Is Code Auditor MCP Server safe to use?

Code Auditor MCP Server has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under MIT.

How do I install Code Auditor MCP Server?

Code Auditor MCP Server supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What can Code Auditor MCP Server do?

Code Auditor MCP Server provides 2 tools: Install, Recalibration. See the full tools list on the server page for descriptions and parameters.

What AI clients work with Code Auditor MCP Server?

Code Auditor MCP Server is compatible with claude-desktop, cursor, claude-code. It uses stdio and http transport.

Is Code Auditor MCP Server actively maintained?

Code Auditor MCP Server is actively maintained — last commit was 3 days ago. It has 7 GitHub stars.

Code Auditor MCP Server

code-auditor-mcp

Code Quality Auditor: Analyze code for SOLID principles, DRY violations, and more

7 2 tools GitHub npm

No known CVEs

MIT license

Actively maintained

Last commit 3d ago

Works with most clients

Transport: stdio, http

2 tools · ~138 tok

Grade A · 0.1% of 200K ctx

MCPpedia last refreshed this data 10h ago

Edit this pageView history

Code Auditor MCP Server is an MCP server that code Quality Auditor: Analyze code for SOLID principles, DRY violations, and more. Its tool list has not been published yet over stdio and http, requires no API key, and scores 89/100 on MCPpedia's security, maintenance and efficiency rubric.

Developer Tools

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "code-auditor": {
      "env": {
        "CODE_AUDITOR_DATA_DIR": "/Users/you/Library/Application Support/code-auditor"
      },
      "args": [
        "/absolute/path/to/code-auditor/app/dist/mcp-index.js",
        "--stdio"
      ],
      "command": "node"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-benahammond-code-auditor-mcp)](https://mcppedia.org/s/io-github-benahammond-code-auditor-mcp)

Read me

What Code Auditor MCP Server does

Your AI understands your code across languages. Code Auditor indexes your entire codebase (TypeScript, JavaScript, and Go) and provides real-time analysis that AI assistants like Claude can actually use to help you write better code.

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

npx -y 'code-auditor-mcp' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

89/100across 5 weighted dimensions

How we score →

0255075100

−11

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked code-auditor-mcp against OSV.dev.

Inventory

Tools (2)

Click any tool to inspect its schema.

~138 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Code Auditor MCP Server safe to use?: Code Auditor MCP Server has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under MIT.
How do I install Code Auditor MCP Server?: Code Auditor MCP Server supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can Code Auditor MCP Server do?: Code Auditor MCP Server provides 2 tools: Install, Recalibration. See the full tools list on the server page for descriptions and parameters.
What AI clients work with Code Auditor MCP Server?: Code Auditor MCP Server is compatible with claude-desktop, cursor, claude-code. It uses stdio and http transport.
Is Code Auditor MCP Server actively maintained?: Code Auditor MCP Server is actively maintained — last commit was 3 days ago. It has 7 GitHub stars.

Similar servers

Others in developer-tools

View all →

Context797

Context7 Platform -- Up-to-date code documentation for LLMs and AI code editors

61.1k 2

XcodeBuildMCP97

A Model Context Protocol (MCP) server and CLI that provides tools for agent use when working on iOS and macOS projects.

6.3k 2

XcodeBuildMCP97

XcodeBuildMCP provides tools for Xcode project management, simulator management, and app utilities.

6.3k 1

Browser Tools Mcp96

Monitor browser logs directly from Cursor and other MCP compatible IDEs.

7.3k 7

MCP Security Weekly

Get CVE alerts and security updates for Code Auditor MCP Server and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Developer Tools

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "code-auditor": {
      "env": {
        "CODE_AUDITOR_DATA_DIR": "/Users/you/Library/Application Support/code-auditor"
      },
      "args": [
        "/absolute/path/to/code-auditor/app/dist/mcp-index.js",
        "--stdio"
      ],
      "command": "node"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-benahammond-code-auditor-mcp)](https://mcppedia.org/s/io-github-benahammond-code-auditor-mcp)

Read me

What Code Auditor MCP Server does

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

npx -y 'code-auditor-mcp' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

README

Code Auditor

Architectural invariants enforced inside your AI agent's edit loop. When the agent writes code that breaks a project rule, Code Auditor catches it and blocks the edit. The agent sees the rule's message and fixes itself.

Install

npm install -g code-auditor-mcp
code-audit install --agent all

Two commands to install everywhere. code-audit install --agent all copies the skill to every AI coding tool on your machine. Use --agent for specific tools.

What you get per tool: the skill (SKILL.md), MCP server access, and hook wiring where the tool supports it (blocking on Claude Code and Codex, advisory on Cursor).

code-audit install --list   # see the support matrix

Claude Code users can also install via plugin:

claude plugin marketplace add BenAHammond/code-auditor-mcp
claude plugin install code-auditor

The hook auto-installs the auditor on first use via npx.

Prompt examples

"Index the codebase and run a full audit. Create tasks from any violations."

"Create a .codeauditor.json that bans lodash imports and prevents src/languages/ from importing anything in src/analyzers/."

"Run a full code audit and create tasks from the violations."

"Sync the code index and audit only what changed vs main."

"Add an ast-pattern rule that blocks new Function(...)."

"Add a naming rule requiring hooks in src/hooks/ to start with use."

"Add a call-constraint so chargeCustomer() in src/services/payment.ts can only be called from src/api/."

Rule kinds

Five kinds. The agent writes them to .codeauditor.json. Bad configs fail the audit, not silently.

Kind	What it blocks
`import-ban`	Banned module imports
`call-constraint`	Function calls from unauthorized files
`module-boundary`	Imports across module boundaries
`naming`	Exported symbols not matching a pattern
`ast-pattern`	AST nodes matching an ast-grep pattern
`style-mechanism`	Unapproved style mechanisms per file/glob
`no-raw-values`	Hardcoded values for specific CSS properties

Works with your agent

One skill, one CLI, one MCP server. Every agent gets the same audit engine — the hook contract is the only difference.

Agent	Skill	Hooks / Blocking	MCP	Verified
Claude Code	Plugin or `code-audit install`	Yes — blocking	Yes	2026-07-19
Cursor	`code-audit install --agent cursor` (project-only)	Advisory	Yes	2026-07-19
Codex	`code-audit install --agent codex` + plugin	Yes — blocking	Yes	2026-07-19
Gemini CLI	`code-audit install --agent gemini`	No	Yes	2026-07-19
VS Code / Copilot	`code-audit install --agent agents`	No	Yes	2026-07-19
Other SKILL.md tools	`code-audit install --agent agents`	No	Yes	2026-07-19

Hook behavior: Blocking means violations at or above --fail-on severity prevent the edit from landing (the agent sees the violation and fixes inline). Advisory means violations are reported through the strongest available feedback channel but the edit has already occurred. Cursor's afterFileEdit hook is fire-and-forget with no output consumption. MCP is available everywhere for shell-less use.

Findings: Deterministic vs Advisory

Code Auditor's built-in rules fall into two categories:

Category	Meaning	Examples
Deterministic	Structural fact — an engineer would act on every finding	`single-responsibility` (300-line functions), `solid/method-complexity` (cyclomatic complexity > 20), `solid/class-size` (40+ method classes), `dependency-inversion` (concrete imports where an interface exists)
Advisory	Heuristic signal — may be wrong depending on domain	`sql-injection-risk` (AST-level string-pattern matching without type info), `missing-org-filter` (domain-specific — assumes SaaS tenant isol

... View full README on GitHub

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

89/100across 5 weighted dimensions

How we score →

0255075100

−11

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked code-auditor-mcp against OSV.dev.

Inventory

Tools (2)

Click any tool to inspect its schema.

~138 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Code Auditor MCP Server safe to use?: Code Auditor MCP Server has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under MIT.
How do I install Code Auditor MCP Server?: Code Auditor MCP Server supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can Code Auditor MCP Server do?: Code Auditor MCP Server provides 2 tools: Install, Recalibration. See the full tools list on the server page for descriptions and parameters.
What AI clients work with Code Auditor MCP Server?: Code Auditor MCP Server is compatible with claude-desktop, cursor, claude-code. It uses stdio and http transport.
Is Code Auditor MCP Server actively maintained?: Code Auditor MCP Server is actively maintained — last commit was 3 days ago. It has 7 GitHub stars.