Log inSubmit server
Code Auditor MCP logo

Code Auditor MCP

Audits AI-edited code against configurable architectural rules and can block violating changes through supported agent hooks.

InstallRepository
Full README Compare alternatives Embed widget Claim this listing

Install Code Auditor MCP

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "code-auditor-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "code-auditor-mcp"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Automated check passed— started and listed 8 tools correctly (16d ago).

Overview

code-auditor-mcp applies configurable architectural invariants inside an AI coding agent’s edit loop, reporting violations and blocking changes when supported hooks encounter gating rules. It combines an MCP server, the `code-audit` CLI, a shared skill, and project rules stored in `.codeauditor.json`. Reach for it when an agent needs enforceable import boundaries, naming conventions, AST patterns, call restrictions, or code-quality checks across a repository. Claude Code and Codex support blocking hooks, while Cursor reports violations advisorially and other listed clients use MCP access.

Use cases

  • Enforce import and module boundaries during AI-assisted edits
  • Block banned APIs or AST patterns before changes land
  • Audit only files changed against a base branch
  • Review violations one file at a time with an agent
  • Require naming conventions for exported symbols

Key features

  • Configurable architectural invariants in `.codeauditor.json`
  • Seven built-in rule categories
  • Full and changed-code audits
  • Blocking and advisory agent hook modes
  • SQLite-backed project code index
  • MCP configuration generation for multiple clients

Tools8

What Code Auditor MCP lets your agent do. Expand a tool for its parameters.

Verified live~2.6k tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked Today

Recent health check succeeded.

9/10 checks healthy over the last 92d

What it can do

From the 8 tools this server returned when we ran it.

Can delete or modify data · 2Makes network requests · 1Read-only tools · 6
Network at startup3 connections
Files written at startupNone
Install scriptsNone
npm provenanceNot published
Package age433 days
Maintainers1

Observed 2026-10-25 in an isolated sandbox. A description of reach, not a security audit.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 17d ago via OSV.dev · code-auditor-mcp (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars8Stargazers on the source repository.
npm downloads3.3kPackage downloads in the last 30 days.
Last commit16d agoMost recent push to the default branch.
Availability100%Our rolling endpoint + install checks that succeeded.
Install checkPassedOur sandbox started it and listed its tools.
Tools exposed8Callable tools this server registers over MCP.
Directory activity3 viewsConfig copies, upvotes, and views on AllMCPs.

How Code Auditor MCP works

What code-auditor-mcp does

code-auditor-mcp checks code against project-specific invariants and built-in quality rules while an AI agent is editing a repository. Findings can cover banned imports, module-boundary violations, unauthorized function calls, naming patterns, AST matches, style mechanisms, and hardcoded CSS values. Rules are defined in .codeauditor.json, allowing a project to express constraints such as preventing one directory from importing another or requiring hooks to begin with use.

The auditor distinguishes deterministic findings from advisory heuristics. Deterministic checks include function size, method complexity, class size, and certain dependency-inversion cases. Advisory checks include token-identical duplication and pattern-based SQL injection detection. Some low-precision rules are disabled by default and can be enabled with severity overrides.

How it works

Install the package globally, then run code-audit install --agent all to distribute the skill and MCP setup across supported AI coding tools. Agent-specific installation is available with --agent, and code-audit install --list displays the support matrix. Claude Code can alternatively use the code-auditor plugin.

The agent can index a repository, run a full or changed-code audit, and work through violations file by file with code-audit next-file. The MCP server also supports generating client configuration for named MCP consumers. Hook behavior depends on the client: Claude Code and Codex can block edits when a rule has gating: true, Cursor provides advisory feedback, and clients without hook support can use MCP directly.

Setup and configuration

Node.js 18 or newer is required. Node.js 23.4 or newer can use the built-in node:sqlite path without compiling or downloading a native dependency. Older supported Node versions may use the optional better-sqlite3 backend and can require approval for its install script.

Place project rules and analyzer settings in .codeauditor.json. Environment variables control process behavior such as worker count, daemon and job timeouts, queued-job concurrency, SQLite backend selection, index location, fatal-error handling, and the optional HTTP UI port. By default, the index is stored in a user-level OS cache rather than inside the audited repository. Setting CODE_AUDITOR_DATA_DIR stores project-separated databases beneath that directory using a hash of the project root.

Tools and capabilities

  • Enforce seven rule categories: import-ban, call-constraint, module-boundary, naming, ast-pattern, style-mechanism, and no-raw-values.
  • Audit the full repository or only changes relative to a base such as main.
  • Walk findings with code-audit next-file during an agent-led remediation loop.
  • Configure severity overrides, including enabling rules disabled by default.
  • Generate MCP configuration for Claude, Codex, Cursor, Gemini, Copilot, Continue, AWS Q Developer, Codeium/Windsurf, VS Code, Cline, and ZCode.
  • Run queued audits with configurable worker pools, leases, timeouts, and concurrency limits.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Code Auditor MCP

code-auditor-mcp is an MCP server that connects AI coding agents to a repository auditor, project rules, and a code index. Its main capabilities include running audits, walking findings with `code-audit next-file`, enforcing configurable invariants, and generating MCP client configuration for supported tools.

Install it with `npm install -g code-auditor-mcp`, then run `code-audit install --agent all`. Use `--agent` for a specific tool, or install the Claude Code plugin with its marketplace commands.

Yes, code-auditor-mcp works with Cursor through `code-audit install --agent cursor` or generated MCP configuration. Cursor’s `afterFileEdit` hook is advisory and fire-and-forget, so violations are reported after the edit rather than blocking it.

Define project-level rules in `.codeauditor.json`. The configuration supports import bans, call constraints, module boundaries, naming patterns, AST patterns, style mechanisms, no-raw-values checks, analyzer settings, thresholds, and severity overrides.

Node.js 18 or newer is supported. Node.js 23.4 or newer uses the built-in `node:sqlite` module; older supported versions can fall back to the optional `better-sqlite3` dependency, which may require build-script approval.

Related MCP servers

All in Developer Tools All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewCode Auditor MCP AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/code-auditor-mcp?style=directory)](https://allmcps.com/mcp/code-auditor-mcp)
HTML Embed
<a href="https://allmcps.com/mcp/code-auditor-mcp"><img src="https://allmcps.com/api/badge/code-auditor-mcp?style=directory" alt="Code Auditor MCP on AllMCPs" /></a>