mcpbeat Sign in

Codebase Doctor MCP Server

local only

Codebase Doctor runs on your own machine — the client starts it, so there is no endpoint to ping. 2 652 installs a week from npm. Last commit 11 Oct 2026.

Read-only codebase audits for coding agents: secrets, RLS, deps, review verdicts. No writes.

Installs per day peak 467 · avg 22 · -76% w/w
a month agotoday
2 652
Installs / week
npm · codebase-doctor
0
Stars
0 open issues
11 Oct 2026
Last commit
28 releases in 90 days
MIT
License
TypeScript

What the code does

We read the source, 7 h ago · rules ccca72095570

Evidence

Things with no honest explanation: a promise that contradicts the code, code that runs at install time while hiding what it does, data leaving the machine.

Claims read-only, but the code runs commands src/execution/command-runner.ts:74
    const child = spawn(plan.executable, [...plan.args], {
Deletes files or strips permissions src/audits/infrastructure/docker/doctor.ts:199
          "chmod 777 or a+rwx in RUN",
Capabilities

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

Runs an external command src/execution/command-runner.ts:74
    const child = spawn(plan.executable, [...plan.args], {

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

We found things in this code

Code changes quietly between releases, and nobody reads the diff of a dependency. We do, on every release — watch Codebase Doctor and you get told the day something new turns up.

Three servers free · no card

Connect this server

This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.

run in your terminal
claude mcp add codebase-doctor -- npx -y codebase-doctor
~/Library/Application Support/Claude/claude_desktop_config.json
{
  "mcpServers": {
    "codebase-doctor": {
      "args": [
        "-y",
        "codebase-doctor"
      ],
      "command": "npx"
    }
  }
}
~/.codex/config.toml
[mcp_servers.codebase-doctor]
command = "npx"
args = ["-y", "codebase-doctor"]
.cursor/mcp.json
{
  "mcpServers": {
    "codebase-doctor": {
      "args": [
        "-y",
        "codebase-doctor"
      ],
      "command": "npx"
    }
  }
}
.vscode/mcp.json
{
  "mcpServers": {
    "codebase-doctor": {
      "args": [
        "-y",
        "codebase-doctor"
      ],
      "command": "npx"
    }
  }
}

Alternatives to Codebase Doctor

same job, measured the same way
MCP Codeaudit
by infoinlet-marketplace

Security audit for AI agents — scan code/diffs for leaked secrets, check deps via OSV.

30 installs/wk local only
Agent Release Auditor
by veyndrasystems

Deterministic release gate for AI-written code and coding agents.

61 installs/wk local only
sqlglass
by s-curvelabs

SQL Server / Azure SQL for agents: real schema, lint, read-only runs, plans, write previews.

67 installs/wk local only
seekrit — secrets for agents
by seekrit

Encrypted store for API keys and database URLs your code needs. Use them without reading them.

40 tools answering
G
grim-mcp
by abduljabbarbxr

Security audit for AI agents: code, deps, exposure, secrets, drift, SBOM, and IoC.

511 installs/wk local only
Sippion
by sitten-tokyo

Local read-only repository context retrieval for AI coding agents.

local only
RepoContext
by shmindmaster

Read-only, commit-pinned repository context for coding agents.

local only
Fable Mode
by rex-codebase

Mechanical write gates, evidence receipts, and adversarial review for AI coding agents.

317 installs/wk local only

Codebase Doctor — questions

Answers built from our own checks of this server.

Why is there no uptime for Codebase Doctor?
Codebase Doctor runs on your own machine over stdio — there is no network address to reach, so uptime cannot be measured for it by anyone. What can be measured is adoption: the npm package codebase-doctor was installed 2 652 times last week.
How do I connect Codebase Doctor?
Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It runs locally, so the command pulls codebase-doctor straight from npm; nothing to host, nothing to sign up for.
How many people use Codebase Doctor?
The npm package codebase-doctor was installed 2 652 times in the last week. Week over week that is -76%. We show installs rather than GitHub stars on purpose: a star is a bookmark, an install is someone actually running it.
Is Codebase Doctor open source?
Yes — it is published under the MIT licence, written in TypeScript and 0 stars on GitHub. The source link is on this page, so you can read exactly what it does with your data before you connect it.