Codeinspectus

What Synvoya/codeinspectus MCP server does

Synvoya/codeinspectus MCP server provides a local security-scanning workflow for repositories, with particular coverage for AI-generated and “vibe-coded” applications. It normalizes results from Opengrep SAST, Gitleaks secret detection, Trivy dependency/IaC/license analysis, and a first-party offline Pub inventory into CWE-keyed findings. Native checks add coverage for issues such as client-side secrets, Supabase authorization and row-level security patterns, prompt-injection sinks, unsafe model output handling, API-boundary failures, and selected runtime-control configuration gaps.

The server does not modify source files or repositories. Scan output can include remediation recommendations, detected technologies, engine execution counts, compliance tags, and evidence states for supported runtime controls.

How it works

The main workflow is scan, fix, and rescan. codeinspectus_scan analyzes a path and returns the current findings. codeinspectus_rescan compares a later scan with a previous scan ID, or with the latest scan for the same path, and identifies resolved, persistent, newly introduced, and not-rechecked findings. This makes Synvoya/codeinspectus MCP server suitable for checking whether an agent’s proposed remediation actually changed the security result.

codeinspectus_explain_finding expands one finding into an explanation, impact description, concrete remediation steps, and references. codeinspectus_compliance_report maps a prior scan to code-visible controls in NIST CSF 2.0, ISO 27001:2022, SOC 2, CIS v8.1, Essential Eight, and OWASP Web/LLM frameworks. These reports describe code-level coverage only; they are not audits, certifications, or attestations.

codeinspectus_generate_sbom writes a CycloneDX or SPDX SBOM to a selected output path using Trivy and the offline Pub lockfile inventory. codeinspectus_list_rules reports active detectors, engine versions, database freshness, and shipped native rule packs.

Setup and configuration

Node.js 22 or newer is required, with Node 24 LTS recommended. The package is available as codeinspectus on npm. Initial setup can inspect available components and obtain approval before downloading the optional managed engine binaries. Those binaries are SHA-pinned, verified, and stored under ~/.codeinspectus/, outside the npm package. Setup can also refresh the offline Trivy vulnerability database when it is missing or older than seven days.

After setup, scans perform no network I/O. Opengrep requires glibc on Linux; Alpine/musl can still use the native rules, Gitleaks, and Trivy, but Opengrep may be marked unavailable and overall coverage may be partial. MCP clients communicate with the server over piped stdio. Setup state is exposed in responses so an agent can identify missing, repair-required, stale, or unsupported components.

Tools and capabilities

The Synvoya/codeinspectus MCP server includes:

• Full local scans covering SAST, secrets, dependencies, IaC, licenses, native Pub analysis, and AI-code-specific detectors.
• Differential rescans for validating fixes and detecting regressions.
• Detailed finding explanations with remediation guidance and references.
• Code-level framework control coverage reports.
• CycloneDX or SPDX SBOM generation with component counts and an output location.
• Rule, engine, and database status inspection.

The shipped manifest contains 94 curated detections, including JavaScript/TypeScript, Flutter/Dart, mobile, Python, Go, Java, C#, PHP, Rust, Ruby, Firebase, and GitHub Actions coverage. Exact language and framework coverage is bounded by the native packs and rules shipped with the installed version.