About Django Chainsaw
Django Chainsaw is an MCP server published by syrian963 in the Science category: finds what will hurt in a Django project: cascades, N+1, unsafe migrations, tenant leaks.
Recent commit activity is the strongest signal that reported issues will get attention.
Install
uvx django-chainsaw-mcppip install django-chainsaw-mcpThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Tools (30)
bypassed_effectsBulk writes that skip everything the `save()` chain promised.
Parameters not published.
celery_arguments**What the worker actually receives**, and whether it can even be called.
Parameters not published.
checkRun everything that applies, one severity-sorted list, one exit code.
Parameters not published.
choice_typosLiterals a field's `choices` will never match: valid SQL, zero rows, no exception.
Parameters not published.
dangling_referencesURL names, templates, signal senders and Celery tasks nothing will resolve.
Parameters not published.
datetime_auditNaive datetimes and field defaults that break when the clock moves.
Parameters not published.
defeated_prefetchesPrefetches paid for and then re-queried by the accessor that reads them.
Parameters not published.
delete_impactDelete one row: what cascades, what blocks, what gets nulled. Transitive.
Parameters not published.
deploy_safety**Is this destructive migration safe to ship yet?**
Parameters not published.
endpoint_costHow many queries one request costs, before anybody sends one.
Parameters not published.
Show all 30 tools
escaping_side_effectsMail and tasks fired inside a transaction that can still roll back.
Parameters not published.
explain_model**Everything about one model, plus the risks only visible combined.**
Parameters not published.
find_n_plus_oneRelation traversals in a template that each cost a query, and the fix.
Parameters not published.
find_unscoped_queries**Which queries read data the caller may not own?** The IDOR shape.
Parameters not published.
list_modelsEvery model with fields, relation kind, direction and `on_delete`.
Parameters not published.
migration_riskMigrations rated: blocks writes, rewrites the table, breaks running code.
Parameters not published.
missing_indexesFields the code filters or sorts on that carry no index.
Parameters not published.
money_precision**Where a decimal amount stops being exact.**
Parameters not published.
multiplied_aggregatesCounts and sums multiplied by a join across two multi-valued relations.
Parameters not published.
open_endpointsSensitive fields on endpoints anybody can call.
Parameters not published.
project_infoDoes the target project load at all? Run this first when something is broken.
Parameters not published.
queries_in_loopsQueries written inside a loop, split by which of three fixes applies.
Parameters not published.
race_conditionsCounters read into Python, changed, and saved. Also unsafe upserts.
Parameters not published.
request_impactEvery finding grouped by the entry points that reach it, so the question becomes which endpoint to fix.
Parameters not published.
scan_templatesThe same across a directory, resolving context from views.
Parameters not published.
serializer_exposureWhat DRF serializers expose, including what the next migration will add.
Parameters not published.
serializer_nplusoneN+1 in DRF serializers, which is where it lives in an API project.
Parameters not published.
suggest_fixes**Findings turned into code, grouped by how safe each one is to apply.**
Parameters not published.
unused_eager_loadingJoins and prefetches nothing in the response reads.
Parameters not published.
what_happens_on**What does this save actually trigger?** Follows the signal chain.
Parameters not published.
Ask AI
Ask AI about Django Chainsaw
Powered by Claude · Grounded in docs
Security checks
6 checks have not been run yet.