# goldmembrane/cleaner-code [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/goldmembrane/cleaner-code  
**GitHub Stars:** 1  
**Views:** 2  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/goldmembrane-cleaner-code

## Description
AI code security scanner MCP server. Detects 9 categories of threats in AI-generated code (invisible Unicode, Trojan Source, homoglyphs, Glassworm steganography, rules file backdoors, dependency typosquatting, obfuscation) using static analysis plus CodeBERT deep learning. Runs locally, free tier.

## Tools
Capabilities this server exposes over MCP:

- **scan_file** — Scan a single file for hidden malicious code patterns
- **scan_directory** — Recursively scan a directory across all source files
- **scan_rules_file** — Scan an AI configuration/rules file for prompt injection and Rules File Backdoor attacks
- **check_dependencies** — Check `package.json` for typosquatting, suspicious install scripts, and dependency risks
- **ai_analyze** — Deep AI analysis using the trained CodeBERT model (classifies chunks as malicious/benign with confidence)
- **explain_finding** — Get detailed explanation of a specific threat category, with attack scenarios and remediation

## Claude Desktop Quick Installation
No generated config for this server: it installs through its own setup steps.

The project's own setup steps (from https://github.com/goldmembrane/cleaner-code), copied verbatim. Run them in order; they are not an mcpServers config.

1. Install:

```sh
git clone https://github.com/goldmembrane/cleaner-code.git
```

2. Install:

```sh
cd cleaner-code
```

3. Install:

```sh
npm install
```

4. Install:

```sh
npm run build
```

## Documentation

## What goldmembrane/cleaner-code MCP server does

The goldmembrane/cleaner-code MCP server provides local security checks for source code, AI assistant rules, and JavaScript package metadata. Its scanners look for hidden or misleading content that ordinary linters may not identify, including invisible Unicode characters, bidirectional control characters, homoglyphs, Unicode steganography, rules-file backdoors, dependency typosquatting, suspicious install scripts, and obfuscation patterns.

The server exposes six MCP tools:

- `scan_file` checks one file for hidden malicious-code patterns.
- `scan_directory` walks a directory and scans its source files.
- `scan_rules_file` checks AI configuration and rules files for prompt injection and rules-file backdoors.
- `check_dependencies` inspects `package.json` for dependency risks, typosquatting, and suspicious install scripts.
- `ai_analyze` uses the trained CodeBERT model to classify code chunks as malicious or benign with confidence scores.
- `explain_finding` describes a threat category, possible attack scenarios, and remediation steps.

## How it works

The goldmembrane/cleaner-code MCP server runs as a local stdio process. An MCP client starts the compiled Node.js entry point and calls the tools during code review or generation. Findings can include severity, line numbers, and remediation guidance.

Detection uses two approaches. Eight deterministic scanners cover known patterns such as Trojan Source bidirectional controls, confusable characters, hidden Unicode, whitespace-based payloads, obfuscation, rules-file attacks, and dependency issues. The CodeBERT analyzer examines code chunks locally and provides a malicious-or-benign classification with a confidence value.

## Setup and configuration

Install Node.js 18 or newer, clone the repository, install its packages, and build it:

```bash
git clone https://github.com/goldmembrane/cleaner-code.git
cd cleaner-code
npm install
npm run build
```

Configure the MCP client to launch `dist/index.js` with Node. The README provides configurations for Claude Code and Cursor using either a user or project MCP configuration file. Replace the example path with the absolute path to the cloned repository, restart the client, and select the available tools.

The repository also documents an optional HTTP API server in its project structure, but the provided MCP setup uses stdio. No environment variables are specified for the MCP server.

## Tools and capabilities

Use `scan_file` for a focused review of one source file and `scan_directory` for a recursive project-level scan. Use `scan_rules_file` when reviewing files such as `.cursorrules`, `CLAUDE.md`, or other AI configuration files. `check_dependencies` is specific to `package.json` and checks package naming and installation behavior.

For cases where static rules may not be enough, `ai_analyze` applies the CodeBERT model to code chunks. `explain_finding` is intended for understanding a reported category and its remediation options. Static tools and explanations have no stated usage limit.

## Limitations and notes

The goldmembrane/cleaner-code MCP server is designed to detect the categories and patterns implemented by its static scanners and model; it should not be treated as a complete security review. The dependency checker is described for `package.json`, not arbitrary package-manager manifests.

The project is licensed under ISC. The README names Claude Code, Cursor, VS Code with Copilot, and Cline as compatible clients. The server requires a local Node.js runtime and a built project entry point.

_Full upstream README: https://allmcps.com/mcp/goldmembrane-cleaner-code/readme_