Pentagonal vs Codeinspectus
A side-by-side look at the Pentagonal and Codeinspectus MCP servers: transport, auth, tools, quality signals, and the config to install either one in Claude, Cursor, Windsurf or VS Code.
Verdict: choose Pentagonal for security work as a local process; choose Codeinspectus for security as a local process. You can also run both side by side in one mcpServers block.
Which MCP server should you choose?
Choose Pentagonal when
- You need dedicated capabilities in the Security domain.
- You prefer a local stdio subprocess transport.
- Its auth model fits you: API key required.
- You have the keys it needs:
PENTAGONAL_KEY. - You want tools like
pentagonal_generate, pentagonal_lookup, pentagonal_audit.
Choose Codeinspectus when
- You need dedicated capabilities in the Security domain.
- You prefer a local stdio subprocess transport.
- Its auth model fits you: No auth required.
- You want tools like
codeinspectus_scan, codeinspectus_setup, codeinspectus_rescan.
Feature & specification comparison
Rows where the two servers differ are marked.
| Spec | ||
|---|---|---|
| Category | Security | Security |
| Quality signal | 61/100 · Good | 68/100 · Great |
| Install command | Confirmed | Confirmed |
| Transport | Local subprocess (stdio) | Local subprocess (stdio) |
| Auth | API key required | No auth required |
| Pricing | Freemium | Free |
| Required env vars | PENTAGONAL_KEY | None listed |
| Verified owner | Community listing | Community listing |
| GitHub stars | 1 | 48 |
| Directory activity | 6 views 0 installs 0 upvotes | 7 views 0 installs 0 upvotes |
| Tools | 7 | 7 |
| Full listing | View Pentagonal | View Codeinspectus |
Tools & capabilities
Pentagonal tools 7
pentagonal_generateGenerate a production-quality smart contract from a natural language description. Supports EVM (Solidity) and Solana (Anchor/Rust or SPL Token config). The generator uses Pentagonal's self-learning security rules to produce safer code.pentagonal_lookupLook up any token or smart contract by address. Returns the full intelligence report: price, market cap, ATH, 24h volume, transactions, holders, liquidity, LP lock status, pool count, security flags (honeypot, mintable, pausable, hidden owner, taxes), social links, and source code if verified. Use this before auditing to understand the full token landscape. Supports EVM and Solana tokens. Chain is auto-detected if omitted.pentagonal_auditRun an 8-agent security pen test on a smart contract. Each agent specializes in a different attack vector: reentrancy, flash loans, access control, gas griefing, oracle manipulation, front-running, integer overflow, and economic exploits. Findings are returned with severity ratings and line numbers. New security rules are automatically learned from each audit.pentagonal_fixFix a specific vulnerability in a smart contract. Provide the contract code and the finding details — returns the complete fixed contract preserving all existing functionality.pentagonal_compileCompile Solidity source code and return the ABI, bytecode, constructor arguments, and gas estimates. Use this after generating and auditing a contract to prepare it for deployment.pentagonal_rulesGet the current self-learning security rules. These rules are accumulated from every audit Pentagonal performs — the more contracts audited, the smarter the system gets.pentagonal_chainsList all supported blockchains with their chain IDs, explorer URLs, and deployment hints.
Codeinspectus tools 7
codeinspectus_scanRun a full local security scan of a path: managed engines (Opengrep SAST, Gitleaks secrets, Trivy SCA/IaC/license), CodeInspectus's offline native Pub SCA, plus AI-code-specific checks (client-side secret exposure, Supabase RLS/inverted-auth, prompt-injection sinks, API-boundary failures, and explicit runtime-control misconfiguration). Returns CWE-keyed findings with fix recommendations, detected repository technologies, explicit native-pack execution counts, compliance tags, and three-state repository evidence for supported runtime controls. Also returns the V3 repository-trust contract with deterministic V3.1 source-integrity evidence for bidi controls, hidden/default-ignorable characters, Unicode tag and variation-selector payloads, and bounded mixed-script confusables. V3.2 additionally audits explicit AI attribution in source/git/media metadata and validates supported local C2PA assets with the official optional Content Authenticity Initiative library. Remote manifests and revocation endpoints are never fetched. Statistical-watermark detection remains explicitly unavailable. Fully offline — zero network egress at scan time. Never writes to your code or repo.codeinspectus_setupInspect external-engine health and exact platform download sizes, save declined choices, or install selected Opengrep/Gitleaks/Trivy components after explicit confirmation. Plan is offline. Install writes only to ~/.codeinspectus, verifies immutable pins/publisher provenance, and never modifies the target repository.codeinspectus_rescanRe-run a scan after fixes were applied and diff against a prior scan_id (or the most recent scan of the same path). Reports which findings are resolved, which remain, and which were newly introduced, plus fresh technology and native-pack execution coverage. Repository-trust artifacts are diffed separately with fail-closed resolved, remaining, introduced and not-rechecked states. Use this to verify approved fixes. Never writes to your code or repo.codeinspectus_compliance_reportProduce a per-framework code-level control-coverage view for a prior scan (NIST CSF 2.0, ISO 27001:2022, SOC 2, CIS v8.1, Essential Eight, OWASP Web/LLM). Reports 'X of N code-visible controls have findings' with the code-visible subset as the explicit denominator. This is NOT a compliance audit, certification, or attestation — code-level evidence only.codeinspectus_explain_findingReturn a deep explanation and full remediation plan for a single finding id from a prior scan: what the weakness is, why it matters, concrete fix steps, and references.codeinspectus_generate_sbomGenerate a CycloneDX or SPDX SBOM for the target project using Trivy plus the first-party offline Pub lockfile inventory, with native Pub fallback when Trivy is unavailable. Writes the SBOM file to the chosen output path and returns its location and component count. Offline.codeinspectus_list_rulesList the active detectors and engine versions, the CodeInspectus detection-database version and date, Trivy vulnerability-DB freshness, bundled Pub advisory-database provenance/freshness, and the custom CodeInspectus AI-code rules and native detector packs currently shipped.
Ready-to-paste client configs
Paste either block (or both) into your client config, e.g. claude_desktop_config.json or ~/.cursor/mcp.json. We only show a config when the install command is confirmed.
Pentagonal
{
"mcpServers": {
"pentagonal-ai-pentagonal": {
"command": "npx",
"args": [
"-y",
"pentagonal-mcp"
],
"env": {
"PENTAGONAL_KEY": "YOUR_PENTAGONAL_KEY_HERE"
}
}
}
}
Codeinspectus
{
"mcpServers": {
"synvoya-codeinspectus": {
"command": "npx",
"args": [
"-y",
"codeinspectus"
]
}
}
}
Frequently asked questions
Pentagonal is categorized under Security and uses a local stdio subprocess. Codeinspectus belongs to Security and uses a local stdio subprocess. Pick Pentagonal for security work and Codeinspectus for security.
Copy the mcpServers block from the config section on this page into your client's config (for example claude_desktop_config.json or ~/.cursor/mcp.json), then fully restart the client.
Pentagonal is listed as freemium — a free tier with paid plans. Auth: api key required. Codeinspectus is listed as free. Auth: no auth required. If a server needs environment variables such as API keys, define them under the env key in your client's MCP config.
Yes. MCP clients support multiple servers: add pentagonal-ai-pentagonal and synvoya-codeinspectus as separate keys in the same mcpServers object, and your assistant will call tools from either one.
On AllMCPs, Pentagonal has a quality signal of 61/100 (Good) with 6 views, 0 installs and 1 GitHub stars. Codeinspectus has 68/100 (Great) with 7 views, 0 installs and 48 GitHub stars.