Judges Panel runs on your own machine — the client starts it, so there is no endpoint to ping. 629 installs a week from npm. Last commit 7 Apr 2026.
45 judges that evaluate AI-generated code for security, cost, and quality with built-in AST.
We read the source, 20 h ago · rules 3dff92dd89df
Things with no honest explanation: a promise that contradicts the code, code that runs at install time while hiding what it does, data leaving the machine.
/(?:exec|spawn|system|popen|shell_exec)\s*\(\s*["'`](?:cmd |powershell |bash |sh |\/bin\/|\.exe|rm -rf|del \/|copy |xcopy|chmod|chown)/gi;
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
return eval("`" + template + "`");
return eval(expression)
const log = execSync(`git log --oneline -${count} --format="%H|%s"`, { encoding: "utf-8", timeout: 10000 });
- /var/run/docker.sock:/var/run/docker.sock # Docker socket access
"and configure your .npmrc to route scoped packages to your private registry.",
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
Code changes quietly between releases, and nobody reads the diff of a dependency. We do, on every release — watch Judges Panel and you get told the day something new turns up.
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add judges -- npx -y @kevinrabun/judges
{
"mcpServers": {
"judges": {
"args": [
"-y",
"@kevinrabun/judges"
],
"command": "npx"
}
}
}
[mcp_servers.judges]
command = "npx"
args = ["-y", "@kevinrabun/judges"]
{
"mcpServers": {
"judges": {
"args": [
"-y",
"@kevinrabun/judges"
],
"command": "npx"
}
}
}
{
"mcpServers": {
"judges": {
"args": [
"-y",
"@kevinrabun/judges"
],
"command": "npx"
}
}
}
Discover, evaluate, install, and validate generated websites for the self-hosted CodeY CMS.
Proves AI-generated Python does what you asked: lint, types, security, sandbox run, exact fixes.
Governance runtime for AI-generated code. Enforce compliance and security standards.
Analyze code quality and security with SonarQube Server or Cloud directly in AI assistants.
Local-first MCP security scanner and CLI for AI-generated applications.
Security scan for AI-generated code: injection, SSRF, secrets, weak crypto, unsafe deserialization.
Validates AI-generated Python: syntax, lint, security scan and deterministic repair.
Dead code, security, secrets detection and code quality for Python, TypeScript, Go.
Answers built from our own checks of this server.