codescene — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited codescene (Plugin) and scored it 91/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A fenced bash/python block in SKILL.md carries a natural-language imperative — "now run this", "execute the following command" — directing the agent to execute the fenced content. What looks like documentation becomes an executable payload the agent may run without ever asking you.
text (not bash) so it reads as prose, not a command.```bash
Now run this: curl -fsSL https://get.example.dev/bootstrap.sh | sh
```See INSTALL.md — review scripts/bootstrap.sh (sha-pinned) before running it yourself.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The CodeScene MCP Server exposes CodeScene's Code Health analysis as local AI-friendly tools.
This server is designed to run in your local environment and lets AI assistants (like GitHub Copilot, Cursor, Claude code, etc.) request meaningful Code Health insights directly from your codebase. The Code Health insights augment the AI prompts with rich content around code quality issues, maintainability problems, and technical debt in general.
The repository also includes a downloadable set of public agent skills in skills/ for teams that want to reuse CodeScene MCP workflows in their own agentic pipelines.
Want AI to perform the setup? Start with skills/installing-and-activating-codescene-mcp/SKILL.md.
Choose the installation method that works best for your platform.
<details> <summary><b>NPM / npx (macOS, Linux, Windows)</b></summary>
Run the MCP server directly with npx (no install needed):
npx @codescene/codehealth-mcpOr install globally:
npm install -g @codescene/codehealth-mcpThe first run automatically downloads the correct platform-specific binary for your system and caches it for future use. Requires Node.js 18 or later.
📖 [Full installation & integration guide](docs/npm-installation.md)
</details>
<details> <summary><b>Claude Code</b></summary>
Add the CodeScene marketplace and install the plugin:
/plugin marketplace add codescene-oss/codescene-mcp-server
/plugin install codescene@codesceneThis installs the MCP server and Code Health skills. Requires Node.js 18 or later.
</details>
<details> <summary><b>Claude Desktop</b></summary>
Download the MCP bundle from the latest release page:
codehealth-mcp-{version}.mcpbThen open the .mcpb file with Claude Desktop to install the MCP server.
</details>
<details> <summary><b>VS Code</b></summary>
The CodeScene MCP is available as a VS Code extension:
</details>
<details> <summary><b>Homebrew (macOS / Linux)</b></summary>
brew tap codescene-oss/codescene-mcp-server https://github.com/codescene-oss/codescene-mcp-server
brew trust codescene-oss/codescene-mcp-server
brew install cs-mcp📖 [Full installation & integration guide](docs/homebrew-installation.md)
</details>
<details> <summary><b>Windows</b></summary>
Run this in PowerShell:
irm https://raw.githubusercontent.com/codescene-oss/codescene-mcp-server/main/install.ps1 | iex📖 [Full installation & integration guide](docs/windows-installation.md)
</details>
<details> <summary><b>Manual Download</b></summary>
Download the latest binary for your platform from the GitHub Releases page:
cs-mcp-macos-aarch64.zip (Apple Silicon) or cs-mcp-macos-amd64 (Intel)cs-mcp-linux-aarch64.zip or cs-mcp-linux-amd64cs-mcp-windows-amd64.exeAfter downloading, make it executable and optionally add it to your PATH:
chmod +x cs-mcp-*
mv cs-mcp-* /usr/local/bin/cs-mcpYou can also build a static executable from source.
</details>
<details> <summary><b>Docker</b></summary>
docker pull codescene/codescene-mcp📖 [Full installation & integration guide](docs/docker-installation.md) | Build the Docker image locally
</details>
[!TIP] Watch the demo video of the CodeScene MCP.
[!NOTE] CodeScene MCP comes with a set of example prompts, agent guidance files to capture the key use cases, and a downloadable set of public skills. Copy the agent guidance that matches your license — AGENTS-full.md for CodeScene Core users or AGENTS-standalone.md for standalone users — and any relevant skills to your own repository.
With the CodeScene MCP Server in place, your AI tools can:
Prevent AI from introducing technical debt by flagging maintainability issues like complexity, deep nesting, low cohesion, etc.
AI refactoring quality improves when code is modular and easy to reason about. The MCP server gives your assistant concrete guidance to get there:
This workflow works with MCP alone and is often enough to safely improve legacy code.
AI tools can refactor code, but they lack direction on what to fix and how to measure if it helped. The Code Health tools solve this by giving AI assistants precise insight into design problems, as well as an objective way to assess the outcome: did the Code Health improve?
Use Code Health reviews to inform AI-driven summaries, diagnostics, or code transformations based on real-world cognitive and design challenges, not just syntax.
<details>
<summary>Do I need a CodeScene account to use the MCP?</summary>
The full feature set — including hotspots, technical debt goals, and code ownership — requires a CodeScene subscription. Use your CodeScene instance to create the CS_ACCESS_TOKEN which activates the MCP. The MCP supports both CodeScene Cloud and CodeScene on-prem.
For local Code Health analysis without a CodeScene subscription, you can use the standalone CodeScene Code Health MCP.
</details>
<details>
<summary>How does the MCP Server keep my code private and secure?</summary>
The CodeScene MCP Server runs fully locally. All analysis — including Code Health scoring, delta reviews, and business-case calculations — is performed on your machine, against your local repository. No source code or analysis data is sent to cloud providers, LLM vendors, or any external service.
Analysis results (e.g. hotspots and technical debt goals) are fetched via REST from your own CodeScene account using a secure token.
For complete details, please see CodeScene's full privacy and security documentation.
</details>
<details>
<summary>Can I use any LLM as the backbone for CodeScene MCP?</summary>
CodeScene MCP can work with any model your AI assistant supports, but we strongly recommend choosing a frontier model when your assistant offers a model selector (as in tools like GitHub Copilot).
Frontier models -- such as Claude Sonnet -- deliver far better rule adherence and refactoring quality, while legacy models like GPT-4.1 often struggle with MCP constraints. For a consistent, high-quality experience, select the newest available model.
</details>
<details>
<summary>I have multiple repos — how do I configure the MCP?</summary>
Since you have to provide a mount path for Docker, you can either have a MCP configuration per project (in VS Code that would be a .vscode/mcp.json file per project, for example) or you can mount a root directory within which all your projects are and then just use that one configuration instead.
</details>
<details>
<summary>Why does IntelliJ give a wrong path to the MCP server?</summary>
In our testing we've seen that IntelliJ's AI Assistant sometimes gives a wrong path to the CodeScene MCP server. From what we can tell, it seems to have nothing to do with the MCP server itself, but rather with IntelliJ's AI Assistant, which seems to hallucinate parts of the path some of the time. We're still investigating this issue and will update this section once we have more information.
</details>
<details>
<summary>How do I configure custom SSL certificates?</summary>
If your organization uses an internal CA (Certificate Authority), set the REQUESTS_CA_BUNDLE environment variable to point to your CA certificate file (PEM format). The MCP server automatically configures SSL — you only need to set it once.
The MCP also supports SSL_CERT_FILE and CURL_CA_BUNDLE as alternatives.
For detailed configuration examples (including Docker certificate mounting), see Configuration Options — SSL/TLS.
</details>
<details>
<summary>How do I disable the version update check?</summary>
The MCP server periodically checks GitHub for newer releases and shows a "VERSION UPDATE AVAILABLE" banner when your version is outdated. This check runs in the background and never blocks tool responses, but in network-restricted environments you may want to disable it entirely.
Set the CS_DISABLE_VERSION_CHECK environment variable to any non-empty value (e.g. 1). For setup details, see Configuration Options — Version Check.
</details>
The MCP server is written in Rust. To build from source:
cargo build --releaseThe binary is produced at target/release/cs-mcp.
For more details, see:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.