CodeInspectus MCP Server

by synvoya Your server? Claim it

local only

CodeInspectus runs on your own machine — the client starts it, so there is no endpoint to ping. 142 installs a week from npm. Last commit 7 Sep 2026.

Local-first MCP security scanner and CLI for AI-generated applications.

Installs per day peak 303 · avg 76 · +119% w/w

a month agotoday

142

Installs / week

npm · codeinspectus

Stars

5 open issues

7 Sep 2026

Last commit

0 releases in 90 days

Apache-2.0

License

TypeScript

What the code does

We read the source, 19 h ago · rules 3dff92dd89df

Capabilities

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

A line of code looks encrypted src/ai-checks/client-secrets.ts:51

  /(?:process\.env\.|import\.meta\.env\.|(?<![\w$.])env\.)((?:NEXT_PUBLIC_|VITE_|REACT_APP_|EXPO_PUBLIC_|GATSBY_|NUXT_PUBLIC_|PUBLIC_)[A-Z0-9_]*(?:SECRET|PRIVATE|API[_]?KEY|ACCESS[_]?KEY|TOKEN|PASSWORD|SERVICE[_]?ROLE)[A-Z0-9_]*)\b/g;

Runs an external command src/engines/exec.ts:62, src/packs/go/unsafe-tool-execution.ts:408, src/engines/signature.ts:29 и ещё 2

    const child = spawn(binPath, args, {

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

This code can reach further than it looks

We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.

Connect this server

This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add codeinspectus -- npx -y codeinspectus

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "codeinspectus": {
      "args": [
        "-y",
        "codeinspectus"
      ],
      "command": "npx"
    }
  }
}

~/.codex/config.toml

[mcp_servers.codeinspectus]
command = "npx"
args = ["-y", "codeinspectus"]

.cursor/mcp.json

{
  "mcpServers": {
    "codeinspectus": {
      "args": [
        "-y",
        "codeinspectus"
      ],
      "command": "npx"
    }
  }
}

.vscode/mcp.json

{
  "mcpServers": {
    "codeinspectus": {
      "args": [
        "-y",
        "codeinspectus"
      ],
      "command": "npx"
    }
  }
}

Alternatives to CodeInspectus

same job, measured the same way

MCP Tenant Isolation

by subodhkc

Static analysis scanner for MCP server code and multi-tenant SaaS applications.

5 467 installs/wk local only

Readyorai

by tedoneobichajavascript

Zero-cost MCP server for local code inspection and best-practice recommendations

32 installs/wk local only

Code Guard MCP

by mlawsonking

Security scan for AI-generated code: injection, SSRF, secrets, weak crypto, unsafe deserialization.

44 installs/wk local only

Rune

by thecolourfoundation

Evidence-traced codebase understanding and security scanning for AI agents over MCP.

24 installs/wk local only

Seojeom MCP

by seojeom

Local-first MCP server for Claude/Codex project wiki and graph workflows

local only

Sentrik

by maxgerhardson

Governance runtime for AI-generated code. Enforce compliance and security standards.

69 installs/wk local only

Agentmako

by drhalto

Local-first codebase intelligence MCP server for AI coding agents.

53 installs/wk local only

Pathmark

by hacksurvivor

Local-first intent and provenance for Codex, Claude Code, Cursor, Gemini CLI, and MCP agents.

64 installs/wk local only

CodeInspectus — questions

Answers built from our own checks of this server.

Why is there no uptime for CodeInspectus?

CodeInspectus runs on your own machine over stdio — there is no network address to reach, so uptime cannot be measured for it by anyone. What can be measured is adoption: the npm package codeinspectus was installed 142 times last week.

How do I connect CodeInspectus?

Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It runs locally, so the command pulls codeinspectus straight from npm; nothing to host, nothing to sign up for.

How many people use CodeInspectus?

The npm package codeinspectus was installed 142 times in the last week. Week over week that is +119%. We show installs rather than GitHub stars on purpose: a star is a bookmark, an install is someone actually running it.

Is CodeInspectus open source?

Yes — it is published under the Apache-2.0 licence, written in TypeScript, 46 stars on GitHub and 5 open issues. The source link is on this page, so you can read exactly what it does with your data before you connect it.