Code Auditor MCP

Official

by BenAHammond · TypeScript

Code Quality Auditor: Analyze code for SOLID principles, DRY violations, and more

Analyze code for SOLID principles, DRY violations, and quality issues.

Code Auditor: AI-Powered Multi-Language Code Intelligence

Your AI understands your code across languages. Code Auditor indexes your entire codebase (TypeScript, JavaScript, and Go) and provides real-time analysis that AI assistants like Claude can actually use to help you write better code.

The Problem It Solves

AI coding assistants are powerful, but they're flying blind. They can't search your codebase, don't know your patterns, and miss critical context. Code Auditor changes that by creating a searchable index of every function, component, and pattern in your code.

How It Works

Index - Automatically catalogs functions, React components, Go structs, and dependencies
Analyze - Detects SOLID violations, code duplication, and security issues across multiple languages
Connect - AI assistants access your code index via MCP (Model Context Protocol)
Iterate - Get intelligent suggestions based on your actual codebase patterns

Quick Start (2 minutes)

bash

# Add to your project with Claude Code CLI
claude mcp add code-auditor -- npx code-auditor-mcp

# That's it! Now ask Claude:
# "What authentication functions exist in my codebase?"
# "Find all API endpoints and check for rate limiting"
# "Show me Go structs that handle user data"
# "Compare TypeScript and Go implementations of the same feature"

Core Features That Matter

🔍 Multi-Language Code Search

code

"Find all functions that validate user input"
"Show me where we're calling the payment API"
"What Go structs implement the User interface?"
"Compare error handling patterns between TypeScript and Go"

🎯 Smart Code Analysis

SOLID Principles - Catch architecture issues before they spread
DRY Violations - Find duplicate code that should be refactored
Security Patterns - Verify auth, rate limiting, SQL injection protection
Dead Code - Identify unused imports and functions

🤖 AI Tool Integration

Auto-generates configurations for:

Claude (via MCP)
Cursor
Continue
GitHub Copilot
10+ other AI assistants

⚙️ Persistent Configuration

Set your analyzer preferences once:

code

You: "Set SOLID analyzer to allow 3 responsibilities for components"
Claude: Configuration saved! All future audits will use this setting.

📋 Project task queue (MCP)

Use the project_tasks tool to keep a per-project task list in the local database (titles, status, priorities, due dates, blockers, related files/symbols, and more). Tasks survive sync_index reset: clearing the analysis index removes indexed functions, cached audits, code maps, and schema overlays so you do not keep “ghost” references to deleted code—it does not delete your task list or analyzer configs.

Real Examples

Example 1: Finding Authentication Patterns

code

You: "Show me all authentication-related functions"
Claude: Found 23 functions across 8 files:
- `validateToken()` in auth/tokens.ts:45
- `requireAuth()` in middleware/auth.ts:12
- `checkPermissions()` in auth/permissions.ts:78
...

Example 2: Analyzing Code Quality

code

You: "Audit the user service for issues"
Claude: Found 3 critical issues:
- Single Responsibility violation: UserService handles both auth and profile updates
- SQL injection risk: Raw query in getUserByEmail() at line 234
- Missing rate limiting on password reset endpoint

Example 3: Discovering Patterns

code

You: "Find React components similar to DataTable"
Claude: Found 4 similar components:
- `UserTable` - extends DataTable with user-specific columns
- `OrderGrid` - implements similar pagination pattern
- `ProductList` - uses same filtering approach

Installation Options

Published package (npm / pnpm / yarn)

bash

npm install -g code-auditor-mcp
# or: pnpm add -g code-auditor-mcp
code-audit  # Run analysis

Project install

bash

npm install --save-dev code-auditor-mcp
npx code-audit

Developing from this repository

Requires Node.js 18+. From the app/ directory:

bash

pnpm install
pnpm run build
pnpm test

The package manager in use is pnpm (see packageManager in package.json). Use pnpm run test:parity only if you need the legacy vs universal analyzer parity suite.

CI/CD Integration

yaml

# GitHub Actions
- name: Code Audit
  run: npx code-audit --fail-on-critical

MCP server: where the index is stored

The Loki index file defaults to <current working directory>/.code-index/index.db. If your MCP host runs with an unexpected or shared cwd, point at a dedicated folder:

Environment variable CODE_AUDITOR_DATA_DIR — directory to use as the storage root (absolute or relative to the process cwd when the server starts). The database file is <resolved>/index.db (no extra .code-index segment).
CLI — node dist/mcp-index.js --data-dir /path/to/data (equivalent to setting the env var). The published binary code-auditor-mcp also accepts --data-dir because it loads the same bootstrap.

Example Cursor .cursor/mcp.json fragment:

json

{
  "mcpServers": {
    "code-auditor": {
      "command": "node",
      "args": ["/absolute/path/to/code-auditor/app/dist/mcp-index.js", "--stdio"],
      "env": {
        "CODE_AUDITOR_DATA_DIR": "/Users/you/Library/Application Support/code-auditor"
      }
    }
  }
}

Key Commands

bash

code-audit                    # Full analysis with HTML report
code-audit -f json           # JSON output for CI/CD
code-audit -a solid,dry      # Run specific analyzers
code-audit --health          # Quick health score (0-100)

The Feedback Loop

Write Code → Code Auditor indexes it automatically
Ask AI → "Is there a function to validate emails?"
Get Context → AI finds validateEmail() and similar patterns
Improve → AI suggests using existing validation instead of duplicating
Repeat → Your AI gets smarter about YOUR codebase

Configuration

Set custom thresholds for your architecture:

javascript

// Via MCP
mcp.set_analyzer_config({
  analyzerName: "solid",
  config: {
    maxUnrelatedResponsibilities: 4,
    patternThresholds: {
      "Dashboard": { maxResponsibilities: 6 }
    }
  }
});

Advanced Search Operators

What You Want	Search Query
Complex functions	`complexity:>10`
Go functions only	`lang:go`
TypeScript components	`lang:typescript component:functional`
Undocumented exports	`exported:true jsdoc:false`
React hooks usage	`component:functional hook:useState`
Go struct methods	`lang:go entity:struct`
Find dependencies	`calls:validateUser`
Cross-language patterns	`name:validateEmail`
Unused imports	`unused-imports file:src`

Performance

Indexes 10,000+ functions in seconds
Incremental updates on file changes
LokiJS for fast in-memory search
FlexSearch for intelligent queries

Contributing

See CONTRIBUTING.md for guidelines.

License

MIT - Use it anywhere, anytime.

Ready to give your AI x-ray vision into your code?

bash

claude mcp add code-auditor -- npx code-auditor-mcp

Install

Add to VS Code Add to Cursor

claude_desktop_config.json

json

{
  "mcpServers": {
    "code-auditor-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "code-auditor-mcp@2.0.2"
      ]
    }
  }
}