# code-auditor-mcp [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/BenAHammond/code-auditor-mcp  
**GitHub Stars:** 8  
**npm Downloads (last month):** 3335  
**Views:** 3  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/code-auditor-mcp

## Description
Code Quality Auditor: Analyze code for SOLID principles, DRY violations, and more

## Tools
Capabilities this server exposes over MCP:

- **audit** — Run code quality audits (synchronous or background), check status, fetch paginated results, and get health checks. Actions: run (sync audit, returns full results), start (background job), status (poll a job), results (paginated violations), health (score + code map).
- **search** — Search indexed functions and components. Actions: query (natural language + operators like entity:, component:, hook:, dep:, calls:, lang:, complexity:, exported:, jsdoc:, file:, unused-imports, name:), definition (exact function/component lookup).
- **index** — Manage the code index. Actions: sync (update from files with optional auto-whitelist), cleanup (remove deleted files), reset (clear analysis data, preserve tasks/config/whitelist), status (index statistics).
- **config** — Manage analyzer configurations, generate AI tool configs, manage whitelists, and manage invariant rules. Actions: get, set, reset (analyzer configs), generate (AI tool config files), whitelist_list, whitelist_add, whitelist_update, whitelist_detect, rules_list, rules_check.
- **telemetry** — Manage anonymous dismissal feedback opt-in (default OFF). Actions: status, enable, disable. When enabled, a dismissal and its reason are sent to the feedback endpoint, grouped by an anonymous install ID generated locally.
- **code_map** — Retrieve sections of previously generated code maps. Actions: get (retrieve a specific section), list (list all available sections for a map).
- **tasks** — Manage a persistent per-project task queue. Tasks survive index resets. Actions: create, list, list_tree, get, update, complete, delete, from_audit (create tasks from audit violations with deduplication).
- **guide** — Get recommended workflows and best practices for using the code auditor tools effectively. Single action: get.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "code-auditor-mcp": {
    "command": "npx",
    "args": ["-y","code-auditor-mcp"]
  }
}
```

## Documentation

## What code-auditor-mcp does

code-auditor-mcp checks code against project-specific invariants and built-in quality rules while an AI agent is editing a repository. Findings can cover banned imports, module-boundary violations, unauthorized function calls, naming patterns, AST matches, style mechanisms, and hardcoded CSS values. Rules are defined in `.codeauditor.json`, allowing a project to express constraints such as preventing one directory from importing another or requiring hooks to begin with `use`.

The auditor distinguishes deterministic findings from advisory heuristics. Deterministic checks include function size, method complexity, class size, and certain dependency-inversion cases. Advisory checks include token-identical duplication and pattern-based SQL injection detection. Some low-precision rules are disabled by default and can be enabled with severity overrides.

## How it works

Install the package globally, then run `code-audit install --agent all` to distribute the skill and MCP setup across supported AI coding tools. Agent-specific installation is available with `--agent`, and `code-audit install --list` displays the support matrix. Claude Code can alternatively use the `code-auditor` plugin.

The agent can index a repository, run a full or changed-code audit, and work through violations file by file with `code-audit next-file`. The MCP server also supports generating client configuration for named MCP consumers. Hook behavior depends on the client: Claude Code and Codex can block edits when a rule has `gating: true`, Cursor provides advisory feedback, and clients without hook support can use MCP directly.

## Setup and configuration

Node.js 18 or newer is required. Node.js 23.4 or newer can use the built-in `node:sqlite` path without compiling or downloading a native dependency. Older supported Node versions may use the optional `better-sqlite3` backend and can require approval for its install script.

Place project rules and analyzer settings in `.codeauditor.json`. Environment variables control process behavior such as worker count, daemon and job timeouts, queued-job concurrency, SQLite backend selection, index location, fatal-error handling, and the optional HTTP UI port. By default, the index is stored in a user-level OS cache rather than inside the audited repository. Setting `CODE_AUDITOR_DATA_DIR` stores project-separated databases beneath that directory using a hash of the project root.

## Tools and capabilities

- Enforce seven rule categories: `import-ban`, `call-constraint`, `module-boundary`, `naming`, `ast-pattern`, `style-mechanism`, and `no-raw-values`.
- Audit the full repository or only changes relative to a base such as `main`.
- Walk findings with `code-audit next-file` during an agent-led remediation loop.
- Configure severity overrides, including enabling rules disabled by default.
- Generate MCP configuration for Claude, Codex, Cursor, Gemini, Copilot, Continue, AWS Q Developer, Codeium/Windsurf, VS Code, Cline, and ZCode.
- Run queued audits with configurable worker pools, leases, timeouts, and concurrency limits.

_Full upstream README: https://allmcps.com/mcp/code-auditor-mcp/readme_