# notasandy/mcp-code-sanitizer [Health: Active]

**Category:** 🗄️ Databases  
**Repository:** https://github.com/notasandy/mcp-code-sanitizer  
**GitHub Stars:** 3  
**Views:** 1  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/notasandy-mcp-code-sanitizer

## Description
Strict AI code reviewer powered by Groq. Finds bugs, vulnerabilities and SQL injections. Tools: analyzecode, comparecode, explaincode, generatetests, analyzefile, HTML reports.

## Tools
Capabilities this server exposes over MCP:

- **analyze_code** — Strict analysis of a code fragment using Groq LLM.
- **compare_code** — Compares two versions of code and evaluates whether the change is an improvement.

Performs a structured diff analysis: identifies what improved, what regressed,
and what changed neutrally. Returns a merge recommendation based on the findings.
Useful for code review, refactoring validation, and AI-generated code verification.
- **explain_code** — Explains what code does - step by step and clearly.
Args:
    code:     Code to explain.
    language: Programming language.
    audience: Target audience level - junior, middle, or senior.
Returns:
    JSON with step-by-step explanation, key concepts, and gotchas.
- **generate_tests** — Generates tests for the provided code.
Args:
    code:      Code to generate tests for.
    language:  Programming language.
    framework: Test framework (optional - pytest, jest, unittest, etc.).
Returns:
    JSON with test cases, runnable test code, and coverage estimate.
- **analyze_file** — Analyzes a whole code file from disk.
Automatically detects language by file extension.
Large files are split into chunks and analyzed in parallel.
- **cache_info** — Shows cache statistics or clears the cache
Args:
    clear: True - clears the cache, False - shows statistics.

Returns:
    JSON with cache stats or clear result.
- **generate_report** — Generates a beautiful HTML report from analyze_code or analyze_file results.
Args:
    analysis_json: JSON string from analyze_code or analyze_file.
    output_path:   Path to save the HTML file (optional).
    source_name:   File/fragment name for the report title.
Returns:
    JSON with fields: html, saved_to, length.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `uvx` (confidence: high):

```json
"mcpServers": {
  "mcp-code-sanitizer": {
    "command": "uvx",
    "args": ["mcp-code-sanitizer"],
    "env": {
      "GROQ_API_KEY": ""
    }
  }
}
```

**Requires environment variables:** `GROQ_API_KEY` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What notasandy/mcp-code-sanitizer MCP server does

notasandy/mcp-code-sanitizer MCP server provides an MCP interface for reviewing and understanding source code. Its primary review operation looks for bugs, vulnerabilities, security issues, and SQL injection risks, and returns a structured result that can include a summary, score, issue severity, affected line, explanation, suggested fix, warnings, and recommendations.

The server also supports tasks beyond defect detection. It can explain a code fragment for a junior, middle, or senior audience; generate tests for a supplied function or code section; compare an earlier and later version; inspect an entire file; and turn analysis results into an HTML report. These capabilities fit code review, refactoring validation, AI-generated code checks, and developer education workflows.

## How it works

The server runs as a FastMCP application and sends analysis requests to the Groq API. The default model is `llama-3.3-70b-versatile`, although the model can be changed through configuration. The client communicates with the server over MCP, while the server handles the Groq request and formats the result for the calling agent.

`compare_code` performs a structured evaluation of two versions. Its result distinguishes improvements, regressions, and neutral changes, then provides a recommendation to merge or request changes. `analyze_file` determines the language from the file extension. Larger files are divided into chunks and analyzed in parallel. Results may be cached in memory with a time-to-live and entry limit.

## Setup and configuration

notasandy/mcp-code-sanitizer MCP server requires a Groq API key. The key can be supplied in the MCP client configuration as `GROQ_API_KEY`, or through a `.env` file when running the project manually. The documented package-based setup uses `uvx mcp-code-sanitizer`; manual installation uses the repository requirements and starts `server.py` with Python.

The README provides configurations for Claude Desktop, Cursor, VS Code, and Claude Code CLI. VS Code requires version 1.99 or newer with GitHub Copilot. If `uvx` is unavailable, the documented prerequisite is installing the `uv` package with pip.

Optional settings include `GROQ_MODEL`, `CACHE_TTL`, and `CACHE_MAX`. They select the Groq model, define cache lifetime in seconds, and limit the number of cached entries. The default values are `llama-3.3-70b-versatile`, `3600`, and `200` respectively.

## Tools and capabilities

- `analyze_code`: Reviews a code fragment for defects and security problems and returns a scored analysis.
- `compare_code`: Evaluates whether a change improves the code and identifies regressions or neutral differences.
- `explain_code`: Produces a step-by-step explanation with concepts and potential gotchas.
- `generate_tests`: Creates test cases and runnable test code; an optional framework can include pytest, Jest, or unittest.
- `analyze_file`: Reads and analyzes a file from disk, detecting its language from the extension.
- `generate_report`: Converts analysis JSON into an HTML report and can save it to a specified path.
- `cache_info`: Reports cache statistics or clears the in-memory cache.

The repository also documents a GitHub Action that reviews changed pull-request files, posts a structured comment, and fails the check when critical issues are found. That workflow uses the same Groq API key through a repository secret.

## Limitations and notes

notasandy/mcp-code-sanitizer MCP server depends on Groq availability and a valid API key, so its findings are LLM-generated review results rather than a replacement for execution, deterministic static analysis, or human review. The documented GitHub Action reviews up to 10 changed files per pull request. Support for other LLM providers is listed as a future contribution rather than an existing configuration option.

_Full upstream README: https://allmcps.com/mcp/notasandy-mcp-code-sanitizer/readme_