# codemore [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/abhinavteja123/codemore  
**GitHub Stars:** 2  
**npm Downloads (last month):** 303  
**Views:** 4  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/codemore

## Description
The static analyzer your AI agent reads — fix-ready, machine-readable scan reports over MCP.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "codemore": {
    "command": "npx",
    "args": ["-y","codemore@latest"]
  }
}
```

## Documentation

## What codemore MCP server does

The codemore MCP server connects an MCP-compatible coding client to CodeMore's local static analyzer. It examines a project or individual file and returns structured findings tied to file, line, and column locations. Findings include rule references, suggested fix information, and verification criteria intended for machine readers.

CodeMore includes native security, quality, frontend, secrets, authentication, and Supabase rules. The repository documents 64 native rules. Examples include SQL injection patterns, path traversal, weak cryptography, shell injection, exposed secrets, missing authentication checks, unsafe frontend patterns, unused code, and overly complex code.

The analyzer can also use eight optional external adapters: Ruff, golangci-lint, Clippy, Biome, Bandit, Gitleaks, npm-audit, and pip-audit. These adapters are disabled by default and produce namespaced findings when enabled.

## How it works

An MCP client starts CodeMore with the `serve-mcp` command. The client then calls one of six tools: `scan_project`, `scan_file`, `explain_issue`, `suggest_fix`, `apply_fix`, and `validate_fix`. This supports a loop in which an agent scans code, examines a finding, prepares a change, applies it, and checks the result.

The same report model is also used by CodeMore's CLI, but the MCP interface is intended for agents that need to consume findings directly. The report identifies the affected location and includes a proposed fix shape plus explicit conditions for verification. CodeMore can inspect secret-shaped filenames even when they are ignored by Git; use the documented option to fully respect Git ignore rules when that behavior is not wanted.

## Setup and configuration

Install or run the package through npm. The documented MCP configuration starts `npx` with `-y codemore@latest serve-mcp`:

```json
{
  "mcpServers": {
    "codemore": {
      "command": "npx",
      "args": ["-y", "codemore@latest", "serve-mcp"]
    }
  }
}
```

Alternatively, run `npx codemore mcp` to print a configuration snippet and client configuration paths. The repository also documents `npx codemore mcp install --client cursor`, which merges the server into an existing Cursor configuration and supports a dry run.

## Tools and capabilities

- Scan an entire project with `scan_project`.
- Analyze one file with `scan_file`.
- Get more context about a reported issue with `explain_issue`.
- Generate fix guidance with `suggest_fix`.
- Apply a proposed change with `apply_fix`.
- Check a change against the finding's criteria with `validate_fix`.
- Produce findings from native rules and, when enabled, supported external tools.

## Limitations and notes

External adapters require their underlying command-line tools and are opt-in. If an enabled external binary is missing, CodeMore skips that adapter rather than failing the scan. Native analysis is limited to the rules implemented by the project; the documented rule packs should be checked to confirm coverage for a particular language or issue.

The MCP setup runs through a local npm command and is not described as a hosted MCP endpoint. The README separately documents a hosted web scanner, but that is a different access path. The CLI's agentic fix command requires an LLM API key; the provided MCP configuration does not specify an environment variable for running the server itself.

_Full upstream README: https://allmcps.com/mcp/codemore/readme_