Cleaner Code

What goldmembrane/cleaner-code MCP server does

The goldmembrane/cleaner-code MCP server provides local security checks for source code, AI assistant rules, and JavaScript package metadata. Its scanners look for hidden or misleading content that ordinary linters may not identify, including invisible Unicode characters, bidirectional control characters, homoglyphs, Unicode steganography, rules-file backdoors, dependency typosquatting, suspicious install scripts, and obfuscation patterns.

The server exposes six MCP tools:

• scan_file checks one file for hidden malicious-code patterns.
• scan_directory walks a directory and scans its source files.
• scan_rules_file checks AI configuration and rules files for prompt injection and rules-file backdoors.
• check_dependencies inspects package.json for dependency risks, typosquatting, and suspicious install scripts.
• ai_analyze uses the trained CodeBERT model to classify code chunks as malicious or benign with confidence scores.
• explain_finding describes a threat category, possible attack scenarios, and remediation steps.

How it works

The goldmembrane/cleaner-code MCP server runs as a local stdio process. An MCP client starts the compiled Node.js entry point and calls the tools during code review or generation. Findings can include severity, line numbers, and remediation guidance.

Detection uses two approaches. Eight deterministic scanners cover known patterns such as Trojan Source bidirectional controls, confusable characters, hidden Unicode, whitespace-based payloads, obfuscation, rules-file attacks, and dependency issues. The CodeBERT analyzer examines code chunks locally and provides a malicious-or-benign classification with a confidence value.

Setup and configuration

Install Node.js 18 or newer, clone the repository, install its packages, and build it:

git clone https://github.com/goldmembrane/cleaner-code.git
cd cleaner-code
npm install
npm run build

Configure the MCP client to launch dist/index.js with Node. The README provides configurations for Claude Code and Cursor using either a user or project MCP configuration file. Replace the example path with the absolute path to the cloned repository, restart the client, and select the available tools.

The repository also documents an optional HTTP API server in its project structure, but the provided MCP setup uses stdio. No environment variables are specified for the MCP server.

Tools and capabilities

Use scan_file for a focused review of one source file and scan_directory for a recursive project-level scan. Use scan_rules_file when reviewing files such as .cursorrules, CLAUDE.md, or other AI configuration files. check_dependencies is specific to package.json and checks package naming and installation behavior.

For cases where static rules may not be enough, ai_analyze applies the CodeBERT model to code chunks. explain_finding is intended for understanding a reported category and its remediation options. Static tools and explanations have no stated usage limit.

Limitations and notes

The goldmembrane/cleaner-code MCP server is designed to detect the categories and patterns implemented by its static scanners and model; it should not be treated as a complete security review. The dependency checker is described for package.json, not arbitrary package-manager manifests.

The project is licensed under ISC. The README names Claude Code, Cursor, VS Code with Copilot, and Cline as compatible clients. The server requires a local Node.js runtime and a built project entry point.