🛰️ Report-first · runs the real Go toolchain · no LLM in the server

Find the bugs that are actually real.

A Go-only code scanner that reports genuine bugs, dead code and stale docs — then stops. It never rewrites your code. A sensor, not an oracle.

Get started → View on GitHub

gospect-mcp scan -format text ./service

$ gospect-mcp scan -format text ./service
gospect: 6 finding(s) in ./service (272 packages, 1 module)
  [high  ] nilness          handler.go:41
           nil dereference in HandleCheckout
  [medium] unchecked-error  store.go:88
           error return value is not checked
  [medium] lostcancel       worker.go:23
           the context.CancelFunc is never called
  … bugs sorted to the top, generated files skipped
$ ▮

~2.5s272 packages, warm

1 binaryany MCP client

0lines it edits

8+bug detectors

Why gospect-mcp

Ground truth, not a confident guess.

Ask an AI to “find bugs” and roughly one in fifteen is real — the rest are plausible guesses. gospect is deterministic: it’s certain about a small set of things, and hands the judgment back to you.

🛰️

Report-first

The output is a report. It never touches your code — fixes are a separate, explicitly-invoked step.

🧠

Sensor, not oracle

Pure Go tooling — go/packages, go/analysis, SSA. No LLM in the server; your agent brings the judgment.

🎯

Genuine over noisy

Semantically-backed findings, not grep guesses. Generated code is skipped automatically.

📦

Monorepo-native

Point it at the repo root — every nested go.mod is discovered and scanned in one run.

🧹

Noise, tamed

Per-line //gospect:ignore, a repo-wide .gospectignore, and baseline mode for big repos.

🔗

CI-ready

Severity gates, SARIF for inline PR annotations, and optional govulncheck for CVE deps.

Install

Up and running in one line.

macOS / Linux

curl -fsSL https://raw.githubusercontent.com/backendArchitect/gospect-mcp/main/install.sh | bash

Windows (PowerShell)

irm https://raw.githubusercontent.com/backendArchitect/gospect-mcp/main/install.ps1 | iex

With Go

go install github.com/backendArchitect/gospect-mcp@latest

Then scan

gospect-mcp scan /path/to/your/module ./...

Prebuilt binaries (Linux / macOS / Windows · amd64 & arm64) live on the Releases page. Run gospect-mcp help for every command and flag.

Performance

Fast, because it’s bounded by `go build` — not the tool.

Warm-cache, single machine. The first scan of a big repo compiles its dependencies once; every scan after that is fast.

Scope	Packages	Time	Notes
Single small module	~12	~1s	load 0.9s / scan 0.1s
Mid-size module	272	~2.5s	load 2.1s / scan 0.5s
Full 9-module monorepo	458	~26s	modules load in parallel

Multi-agent

Works with every AI agent. Fan out freely.

gospect speaks MCP over stdio, so any client can use it. Every scan is stateless — no shared index, no daemon — so point as many agents at it as you like with nothing to coordinate.

Claude Code

Cursor

Windsurf

Cline

VS Code

Zed

Codex CLI

Gemini CLI

Claude Desktop

Claude Code

claude mcp add gospect gospect-mcp

Any MCP client

{
  "mcpServers": {
    "gospect": { "command": "gospect-mcp", "args": [] }
  }
}

Report-only means an agent can’t change your code through gospect — only surface findings, and, on request, a fix envelope.

In CI

Gate PRs. Annotate diffs. Adopt on messy repos.

gospect-mcp check -fail-on high .                   # fail the build on any high-severity bug
gospect-mcp check -since origin/main .              # diff mode: gate only the PR's changes (~1–2s)
gospect-mcp scan -format sarif . > gospect.sarif    # SARIF → inline PR annotations
gospect-mcp check -baseline base.json .             # gate only on NEW findings

Diff mode (-since) scans only the packages a PR touched, turning a ~30s full scan into a ~1–2s check. A drop-in GitHub Action uploads SARIF so findings show up right on the pull request, and baseline mode lets you turn gospect on for a repo that already has hundreds of findings.