MCP server audit: 43 tools, 97%/A quality, 93%/A security, 0 crashes across 28 tools tested
Ran mcp-doctor (static analysis) and mcp-fuzz + mcp-reality-check (runtime checks) against Serena. Sharing the results in case they're useful — no action needed on your end.
mcp-doctor: 97%/A quality, 93%/A security, 43 tools detected. Serena's class-based tool registry (class XyzTool(Tool): def apply(...)) wasn't recognized at all before this pass — added support for it, including resolving tool names from the class name and params from apply()'s reST/Sphinx-style docstring (:param x:). Two tools (search_for_pattern, safe_delete_symbol) initially came back as "no description" — that was a bug in my own tool, not Serena: I was reading the class's docstring, but src/serena/mcp.py's func_doc = tool.get_apply_docstring() or "" shows the actual registered description always comes from apply()'s own docstring. Fixed on my end.
mcp-fuzz + mcp-reality-check: ran end-to-end with a real Python language server actually active (not a stub) — --include-destructive against all 28 real tools (symbol/LSP tools included), 0 crashes, 0 timeouts, 100%/A on both crash-resilience and response-sanity checks. Every synthetic bad-input call that errored came back as a well-typed, specific exception (FileNotFoundError, NotADirectoryError, a clear symbol-resolution ValueError) — no raw tracebacks.
No bugs found in Serena itself this round — a clean, well-built server. A real per-repo grade badge is available if useful:
[](https://vishalhabib99.github.io/mcp-doctor/)
Feel free to add it to the README if useful, or just close this out — either way.
Source: oraios/serena