Codesentinel MCP Server

@salrad22

代码仓库

基本信息

分类

开发工具

传输方式

stdio

作者

salrad22

提交者

Rasha Salim

关于 Codesentinel MCP Server

暂无概览

#codesentinel#code-quality #security-analysis

Codesentinel MCP Server 配置

使用下面的配置,将此服务器添加到你的 MCP 客户端。

{
  "mcpServers": {
    "code-sentinel": {
      "command": "npx",
      "args": [
        "code-sentinel-mcp"
      ]
    }
  }
}

Codesentinel MCP Server 工具

Analyze code for security issues, errors, deceptive patterns, and placeholders. Returns a structured analysis with issues and strengths.

Analyze code and generate a detailed HTML report with visual indicators for issues and strengths.

Check code for security vulnerabilities only (hardcoded secrets, SQL injection, XSS, etc.)

Check for code patterns that hide errors or create false confidence (empty catches, silent failures, etc.)

Check for placeholder code, dummy data, TODO/FIXME comments, and incomplete implementations

Analyze code for architectural, design, and implementation patterns. Detects pattern usage, inconsistencies, and provides actionable suggestions for improvement. Returns LLM-optimized JSON with action items.

Focused analysis of Gang of Four (GoF) design patterns in code. Detects Singleton, Factory, Observer, Strategy, and other classic patterns with confidence levels and implementation details.

概览

What is Codesentinel?

Codesentinel is a Model Context Protocol (MCP) server that analyzes source code for security vulnerabilities, deceptive patterns, placeholder code, code smells, and good practices. It integrates with Claude Code and other MCP-compatible clients to serve as a quality gate before issues reach production.

How to use Codesentinel?

Install globally via npm (npm install -g code-sentinel-mcp) and add to Claude Code using claude mcp add code-sentinel -- npx code-sentinel-mcp, or manually configure the MCP server in ~/.claude/claude_desktop_config.json. Use the provided tools by asking Claude Code to analyze code snippets or files.

Key features of Codesentinel

Detects 93 distinct patterns across 5 categories
Security analysis: hardcoded secrets, SQL injection, XSS, command injection
Deceptive pattern detection: empty catch blocks, silent failures, linter suppression
Placeholder detection: TODOs, lorem ipsum, incomplete implementations
Error and code smell detection: type coercion, null references, async anti‑patterns
Strength recognition: highlights proper typing, error handling, testing patterns

Use cases of Codesentinel

Audit AI‑generated code for hardcoded secrets, empty catch blocks, and placeholders before merging
Review pull requests for security vulnerabilities and error‑hiding patterns
Scan existing codebases for missing error handling and risky patterns during refactoring
Generate visual HTML reports for team review of code quality

常见问题

Which languages does Codesentinel support?

Codesentinel supports TypeScript, JavaScript, Python, Go, Rust, Java, Kotlin, Swift, C#, C/C++, PHP, Vue, and Svelte, with language detection based on file extension.

How is the quality score calculated?

The score (0–100) is `100 - (critical × 25) - (high × 15) - (medium × 5) - (low × 1) + (strengths × 2)`. Critical issues deduct 25 points, strengths add 2 points each.

What tools does Codesentinel provide?

Tools include `analyze_code`, `generate_report`, `check_security`, `check_deceptive_patterns`, `check_placeholders`, `analyze_patterns`, and `analyze_design_patterns`. Each accepts code and filename parameters and returns structured JSON or HTML reports.

Can I add custom detection patterns?

Yes. Edit files in `src/analyzers/` (security.ts, deceptive.ts, placeholders.ts, errors.ts, strengths.ts) following the existing pattern structure with regex, severity, and optional verification logic.

How does the verification feature work?

Many patterns include a `verification` object with `assumption`, `confirmIf`, and `falsePositiveIf` fields to reduce false positives by confirming only when the pattern matches certain contextual conditions.

开发工具分类下的更多 MCP 服务器

Yocoolab

MCP server for AI Agents — exposes Yocoolab feedback threads and design selections as tools

LocalCan

Gives AI agents public URLs (tunnels) for localhost, live HTTP traffic inspection, snapshot publishing, and access control. Part of LocalCan, the ngrok alternative for Mac, Windows and Linux. Free plan.

SSH MCP Server

hypnosis

SSH MCP server for AI agents: remote commands, file transfer, log search and server audits through OpenSSH.

screenshotrun-mcp

screenshotrun

Give your AI agent the ability to see any webpage. Capture screenshots from Claude, Cursor, or any MCP client. Supports full-page, dark mode, mobile emulation, OG image generation, base64 output, custom viewport, ad bloc

Foremerge

naw103

Catch intent conflicts before code conflicts. The open-source coordination protocol for coding agents, built above Git.