Log inSubmit server
Code Sentinel logo

Code Sentinel

Analyzes source code for security issues, deceptive patterns, placeholders, design patterns, and recognized strengths.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Code Sentinel

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "code-sentinel": {
      "command": "npx",
      "args": [
        "-y",
        "code-sentinel-mcp"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Automated check passed— started and listed 7 tools correctly (11d ago).

Overview

The code-sentinel MCP server analyzes source code for security vulnerabilities, deceptive behavior, placeholders, code smells, design patterns, and strengths. It accepts code and a filename through MCP tools, using the filename for language detection and returning structured JSON or an HTML report. Use it alongside linters and type checkers when you need to inspect semantically misleading or incomplete implementations. It runs locally through npm or as a remote Cloudflare Workers service over Streamable HTTP or SSE.

Use cases

  • Audit source code for security vulnerabilities
  • Find unfinished implementations before release
  • Detect error-hiding and false-confidence patterns
  • Review architectural and GoF design patterns
  • Generate an HTML report for human code review

Key features

  • Security vulnerability analysis
  • Deceptive pattern detection
  • Placeholder and incomplete-code detection
  • Architectural and design pattern analysis
  • Structured JSON and HTML report output
  • Recognition of code strengths

Tools7

What Code Sentinel lets your agent do. Expand a tool for its parameters.

Verified live~714 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 1d ago

Recent health check succeeded.

9/9 checks healthy over the last 62d

What it can do

From the 7 tools this server returned when we ran it; 7 declare their own safety hints.

Handles credentials · 1Read-only tools · 7
Network at startup3 connections
Files written at startupNone
Install scriptsprepare
npm provenanceNot published
Package age303 days
Maintainers1

Observed 2026-10-28 in an isolated sandbox. A description of reach, not a security audit.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 9d ago via OSV.dev · code-sentinel-mcp (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars3Stargazers on the source repository.
npm downloads205Package downloads in the last 30 days.
Last commit10mo agoMost recent push to the default branch.
Availability100%Our rolling endpoint + install checks that succeeded.
Install checkPassedOur sandbox started it and listed its tools.
Tools exposed7Callable tools this server registers over MCP.

How Code Sentinel works

What code-sentinel MCP server does

The code-sentinel MCP server reviews source code for issues that may remain hidden even when code is syntactically valid or passes conventional linting. Its checks cover hardcoded secrets, SQL injection, cross-site scripting, command injection, insecure cryptography, disabled SSL, empty catch blocks, silent failures, error-masking fallbacks, linter suppression, TODO comments, dummy data, and incomplete implementations.

The analysis also recognizes positive practices, including typing, error handling, testing patterns, and documentation. Full analysis covers 93 patterns across security, deceptive patterns, placeholders, error and code smells, and strengths. Supported languages include TypeScript, JavaScript, Python, Go, Rust, Java, and others; the filename is used for language detection.

Pattern-based analysis is the central design choice. Rather than targeting syntax errors, formatting, unused variables, or AST structure, the tool looks for code that can hide failures, create false confidence, or appear complete while still containing placeholder behavior. It complements tools such as ESLint, TypeScript, and tree-sitter rather than replacing them.

How it works

Each tool receives the source in a required code parameter and a required filename parameter. analyze_code returns structured JSON containing issues, strengths, and summary statistics. generate_report performs a full review and returns a Markdown summary together with a visual HTML report for human inspection.

Focused tools narrow the review to a particular concern. check_security reports security findings, check_deceptive_patterns identifies error-hiding or false-confidence patterns, and check_placeholders finds unfinished code. analyze_patterns examines architectural, design, and implementation patterns, and can limit the review to architectural, design, code, or all levels. It also accepts an optional natural-language query. analyze_design_patterns focuses specifically on Gang of Four patterns and reports confidence levels, locations, and implementation details.

Setup and configuration

Install the npm package globally with npm install -g code-sentinel-mcp, then register the local command with Claude Code using claude mcp add code-sentinel -- npx code-sentinel-mcp. A globally installed command can be registered as claude mcp add code-sentinel -- code-sentinel. The repository can also be built from source with npm install and npm run build.

A remote deployment is available at https://code-sentinel-mcp.sharara.dev/mcp for Streamable HTTP and /sse for Server-Sent Events. The HTTP endpoint is recommended for newer clients. The project also documents self-hosting on Cloudflare Workers; that option requires a Cloudflare account, Wrangler, and authentication with wrangler login. Its deployment uses Durable Objects for persistent MCP connections and does not require a database.

Tools and capabilities

  • analyze_code: returns the complete structured analysis.
  • generate_report: produces a full analysis with an HTML report.
  • check_security: performs a security-only review.
  • check_deceptive_patterns: finds patterns that conceal errors or create false confidence.
  • check_placeholders: detects TODOs, dummy data, and incomplete implementations.
  • analyze_patterns: reviews architectural, design, and implementation patterns with optional focus controls.
  • analyze_design_patterns: identifies GoF design patterns in object-oriented code.

Limitations and notes

The code-sentinel MCP server is not a syntax checker, formatter, compiler, or general-purpose AST tool. It does not target missing semicolons, unused variables, or syntax errors. Its pattern-based results are intended to complement structural tools, and the repository describes verification steps for many patterns to reduce false positives.

Inputs are source code strings rather than repository paths, and every analysis tool requires a filename.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Code Sentinel

code-sentinel is an MCP server that connects source-code analysis tools to MCP-compatible clients, including Claude Code. Its main tools analyze code, generate HTML reports, check security, detect deceptive patterns and placeholders, and review architectural, implementation, and GoF design patterns.

Install it with `npm install -g code-sentinel-mcp`, then register it with Claude Code using `claude mcp add code-sentinel -- npx code-sentinel-mcp`. You can also clone the repository, install dependencies, and run its build command.

Connect to `https://code-sentinel-mcp.sharara.dev/mcp` over Streamable HTTP or use `/sse` for Server-Sent Events. The documented Claude Code commands support both transports, with Streamable HTTP recommended for newer clients.

It checks for security vulnerabilities, deceptive error-handling patterns, placeholders, code smells, architectural and design patterns, and positive coding practices. Examples include hardcoded secrets, empty catch blocks, silent failures, TODOs, dummy data, and incomplete implementations.

Related MCP servers

All in Developer Tools All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewCode Sentinel AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/code-sentinel?style=directory)](https://allmcps.com/mcp/code-sentinel)
HTML Embed
<a href="https://allmcps.com/mcp/code-sentinel"><img src="https://allmcps.com/api/badge/code-sentinel?style=directory" alt="Code Sentinel on AllMCPs" /></a>