mcpbeat Sign in

SecHelix MCP Server

by omarmohelal Your server? Claim it
local only

SecHelix runs on your own machine — the client starts it, so there is no endpoint to ping. 79 installs a week from pypi. Last commit 29 Oct 2026.

Evidence-first security review of authorized repositories. Read-only, root-confined, no shell.

Installs per day peak 42 · avg 16 · -22% w/w
a month agotoday
79
Installs / week
pypi · sechelix
1
Stars
5 open issues
29 Oct 2026
Last commit
from GitHub
Apache-2.0
License
Python

What changed 2

Every tool that appeared, vanished or quietly changed what it asks for. Recorded since 9 October 2026. No other catalogue keeps this.

15 Oct the owner changed
9 Oct the owner changed

What the code does

We read the source, 4 d ago · rules 995398eba69f

Evidence

Things with no honest explanation: a promise that contradicts the code, code that runs at install time while hiding what it does, data leaving the machine.

            out = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
Capabilities

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

            out = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        process_env = dict(os.environ)
In the project's build, not in the package

Found in continuous integration, deployment or infrastructure files, or in a neighbouring package of the same monorepo. None of this is installed when you add the server: it describes how the project is built and released. We list it because a leaked key in a build pipeline is still a real problem, but it is not something this server does on your machine.

Image downloads and pipes straight to shell deploy/worker/Dockerfile:31
 && curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

We found things in this code

Code changes quietly between releases, and nobody reads the diff of a dependency. We do, on every release — watch SecHelix and you get told the day something new turns up.

Three servers free · no card

Connect this server

This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.

run in your terminal
claude mcp add sechelix -- uvx sechelix
~/Library/Application Support/Claude/claude_desktop_config.json
{
  "mcpServers": {
    "sechelix": {
      "command": "uvx",
      "args": [
        "sechelix"
      ]
    }
  }
}
~/.codex/config.toml
[mcp_servers.sechelix]
command = "uvx"
args = ["sechelix"]
.cursor/mcp.json
{
  "mcpServers": {
    "sechelix": {
      "command": "uvx",
      "args": [
        "sechelix"
      ]
    }
  }
}
.vscode/mcp.json
{
  "servers": {
    "sechelix": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "sechelix"
      ]
    }
  }
}

Alternatives to SecHelix

same job, measured the same way
DevTime
by shakargy

Local-first, read-only MCP server for evidence-backed repository memory.

95 installs/wk local only
Code Factory
by zrk222

Read-only audit evidence for security, tests, native coverage, runtime failures and repair status.

1 028 installs/wk local only
Ybe Check
by addycuber

Ybe Check – security and compliance orchestrator for AI-generated repositories.

79 installs/wk local only
T
Traceproof
by raised-traceproof

Search security findings and contribute versioned, evidence-backed reproduction reports.

answering
Codemouse
by squidcode

Read-only access to your CodeMouse accounts, repositories, and AI pull-request reviews.

answering
CI Guard MCP
by carelessdept

Local-first static repository security and configuration drift auditor (CLI, GitHub Action & MCP).

51 installs/wk local only
Project Brain
by gentleelephant

Read-only source search and retrieval across configured GitHub repositories

local only
Shipcheck MCP
by tatelyman

Read-only Shipcheck launch-risk scans for authorized JS, TS, and MCP repos.

115 installs/wk local only

SecHelix — questions

Answers built from our own checks of this server.

Why is there no uptime for SecHelix?
SecHelix runs on your own machine over stdio — there is no network address to reach, so uptime cannot be measured for it by anyone. What can be measured is adoption: the pypi package sechelix was installed 79 times last week.
How do I connect SecHelix?
Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It runs locally, so the command pulls sechelix straight from pypi; nothing to host, nothing to sign up for.
How many people use SecHelix?
The pypi package sechelix was installed 79 times in the last week. Week over week that is -22%. We show installs rather than GitHub stars on purpose: a star is a bookmark, an install is someone actually running it.
Is SecHelix open source?
Yes — it is published under the Apache-2.0 licence, written in Python, 1 stars on GitHub and 5 open issues. The source link is on this page, so you can read exactly what it does with your data before you connect it.