
Grasp
Open-source code architecture visualizer with a 150-tool MCP server, running fully locally.
About
Grasp is an open-source code architecture visualizer and analysis platform by ashfordeOU. Paste any GitHub or GitLab URL, or point it at a local directory, and get an interactive dependency graph, an A to F architecture health score, a security scanner with SARIF 2.1 export, blast radius analysis, churn heatmaps, and ORM query maps across 35 languages. It runs 100 percent in the browser or locally; no data leaves the machine.
The standout for developers is the MCP server (grasp-mcp-server on npm) exposing around 150 tools: dependency graphs, OSV.dev SCA vulnerability scanning, git change impact, architecture drift detection, test coverage gap maps, and a persistent Kuzu graph plus SQLite brain. A PR impact GitHub Action posts structured risk badges and reviewer suggestions on every pull request. Built-in AI chat supports 11 providers plus OpenRouter and Together AI, with keys stored only in browser localStorage.
The honest picture: Grasp is a solo/small-team open-source project, so support and release cadence depend on maintainer energy. The browser app is the zero-install path, while the MCP server is where the developer value compounds. Star counts and tool counts move with releases; treat published numbers as approximate.
What it can do
- Interactive dependency graphs in 10 views
- 150-tool MCP server for AI assistants
- Security scanning with SARIF export and OSV.dev SCA
- PR impact GitHub Action with risk badges
Setup
Use the browser app with no install, or npm install -g grasp-mcp-server for the MCP server.
Prerequisites
Node.js for the MCP server; a GitHub/GitLab URL or local directory to analyze.
Use cases
Works with
Trust score — 7/10
Scored 7/10 (metrics tier, metrics-v1). Evidence: Verified via vendor site/docs/GitHub and reputable coverage, wave 114; Trending score 74/100 from researcher assessment.
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.