Code Sync Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Code Sync Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Hot reload your remote containerized Python applications directly from your IDE using MCP (Model Context Protocol).
The Code Sync MCP architecture bridges the gap between local development and remote containers for interpreted languages - Python, Ruby, or other interpreted code in your local editor and instantly see changes reflected in containers running anywhere (staging, development clusters, cloud environments, or even production). No compilation step needed - changes take effect immediately.
The included docker-compose.yaml runs everything locally with a demo app.
<video src="https://github.com/user-attachments/assets/eb6c267d-16c5-435f-9179-be13aad13456" width="100"></video>
_This demo shows introducing a bug in a health check, seeing it break immediately, then fixing it in real-time._
When you make a code change in your editor:
Architecture diagram
_All components except the MCP server run in your remote environment_
The proxy is a central websocket server that routes code changes to the right containers.
Deploy [code-sync-proxy](./code-sync-proxy) with:
PROXY_API_KEY=your-secret-key-hereYou only need one proxy per remote environment for all your applications and developers.
For each app deployment, you need two changes:
#### A) Modify your container entrypoint
Replace your existing entrypoint with this wrapper that waits for the sync system:
# Simple one-liner approach (recommended)
sh -c "while [ ! -f /app-files/.sidecar/rsync-launcher.sh ]; do echo 'Waiting for sync...'; sleep 1; done && /app-files/.sidecar/rsync-launcher.sh 'YOUR_ORIGINAL_COMMAND_HERE'"Or use the provided script template.
#### B) Add the sidecar container to your remote deployment
Deploy code-sync-sidecar container alongside your app with these environment variables:
BIFROST_API_URL=http://your-proxy-url
BIFROST_API_KEY=your-secret-key-here # Same as proxy
BIFROST_APP_ID=my-app # Unique app identifier
BIFROST_DEPLOYMENT_ID=dev-john # Unique deployment nameDeployment examples:
#### C) [If Required] Ensure you app has permissions for syncing (if not running as root)
Add to your Dockerfile:
RUN useradd -m appuser
RUN chown -R appuser:appuser /app
USER appuserFor Cursor, add this to your local MCP settings pointing to your remote proxy:
{
"mcpServers": {
"code-sync": {
"command": "uvx code-sync-mcp",
"env": {
"BIFROST_API_KEY": "your-secret-key-here",
"BIFROST_WS_API_URL": "ws://your-proxy-url",
"BIFROST_API_URL": "http://your-proxy-url"
}
}
}
}You'll see these tools become available: Cursor MCP tools
Then you need to add a .bifrost.json file to your app's root:
{
"app_id": "my-app",
"deployment_id": "dev-john",
"app_root": "absolute/path/to/code/root"
}Once set up, use the push_changes tool in your editor to sync your local code changes to any remote container. The system respects your .gitignore file automatically.
Example workflow:
push_changes MCP toolThe system has four main components:
push_changes MCP toolrsync to efficiently detect and package changes.gitignore rulesSIGHUP to trigger app restartBefore running the local demo, ensure you have the following installed:
brew install rsync && rsync --versionrsync --version and upgrade if needed# Clone the repository
git clone https://github.com/bifrostinc/code-sync-mcp.git
# Start the local environment
docker-compose upcursor ./demo-appAdd the following configuration to your Cursor MCP settings:
{
"mcpServers": {
"code-sync": {
"command": "uvx code-sync-mcp",
"env": {
"UV_PYTHON": "3.13",
"BIFROST_API_KEY": "test-secret-key",
"BIFROST_WS_API_URL": "ws://localhost:8000",
"BIFROST_API_URL": "http://localhost:8000"
}
}
}
}demo-app/app.py (try adding an Exception to the health check) deploy these changesExample:
Cursor Demo Screenshot
Real Usage: In a real deployment, the proxy and sidecar components would run in your remote infrastructure rather than locally. This demo simulates that environment on your local machine for testing purposes.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.