# code-sentinel [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/salrad22/code-sentinel  
**GitHub Stars:** 3  
**npm Downloads (last month):** 205  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/code-sentinel

## Description
Code quality analysis MCP server - detects security issues, deceptive patterns, and placeholders

## Tools
Capabilities this server exposes over MCP:

- **analyze_code** — Analyze code for security issues, errors, deceptive patterns, and placeholders. Returns a structured analysis with issues and strengths.
- **generate_report** — Analyze code and generate a detailed HTML report with visual indicators for issues and strengths.
- **check_security** — Check code for security vulnerabilities only (hardcoded secrets, SQL injection, XSS, etc.)
- **check_deceptive_patterns** — Check for code patterns that hide errors or create false confidence (empty catches, silent failures, etc.)
- **check_placeholders** — Check for placeholder code, dummy data, TODO/FIXME comments, and incomplete implementations
- **analyze_patterns** — Analyze code for architectural, design, and implementation patterns. Detects pattern usage, inconsistencies, and provides actionable suggestions for improvement. Returns LLM-optimized JSON with action items.
- **analyze_design_patterns** — Focused analysis of Gang of Four (GoF) design patterns in code. Detects Singleton, Factory, Observer, Strategy, and other classic patterns with confidence levels and implementation details.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "code-sentinel": {
    "command": "npx",
    "args": ["-y","code-sentinel-mcp"]
  }
}
```

## Documentation

## What code-sentinel MCP server does

The code-sentinel MCP server reviews source code for issues that may remain hidden even when code is syntactically valid or passes conventional linting. Its checks cover hardcoded secrets, SQL injection, cross-site scripting, command injection, insecure cryptography, disabled SSL, empty catch blocks, silent failures, error-masking fallbacks, linter suppression, TODO comments, dummy data, and incomplete implementations.

The analysis also recognizes positive practices, including typing, error handling, testing patterns, and documentation. Full analysis covers 93 patterns across security, deceptive patterns, placeholders, error and code smells, and strengths. Supported languages include TypeScript, JavaScript, Python, Go, Rust, Java, and others; the filename is used for language detection.

Pattern-based analysis is the central design choice. Rather than targeting syntax errors, formatting, unused variables, or AST structure, the tool looks for code that can hide failures, create false confidence, or appear complete while still containing placeholder behavior. It complements tools such as ESLint, TypeScript, and tree-sitter rather than replacing them.

## How it works

Each tool receives the source in a required `code` parameter and a required `filename` parameter. `analyze_code` returns structured JSON containing issues, strengths, and summary statistics. `generate_report` performs a full review and returns a Markdown summary together with a visual HTML report for human inspection.

Focused tools narrow the review to a particular concern. `check_security` reports security findings, `check_deceptive_patterns` identifies error-hiding or false-confidence patterns, and `check_placeholders` finds unfinished code. `analyze_patterns` examines architectural, design, and implementation patterns, and can limit the review to `architectural`, `design`, `code`, or `all` levels. It also accepts an optional natural-language `query`. `analyze_design_patterns` focuses specifically on Gang of Four patterns and reports confidence levels, locations, and implementation details.

## Setup and configuration

Install the npm package globally with `npm install -g code-sentinel-mcp`, then register the local command with Claude Code using `claude mcp add code-sentinel -- npx code-sentinel-mcp`. A globally installed command can be registered as `claude mcp add code-sentinel -- code-sentinel`. The repository can also be built from source with `npm install` and `npm run build`.

A remote deployment is available at `https://code-sentinel-mcp.sharara.dev/mcp` for Streamable HTTP and `/sse` for Server-Sent Events. The HTTP endpoint is recommended for newer clients. The project also documents self-hosting on Cloudflare Workers; that option requires a Cloudflare account, Wrangler, and authentication with `wrangler login`. Its deployment uses Durable Objects for persistent MCP connections and does not require a database.

## Tools and capabilities

- `analyze_code`: returns the complete structured analysis.
- `generate_report`: produces a full analysis with an HTML report.
- `check_security`: performs a security-only review.
- `check_deceptive_patterns`: finds patterns that conceal errors or create false confidence.
- `check_placeholders`: detects TODOs, dummy data, and incomplete implementations.
- `analyze_patterns`: reviews architectural, design, and implementation patterns with optional focus controls.
- `analyze_design_patterns`: identifies GoF design patterns in object-oriented code.

## Limitations and notes

The code-sentinel MCP server is not a syntax checker, formatter, compiler, or general-purpose AST tool. It does not target missing semicolons, unused variables, or syntax errors. Its pattern-based results are intended to complement structural tools, and the repository describes verification steps for many patterns to reduce false positives.

Inputs are source code strings rather than repository paths, and every analysis tool requires a filename.

_Full upstream README: https://allmcps.com/mcp/code-sentinel/readme_