# Synvoya/codeinspectus [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/Synvoya/codeinspectus  
**GitHub Stars:** 45  
**npm Downloads (last month):** 1446  
**Views:** 6  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/synvoya-codeinspectus

## Description
Local-first, zero-egress security scanner for AI-generated / "vibe-coded" JS/TS. Bundles Opengrep, Gitleaks & Trivy behind one CWE-keyed schema and adds AI-code-specific checks (client-side secret exposure, Supabase RLS, prompt-injection & LLM-output XSS sinks). No account, no telemetry.

## Tools
Capabilities this server exposes over MCP:

- **codeinspectus_scan** — Run a full local security scan of a path: bundled engines (Opengrep SAST, Gitleaks secrets, Trivy SCA/IaC/license), CodeInspectus's offline native Pub SCA, plus AI-code-specific checks (client-side secret exposure, Supabase RLS/inverted-auth, prompt-injection sinks, API-boundary failures, and explicit runtime-control misconfiguration). Returns CWE-keyed findings with fix recommendations, detected repository technologies, explicit native-pack execution counts, compliance tags, and three-state repository evidence for supported runtime controls. Fully offline — zero network egress at scan time. Never writes to your code or repo.
- **codeinspectus_rescan** — Re-run a scan after fixes were applied and diff against a prior scan_id (or the most recent scan of the same path). Reports which findings are resolved, which remain, and which were newly introduced, plus fresh technology and native-pack execution coverage. Use this to verify fixes. Never writes to your code or repo.
- **codeinspectus_compliance_report** — Produce a per-framework code-level control-coverage view for a prior scan (NIST CSF 2.0, ISO 27001:2022, SOC 2, CIS v8.1, Essential Eight, OWASP Web/LLM). Reports 'X of N code-visible controls have findings' with the code-visible subset as the explicit denominator. This is NOT a compliance audit, certification, or attestation — code-level evidence only.
- **codeinspectus_explain_finding** — Return a deep explanation and full remediation plan for a single finding id from a prior scan: what the weakness is, why it matters, concrete fix steps, and references.
- **codeinspectus_generate_sbom** — Generate a CycloneDX or SPDX SBOM for the target project using Trivy plus the first-party offline Pub lockfile inventory, with native Pub fallback when Trivy is unavailable. Writes the SBOM file to the chosen output path and returns its location and component count. Offline.
- **codeinspectus_list_rules** — List the active detectors and engine versions, the CodeInspectus detection-database version and date, Trivy vulnerability-DB freshness, bundled Pub advisory-database provenance/freshness, and the custom CodeInspectus AI-code rules and native detector packs currently shipped.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "codeinspectus": {
    "command": "npx",
    "args": ["-y","codeinspectus"]
  }
}
```

## Documentation

## What Synvoya/codeinspectus MCP server does

Synvoya/codeinspectus MCP server provides a local security-scanning workflow for repositories, with particular coverage for AI-generated and “vibe-coded” applications. It normalizes results from Opengrep SAST, Gitleaks secret detection, Trivy dependency/IaC/license analysis, and a first-party offline Pub inventory into CWE-keyed findings. Native checks add coverage for issues such as client-side secrets, Supabase authorization and row-level security patterns, prompt-injection sinks, unsafe model output handling, API-boundary failures, and selected runtime-control configuration gaps.

The server does not modify source files or repositories. Scan output can include remediation recommendations, detected technologies, engine execution counts, compliance tags, and evidence states for supported runtime controls.

## How it works

The main workflow is scan, fix, and rescan. `codeinspectus_scan` analyzes a path and returns the current findings. `codeinspectus_rescan` compares a later scan with a previous scan ID, or with the latest scan for the same path, and identifies resolved, persistent, newly introduced, and not-rechecked findings. This makes Synvoya/codeinspectus MCP server suitable for checking whether an agent’s proposed remediation actually changed the security result.

`codeinspectus_explain_finding` expands one finding into an explanation, impact description, concrete remediation steps, and references. `codeinspectus_compliance_report` maps a prior scan to code-visible controls in NIST CSF 2.0, ISO 27001:2022, SOC 2, CIS v8.1, Essential Eight, and OWASP Web/LLM frameworks. These reports describe code-level coverage only; they are not audits, certifications, or attestations.

`codeinspectus_generate_sbom` writes a CycloneDX or SPDX SBOM to a selected output path using Trivy and the offline Pub lockfile inventory. `codeinspectus_list_rules` reports active detectors, engine versions, database freshness, and shipped native rule packs.

## Setup and configuration

Node.js 22 or newer is required, with Node 24 LTS recommended. The package is available as `codeinspectus` on npm. Initial setup can inspect available components and obtain approval before downloading the optional managed engine binaries. Those binaries are SHA-pinned, verified, and stored under `~/.codeinspectus/`, outside the npm package. Setup can also refresh the offline Trivy vulnerability database when it is missing or older than seven days.

After setup, scans perform no network I/O. Opengrep requires glibc on Linux; Alpine/musl can still use the native rules, Gitleaks, and Trivy, but Opengrep may be marked unavailable and overall coverage may be partial. MCP clients communicate with the server over piped stdio. Setup state is exposed in responses so an agent can identify missing, repair-required, stale, or unsupported components.

## Tools and capabilities

The Synvoya/codeinspectus MCP server includes:

- Full local scans covering SAST, secrets, dependencies, IaC, licenses, native Pub analysis, and AI-code-specific detectors.
- Differential rescans for validating fixes and detecting regressions.
- Detailed finding explanations with remediation guidance and references.
- Code-level framework control coverage reports.
- CycloneDX or SPDX SBOM generation with component counts and an output location.
- Rule, engine, and database status inspection.

The shipped manifest contains 94 curated detections, including JavaScript/TypeScript, Flutter/Dart, mobile, Python, Go, Java, C#, PHP, Rust, Ruby, Firebase, and GitHub Actions coverage. Exact language and framework coverage is bounded by the native packs and rules shipped with the installed version.

_Full upstream README: https://allmcps.com/mcp/synvoya-codeinspectus/readme_