nextscanscan my Next.js project at /Users/dev/my-app"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
nextscan
MCP server that scans Next.js projects and returns a compact summary. One tool call → full project overview.
What it does
Without nextscan | With nextscan |
Manual file-by-file exploration | Single |
Multiple tool calls to understand routes | Compact route tree with flags |
Missing security issues | Hardcoded secrets + env leak detection |
Unknown API coverage | Auth + validation status per endpoint |
Schema guesswork | Prisma/Drizzle relation mapping |
Related MCP server: guardvibe
Quick Install
# Clone and build
cd nextscan
npm install
npm run build
# Add to Claude Code
claude mcp add nextscan -- node /path/to/nextscan/dist/index.jsTool: scan
Parameter | Type | Required | Description |
| string | Yes | Absolute path to Next.js project root |
| enum | No |
|
Example Output
nextscan — my-app
────────────────────────────────────────
Root: /Users/dev/my-app
src/ : yes app/ : yes middleware: yes
ORM : prisma
Routes
Pages: 12 Layouts: 3 API: 5
Dynamic: 4 Static: 8
Client: 3 Server: 9
Groups: (marketing), (auth)
Matchers: /dashboard/:path*, /api/:path*
┌─ Pages
├─ /
├─ /about
├─ /dashboard [client]
├─ /blog/[slug] [dyn,SSG]
└─ /settings [client]
API Endpoints
Total: 5 Unprotected: 1
├─ GET,POST /api/users [auth:next-auth | val:zod]
├─ GET /api/health [no-auth,no-rate-limit]
└─ POST /api/webhook [no-auth,no-validation]
Schema
Models: 5 Relations: 4
Orphans: AuditLog
User ─< Post (1:N)
User ─ Profile (1:1)
Post >─< Tag (N:N)
Security
Score: 75/100 Headers: yes Middleware: yes
[high] API route /api/health has no auth: [GET]
[medium] No rate limiting on /api/usersExample Prompts
"Scan my Next.js project at /Users/dev/my-app"
"Check the security of my Next.js app"
"Show me the route structure"
"Analyze the database schema"
Architecture
src/
├── index.ts # MCP server entry point
├── tools/scan.ts # Orchestrator
├── analyzers/
│ ├── routes.ts # App router analysis
│ ├── api.ts # API endpoint analysis
│ ├── schema.ts # Schema orchestration
│ └── security.ts # Security scanning
├── parsers/
│ ├── typescript.ts # ts-morph utilities
│ ├── prisma.ts # Regex-based Prisma parser
│ └── drizzle.ts # AST-based Drizzle parser
├── formatters/
│ └── compact.ts # Unicode tree formatter
└── utils/
├── fs.ts # File system utilities
└── detect.ts # Project detectionRequirements
Node.js 18+
An MCP-compatible client (Claude Code, Claude Desktop, etc.)
Development
npm install
npm run build
npm test
npm run test:coverageAuthor
Berkay Derin — github.com/berkayderin
License
MIT
Available Tools
1 toolscanA
Scan a Next.js project and return a compact summary of routes, API endpoints, schema, and security issues
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Absolute path to the Next.js project root | |
| focus | No | Focus on a specific area (omit for full scan) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of explaining behavior. It adds a useful piece of behavioral context by stating the output is a 'compact summary', but it does not clarify whether scanning is read-only, whether it traverses the filesystem, or what form the summary takes. This is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that leads with the action, specifies the target, and lists the scope. Every word earns its place; there is no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 2-parameter tool with no output schema, the description reasonably covers the main deliverables and the optional focus areas. It does not describe the summary's exact format or nesting, but the tool is simple enough that the description provides sufficient context for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents both parameters with 100% coverage, including the enum values for 'focus'. The description does not add meaning beyond the schema, so the baseline score of 3 is appropriate. It introduces the high-level output categories but does not elaborate on parameter syntax or relationships.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Scan' with a specific resource ('Next.js project') and explicitly enumerates the output areas: routes, API endpoints, schema, and security issues. It is specific and self-contained, and there are no sibling tools requiring differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use the tool: analyzing a Next.js project and getting a summary of key areas. It does not explicitly state when not to use it or mention alternatives, but the absence of siblings reduces the need for exclusions. The optional 'focus' parameter also implicitly guides selective usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
1 tool update
v1.0.1- First observed
scan
TDQS
With only one tool, there is no possibility of confusion between tools. The single tool has a clear, distinct purpose of scanning a Next.js project.
Only one tool exists, so naming is inherently consistent. The verb 'scan' clearly indicates the action.
A single tool is extremely thin for a server, suggesting the surface is severely underdeveloped. Even if the purpose is narrow, most useful servers would expose multiple operations.
The scan tool provides a comprehensive overview of a Next.js project, but it is a read-only operation. Missing other aspects like specific security fix suggestions or detailed endpoint management, leaving notable gaps for deeper workflows.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
Security, SEO and AI-visibility scanner for web apps · free scans and focused checks via MCP.
Scan any MCP server for tool-poisoning, security, auth & license. Trust score before install.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceA utility tool that analyzes Next.js application routes and provides detailed information about API paths, HTTP methods, parameters, status codes, and request/response schemas.3299MIT
- AlicenseAqualityAmaintenanceSecurity MCP server with 300+ rules for AI-generated code. Scans Next.js, Supabase, Clerk, Stripe, Prisma, Hono, GraphQL and 20+ modules. Zero config, runs locally.393935Apache 2.0
- FlicenseAqualityDmaintenanceA comprehensive MCP server for frontend analysis. It provides Google Lighthouse audits, code quality checks, SEO metadata verification, accessibility analysis, and bundle optimization for React and Next.js projects.83-
- AlicenseNot gradedqualityCmaintenanceCross-stack MCP server that scans frontend and backend code together, detects mismatches like phantom calls, dead endpoints, and field drift, and provides a full-stack health audit.161MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/berkayderin/nextscan'
If you have feedback or need assistance with the MCP directory API, please join our Discord server