Codesentinel MCP Server

@salrad22

リポジトリ

基本情報

カテゴリ

開発者ツール

トランスポート

stdio

作者

salrad22

投稿者

Rasha Salim

Codesentinel MCP Server について

概要はまだありません

#codesentinel#code-quality #security-analysis

Codesentinel MCP Server の設定

以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。

{
  "mcpServers": {
    "code-sentinel": {
      "command": "npx",
      "args": [
        "code-sentinel-mcp"
      ]
    }
  }
}

Codesentinel MCP Server のツール

Analyze code for security issues, errors, deceptive patterns, and placeholders. Returns a structured analysis with issues and strengths.

Analyze code and generate a detailed HTML report with visual indicators for issues and strengths.

Check code for security vulnerabilities only (hardcoded secrets, SQL injection, XSS, etc.)

Check for code patterns that hide errors or create false confidence (empty catches, silent failures, etc.)

Check for placeholder code, dummy data, TODO/FIXME comments, and incomplete implementations

Analyze code for architectural, design, and implementation patterns. Detects pattern usage, inconsistencies, and provides actionable suggestions for improvement. Returns LLM-optimized JSON with action items.

Focused analysis of Gang of Four (GoF) design patterns in code. Detects Singleton, Factory, Observer, Strategy, and other classic patterns with confidence levels and implementation details.

概要

What is Codesentinel?

Codesentinel is a Model Context Protocol (MCP) server that analyzes source code for security vulnerabilities, deceptive patterns, placeholder code, code smells, and good practices. It integrates with Claude Code and other MCP-compatible clients to serve as a quality gate before issues reach production.

How to use Codesentinel?

Install globally via npm (npm install -g code-sentinel-mcp) and add to Claude Code using claude mcp add code-sentinel -- npx code-sentinel-mcp, or manually configure the MCP server in ~/.claude/claude_desktop_config.json. Use the provided tools by asking Claude Code to analyze code snippets or files.

Key features of Codesentinel

Detects 93 distinct patterns across 5 categories
Security analysis: hardcoded secrets, SQL injection, XSS, command injection
Deceptive pattern detection: empty catch blocks, silent failures, linter suppression
Placeholder detection: TODOs, lorem ipsum, incomplete implementations
Error and code smell detection: type coercion, null references, async anti‑patterns
Strength recognition: highlights proper typing, error handling, testing patterns

Use cases of Codesentinel

Audit AI‑generated code for hardcoded secrets, empty catch blocks, and placeholders before merging
Review pull requests for security vulnerabilities and error‑hiding patterns
Scan existing codebases for missing error handling and risky patterns during refactoring
Generate visual HTML reports for team review of code quality

よくある質問

Which languages does Codesentinel support?

Codesentinel supports TypeScript, JavaScript, Python, Go, Rust, Java, Kotlin, Swift, C#, C/C++, PHP, Vue, and Svelte, with language detection based on file extension.

How is the quality score calculated?

The score (0–100) is `100 - (critical × 25) - (high × 15) - (medium × 5) - (low × 1) + (strengths × 2)`. Critical issues deduct 25 points, strengths add 2 points each.

What tools does Codesentinel provide?

Tools include `analyze_code`, `generate_report`, `check_security`, `check_deceptive_patterns`, `check_placeholders`, `analyze_patterns`, and `analyze_design_patterns`. Each accepts code and filename parameters and returns structured JSON or HTML reports.

Can I add custom detection patterns?

Yes. Edit files in `src/analyzers/` (security.ts, deceptive.ts, placeholders.ts, errors.ts, strengths.ts) following the existing pattern structure with regex, severity, and optional verification logic.

How does the verification feature work?

Many patterns include a `verification` object with `assumption`, `confirmIf`, and `falsePositiveIf` fields to reduce false positives by confirming only when the pattern matches certain contextual conditions.

「開発者ツール」の他のコンテンツ

Casefile

azimov777

One case file per task — shared by every session, agent and person that touches it. Self-hosted MCP server and live board. MIT.

LastPing

Know when your AI agents, cron jobs and CI pipelines fail, stall or go quiet. Your agent sets up monitors from a plain description, tells you what is broken and why, reads run history and traces, and writes notes on inci

LocalCan

Gives AI agents public URLs (tunnels) for localhost, live HTTP traffic inspection, snapshot publishing, and access control. Part of LocalCan, the ngrok alternative for Mac, Windows and Linux. Free plan.

Mcp-Warden

ermoluk

Local-first credential broker for MCP. AI coding agents (Claude Code, Cursor, Codex…) call APIs, SSH and databases through scoped presets; secrets stay in your OS keychain and never enter the agent's context.

OrangePro

Aamir Siddiqui

OrangePro local-first CLI + MCP server for behavior mapping, grounded test generation, and dynamic proof.