Django Chainsaw MCP server

Read from the package source without running it. The installed server may list more.

• amplification

  Endpoints anyone can call that cost a great deal to answer.

• api_contract

  The shape every serializer currently promises its clients.

• api_contract_check

  What this branch changes about the API, and who it breaks.

• blocking_in_async

  Synchronous calls that run on the event loop.

• bypassed_effects

  Bulk writes that skip everything the model's save() chain promised.

• celery_arguments

  Model instances handed to Celery tasks, and calls whose arity is wrong.

• checkwrite action

  Run every analysis and return one severity-sorted list.

• choice_typos

  Literals compared against a field whose `choices` will never match them.

• dangling_references

  URL names and template names that nothing will resolve.

• datetime_audit

  Naive datetimes in code, and ambiguous defaults on model fields.

• defeated_prefetches

  Relations that were prefetched and then re-queried anyway.

• delete_impactwrite action

  Show what deleting one row of a model would take with it.

• deploy_safetywrite action

  Is a pending destructive migration safe to deploy yet?

• endpoint_cost

  How many queries one request to each endpoint will cost.

• escaping_side_effects

  Calls inside a transaction whose effect cannot be rolled back.

• explain_model

  Everything known about one model, and the risks only visible combined.

• fastapi_exposure
• find_n_plus_one

  Find relation traversals in a template that each cost a query.

• find_unscoped_queries

  Find querysets that read tenant-scoped data without scoping the query.

• list_models

  List the project's models with their fields and relations.

• migration_risk

  Rate migrations by what they do to a live database.

• missing_indexes

  Fields the code filters or sorts on that carry no index.

• money_precision

  Places where a decimal amount stops being exact.

• multiplied_aggregates

  Aggregates whose numbers are wrong because a join multiplied the rows.

• open_endpoints

  Endpoints anyone can call, crossed with what their serializer exposes.

• project_info

  Check that the target Django project loads, and report what it is.

• project_profile

  What this project is built on, without needing Django to boot.

• queries_in_loops

  Database work written inside a loop, split by what the fix is.

• race_conditions

  Read-modify-save races, and row locks taken outside any transaction.

• request_impact

  Every finding, grouped by the entry points that actually reach it.

• scan_templateswrite action

  Run the N+1 analysis over every template in a directory.

• serializer_exposure

  What each DRF ModelSerializer exposes, and what looks unintended.

• serializer_nplusone

  N+1 queries in DRF serializers, with the queryset fix for each.

• sqlalchemy_nplusone
• suggest_fixes

  Findings turned into code, grouped by how safe each one is to apply.

• unused_eager_loading

  select_related and prefetch_related the serializer never reads.

• what_happens_on

  Follow the signal chain a save or delete actually triggers.

• Code scan51 source files scanned25/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitylocal package, no credentials required12/15
• Maintenancelast push 6 days ago15/15
• Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Django Chainsaw: common questions

Is Django Chainsaw MCP server safe?

Yes, by our scan: it is graded A (92/100). Read the Django Chainsaw safety report

How do I install Django Chainsaw?

It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.

Does Django Chainsaw need an API key?

No secret keys are declared. It reads 2 settings from the environment.

Is Django Chainsaw maintained?

The last commit was 7 days ago (2026-09-14). The latest release is v0.1.5.