Codesentinel
@salrad22
About Codesentinel
No overview available yet
Config
Add this server to your MCP-compatible client using the configuration below.
{
"mcpServers": {
"code-sentinel": {
"command": "npx",
"args": [
"code-sentinel-mcp"
]
}
}
}Tools
7Analyze code for security issues, errors, deceptive patterns, and placeholders. Returns a structured analysis with issues and strengths.
Analyze code and generate a detailed HTML report with visual indicators for issues and strengths.
Check code for security vulnerabilities only (hardcoded secrets, SQL injection, XSS, etc.)
Check for code patterns that hide errors or create false confidence (empty catches, silent failures, etc.)
Check for placeholder code, dummy data, TODO/FIXME comments, and incomplete implementations
Analyze code for architectural, design, and implementation patterns. Detects pattern usage, inconsistencies, and provides actionable suggestions for improvement. Returns LLM-optimized JSON with action items.
Focused analysis of Gang of Four (GoF) design patterns in code. Detects Singleton, Factory, Observer, Strategy, and other classic patterns with confidence levels and implementation details.
Overview
What is Codesentinel?
Codesentinel is a Model Context Protocol (MCP) server that analyzes source code for security vulnerabilities, deceptive patterns, placeholder code, code smells, and good practices. It integrates with Claude Code and other MCP-compatible clients to serve as a quality gate before issues reach production.
How to use Codesentinel?
Install globally via npm (npm install -g code-sentinel-mcp) and add to Claude Code using claude mcp add code-sentinel -- npx code-sentinel-mcp, or manually configure the MCP server in ~/.claude/claude_desktop_config.json. Use the provided tools by asking Claude Code to analyze code snippets or files.
Key features of Codesentinel
- Detects 93 distinct patterns across 5 categories
- Security analysis: hardcoded secrets, SQL injection, XSS, command injection
- Deceptive pattern detection: empty catch blocks, silent failures, linter suppression
- Placeholder detection: TODOs, lorem ipsum, incomplete implementations
- Error and code smell detection: type coercion, null references, async anti‑patterns
- Strength recognition: highlights proper typing, error handling, testing patterns
Use cases of Codesentinel
- Audit AI‑generated code for hardcoded secrets, empty catch blocks, and placeholders before merging
- Review pull requests for security vulnerabilities and error‑hiding patterns
- Scan existing codebases for missing error handling and risky patterns during refactoring
- Generate visual HTML reports for team review of code quality
FAQ from Codesentinel
Which languages does Codesentinel support?
Codesentinel supports TypeScript, JavaScript, Python, Go, Rust, Java, Kotlin, Swift, C#, C/C++, PHP, Vue, and Svelte, with language detection based on file extension.
How is the quality score calculated?
The score (0–100) is 100 - (critical × 25) - (high × 15) - (medium × 5) - (low × 1) + (strengths × 2). Critical issues deduct 25 points, strengths add 2 points each.
What tools does Codesentinel provide?
Tools include analyze_code, generate_report, check_security, check_deceptive_patterns, check_placeholders, analyze_patterns, and analyze_design_patterns. Each accepts code and filename parameters and returns structured JSON or HTML reports.
Can I add custom detection patterns?
Yes. Edit files in src/analyzers/ (security.ts, deceptive.ts, placeholders.ts, errors.ts, strengths.ts) following the existing pattern structure with regex, severity, and optional verification logic.
How does the verification feature work?
Many patterns include a verification object with assumption, confirmIf, and falsePositiveIf fields to reduce false positives by confirming only when the pattern matches certain contextual conditions.
Frequently asked questions
Which languages does Codesentinel support?
Codesentinel supports TypeScript, JavaScript, Python, Go, Rust, Java, Kotlin, Swift, C#, C/C++, PHP, Vue, and Svelte, with language detection based on file extension.
How is the quality score calculated?
The score (0–100) is `100 - (critical × 25) - (high × 15) - (medium × 5) - (low × 1) + (strengths × 2)`. Critical issues deduct 25 points, strengths add 2 points each.
What tools does Codesentinel provide?
Tools include `analyze_code`, `generate_report`, `check_security`, `check_deceptive_patterns`, `check_placeholders`, `analyze_patterns`, and `analyze_design_patterns`. Each accepts code and filename parameters and returns structured JSON or HTML reports.
Can I add custom detection patterns?
Yes. Edit files in `src/analyzers/` (security.ts, deceptive.ts, placeholders.ts, errors.ts, strengths.ts) following the existing pattern structure with regex, severity, and optional verification logic.
How does the verification feature work?
Many patterns include a `verification` object with `assumption`, `confirmIf`, and `falsePositiveIf` fields to reduce false positives by confirming only when the pattern matches certain contextual conditions.
Basic information
More Developer Tools MCP servers
Codex Pets
astandrikPublic read-only MCP server for discovering, inspecting, installing, and sharing approved Codex-compatible animated pet packs.
directree
coburn2716directree MCP server — query the honest software directory from any AI assistant
TaskerArmy Agent
TaskerArmyAsk Claude or ChatGPT what Shopify theme optimization tasks are pending on your store, a remote MCP server for TaskerArmy Agent accounts.
Skycloak
Manage your Skycloak-hosted Keycloak: clusters, realms, apps, SSO and users, from any MCP client.
ship.page
BitgateThrow HTML at an API, get an unguessable URL back. Zero-config remote MCP server — your agent deploys pages, sites and CI reports in one call. Free, no signup needed.
Comments