Codemore

What codemore MCP server does

The codemore MCP server connects an MCP-compatible coding client to CodeMore's local static analyzer. It examines a project or individual file and returns structured findings tied to file, line, and column locations. Findings include rule references, suggested fix information, and verification criteria intended for machine readers.

CodeMore includes native security, quality, frontend, secrets, authentication, and Supabase rules. The repository documents 64 native rules. Examples include SQL injection patterns, path traversal, weak cryptography, shell injection, exposed secrets, missing authentication checks, unsafe frontend patterns, unused code, and overly complex code.

The analyzer can also use eight optional external adapters: Ruff, golangci-lint, Clippy, Biome, Bandit, Gitleaks, npm-audit, and pip-audit. These adapters are disabled by default and produce namespaced findings when enabled.

How it works

An MCP client starts CodeMore with the serve-mcp command. The client then calls one of six tools: scan_project, scan_file, explain_issue, suggest_fix, apply_fix, and validate_fix. This supports a loop in which an agent scans code, examines a finding, prepares a change, applies it, and checks the result.

The same report model is also used by CodeMore's CLI, but the MCP interface is intended for agents that need to consume findings directly. The report identifies the affected location and includes a proposed fix shape plus explicit conditions for verification. CodeMore can inspect secret-shaped filenames even when they are ignored by Git; use the documented option to fully respect Git ignore rules when that behavior is not wanted.

Setup and configuration

Install or run the package through npm. The documented MCP configuration starts npx with -y codemore@latest serve-mcp:

{
  "mcpServers": {
    "codemore": {
      "command": "npx",
      "args": ["-y", "codemore@latest", "serve-mcp"]
    }
  }
}

Alternatively, run npx codemore mcp to print a configuration snippet and client configuration paths. The repository also documents npx codemore mcp install --client cursor, which merges the server into an existing Cursor configuration and supports a dry run.

Tools and capabilities

• Scan an entire project with scan_project.
• Analyze one file with scan_file.
• Get more context about a reported issue with explain_issue.
• Generate fix guidance with suggest_fix.
• Apply a proposed change with apply_fix.
• Check a change against the finding's criteria with validate_fix.
• Produce findings from native rules and, when enabled, supported external tools.

Limitations and notes

External adapters require their underlying command-line tools and are opt-in. If an enabled external binary is missing, CodeMore skips that adapter rather than failing the scan. Native analysis is limited to the rules implemented by the project; the documented rule packs should be checked to confirm coverage for a particular language or issue.

The MCP setup runs through a local npm command and is not described as a hosted MCP endpoint. The README separately documents a hosted web scanner, but that is a different access path. The CLI's agentic fix command requires an LLM API key; the provided MCP configuration does not specify an environment variable for running the server itself.