Log inSubmit server
Codeinspectus logo

Codeinspectus

by Synvoya

Local MCP security scanner for AI-generated JavaScript and TypeScript with offline SAST, secrets, SCA, and AI-specific checks.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Codeinspectus

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "synvoya-codeinspectus": {
      "command": "npx",
      "args": [
        "-y",
        "codeinspectus"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Automated check passed— started and listed 7 tools correctly (1mo ago).

Overview

Synvoya/codeinspectus MCP server scans local repositories for security issues in AI-generated JavaScript and TypeScript code. It combines Opengrep, Gitleaks, Trivy, an offline Pub dependency scanner, and native detectors behind MCP tools that return CWE-keyed findings. Scans, rescans, explanations, compliance views, and SBOM generation run locally, with zero network egress during scanning and no repository modifications. Reach for it when an AI coding workflow needs repeatable security checks and fix verification before deployment.

Use cases

  • Scan AI-generated JavaScript or TypeScript before deployment
  • Rescan a repository to verify security fixes
  • Explain a finding and produce remediation steps
  • Generate a CycloneDX or SPDX software bill of materials
  • Map scan findings to code-visible compliance controls

Key features

  • Offline local scanning with zero scan-time network egress
  • CWE-keyed findings across multiple security engines
  • AI-code-specific native detectors
  • Scan-to-fix-to-rescan comparison workflow
  • CycloneDX and SPDX SBOM generation
  • Framework-specific code-level coverage reports

Tools7

What Codeinspectus lets your agent do. Expand a tool for its parameters.

Verified live~1.8k tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked Today

Recent health check succeeded.

19/20 checks healthy over the last 79d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 8d ago via OSV.dev · codeinspectus (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars49Stargazers on the source repository.
npm downloads882Package downloads in the last 30 days.
Last commit2d agoMost recent push to the default branch.
Availability100%Our rolling endpoint + install checks that succeeded.
Install checkPassedOur sandbox started it and listed its tools.
Tools exposed7Callable tools this server registers over MCP.
Directory activity7 viewsConfig copies, upvotes, and views on AllMCPs.

How Codeinspectus works

What Synvoya/codeinspectus MCP server does

Synvoya/codeinspectus MCP server provides a local security-scanning workflow for repositories, with particular coverage for AI-generated and “vibe-coded” applications. It normalizes results from Opengrep SAST, Gitleaks secret detection, Trivy dependency/IaC/license analysis, and a first-party offline Pub inventory into CWE-keyed findings. Native checks add coverage for issues such as client-side secrets, Supabase authorization and row-level security patterns, prompt-injection sinks, unsafe model output handling, API-boundary failures, and selected runtime-control configuration gaps.

The server does not modify source files or repositories. Scan output can include remediation recommendations, detected technologies, engine execution counts, compliance tags, and evidence states for supported runtime controls.

How it works

The main workflow is scan, fix, and rescan. codeinspectus_scan analyzes a path and returns the current findings. codeinspectus_rescan compares a later scan with a previous scan ID, or with the latest scan for the same path, and identifies resolved, persistent, newly introduced, and not-rechecked findings. This makes Synvoya/codeinspectus MCP server suitable for checking whether an agent’s proposed remediation actually changed the security result.

codeinspectus_explain_finding expands one finding into an explanation, impact description, concrete remediation steps, and references. codeinspectus_compliance_report maps a prior scan to code-visible controls in NIST CSF 2.0, ISO 27001:2022, SOC 2, CIS v8.1, Essential Eight, and OWASP Web/LLM frameworks. These reports describe code-level coverage only; they are not audits, certifications, or attestations.

codeinspectus_generate_sbom writes a CycloneDX or SPDX SBOM to a selected output path using Trivy and the offline Pub lockfile inventory. codeinspectus_list_rules reports active detectors, engine versions, database freshness, and shipped native rule packs.

Setup and configuration

Node.js 22 or newer is required, with Node 24 LTS recommended. The package is available as codeinspectus on npm. Initial setup can inspect available components and obtain approval before downloading the optional managed engine binaries. Those binaries are SHA-pinned, verified, and stored under ~/.codeinspectus/, outside the npm package. Setup can also refresh the offline Trivy vulnerability database when it is missing or older than seven days.

After setup, scans perform no network I/O. Opengrep requires glibc on Linux; Alpine/musl can still use the native rules, Gitleaks, and Trivy, but Opengrep may be marked unavailable and overall coverage may be partial. MCP clients communicate with the server over piped stdio. Setup state is exposed in responses so an agent can identify missing, repair-required, stale, or unsupported components.

Tools and capabilities

The Synvoya/codeinspectus MCP server includes:

  • Full local scans covering SAST, secrets, dependencies, IaC, licenses, native Pub analysis, and AI-code-specific detectors.
  • Differential rescans for validating fixes and detecting regressions.
  • Detailed finding explanations with remediation guidance and references.
  • Code-level framework control coverage reports.
  • CycloneDX or SPDX SBOM generation with component counts and an output location.
  • Rule, engine, and database status inspection.

The shipped manifest contains 94 curated detections, including JavaScript/TypeScript, Flutter/Dart, mobile, Python, Go, Java, C#, PHP, Rust, Ruby, Firebase, and GitHub Actions coverage. Exact language and framework coverage is bounded by the native packs and rules shipped with the installed version.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Codeinspectus

MCP clients start it over piped stdio.

Yes. Scans perform zero network I/O after setup, and the server is described as having zero network egress at scan time.

Yes. `codeinspectus_rescan` compares a new scan with a prior scan and reports resolved, remaining, newly introduced, and not-rechecked findings.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewCodeinspectus AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/synvoya-codeinspectus?style=directory)](https://allmcps.com/mcp/synvoya-codeinspectus)
HTML Embed
<a href="https://allmcps.com/mcp/synvoya-codeinspectus"><img src="https://allmcps.com/api/badge/synvoya-codeinspectus?style=directory" alt="Codeinspectus on AllMCPs" /></a>