Codeatlas Mcp Server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Codeatlas Mcp Server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center">
Enterprise-Grade, Local-First MCP Server for AI-Powered Code Intelligence
CodeAtlas MCP Enterprise is an ultra-lightweight, local-first Model Context Protocol (MCP) server that securely indexes your codebase, performs deep AST-based analysis, and provides 20+ intelligent tools for AI code assistants. Your source code never leaves your machine.
</div>
AI code assistants are powerful — but they work best with context. CodeAtlas gives them X-ray vision into your codebase by:
| Feature | Description |
|---|---|
| 🔒 Local-First Parsing | AST analysis runs entirely on your machine — zero code uploaded |
| 🔌 MCP Protocol | Works with all MCP-compatible AI editors |
| 📁 Auto Workspace Discovery | Automatically finds projects in your workspace |
| 🔍 Multi-Language AST | JavaScript, TypeScript, Python, PHP with deep dependency resolution |
| 🧠 Dreaming Memory | Persistent AI memory with vector search for cross-session context |
| 🏠 Multi-Tenant Isolation | Isolate projects by workspace with sandbox boundaries |
| 🔐 API Key Auth | Secure communication via cryptographic hash verification |
| ⚡ Incremental Indexing | Only re-parses changed files for near-instant updates |
| 🏗️ Knowledge Graph | Visualize modules, classes, and functions as an interactive graph |
| 🌐 Remote Sync | Optionally sync metadata to CodeAtlas Enterprise via HTTPS |
| 📊 Code Metrics | LOC, complexity scores, function counts per project |
| 🛡️ Security Scanner | Detect hardcoded secrets, unsafe functions, SQL injection |
| 🔄 Real-time Watching | Auto re-index on file changes via chokidar |
┌─────────────────────────────────────────────────────────┐
│ Your Local Machine │
│ │
│ ┌──────────┐ ┌────────────┐ ┌────────────────┐ │
│ │ Source │───▶│ AST │───▶│ MCP Server │ │
│ │ Code │ │ Parser │ │ (this tool) │───┼──▶ AI Editor
│ │ (JS/TS/ │ │ (local) │ └───────┬────────┘ │
│ │ PY/PHP)│ └────────────┘ │ │
│ └──────────┘ │ │
│ ▼ │
│ ┌──────────────────┐ │
│ │ Dreaming Memory │ │
│ │ (optional: sync) │ │
│ └────────┬─────────┘ │
└───────────────────────────────────────────┼───────────────┘
│ HTTPS (optional)
▼
CodeAtlas Enterprise Servernpm install -g codeatlas-enterprise# Scan current directory and start MCP server
codeatlas-mcp
# With API key for remote sync
codeatlas-mcp --apiKey="your_api_key_here"
# Point to a specific project directory
codeatlas-mcp --projectDir="/path/to/your/project"That's it! Your AI editor can now connect to the MCP server running on stdio.
Provide your API Key in one of these ways:
export CODEATLAS_API_KEY="your_api_key_here" codeatlas-mcp --apiKey="your_api_key_here" CODEATLAS_API_KEY=your_api_key_hereAdd to ~/.cursor/mcp.json or project-level .cursor/mcp.json:
{
"mcpServers": {
"codeatlas": {
"command": "codeatlas-mcp",
"args": ["--apiKey", "YOUR_API_KEY_HERE"]
}
}
}Add to claude_desktop_config.json:
{
"mcpServers": {
"codeatlas": {
"command": "codeatlas-mcp",
"args": ["--apiKey", "YOUR_API_KEY_HERE"]
}
}
}For any MCP-compatible editor, use the same JSON structure:
{
"mcpServers": {
"codeatlas": {
"command": "codeatlas-mcp",
"args": ["--apiKey", "YOUR_API_KEY_HERE"]
}
}
}Note: If you're running without a remote server, omit the --apiKey argument. The local MCP tools (analysis, search, graph) work fully offline.CodeAtlas MCP exposes 20+ tools organized into categories:
| Tool | Description |
|---|---|
analyze | Trigger full AST analysis of the current project |
get_project_structure | Get entities tree (modules, classes, functions, variables) |
get_file_entities | List all entities defined in a specific file |
| Tool | Description |
|---|---|
search_entities | Search for functions, classes, modules by name (fuzzy) |
code_search | Search source file contents for any text or regex |
get_file_content | Read file contents with line numbers |
| Tool | Description |
|---|---|
get_callers | Find all functions/callers that reference a symbol |
get_callees | Find everything a function/module imports or calls |
impact_analysis | Full blast radius: callers + callees + test files |
get_dependencies | Get import/call/containment/implements relationships |
| Tool | Description |
|---|---|
generate_system_flow | Mermaid flowchart of module architecture |
generate_feature_flow_diagram | Mermaid sequence/flow diagram for a feature |
trace_feature_flow | Ordered call chain from entry point to database |
| Tool | Description |
|---|---|
query_dream_memories | Semantic vector search across past AI memories |
save_dream_memory | Persist an AI insight or observation for future sessions |
get_system_memory | Retrieve business rules and change logs |
sync_system_memory | Save business rules or change descriptions |
| Tool | Description |
|---|---|
scan_enterprise_vulnerabilities | Scan all projects for hardcoded secrets, unsafe functions, SQL injection |
detect_architectural_smells | Detect circular dependencies, God objects, dead code |
| Tool | Description |
|---|---|
list_projects | List all discovered and indexed projects |
refresh_projects | Re-scan directories for new or removed projects |
get_project_insights | AI-generated refactoring and maintainability suggestions |
CodeAtlas MCP Enterprise follows a zero-trust, local-first architecture:
Only structural metadata is transmitted:
Raw source code, credentials, and proprietary logic are never transmitted.
When multi-tenant mode is enabled:
Enable tenant isolation via environment variables:
CODEATLAS_MULTI_TENANT=true
CODEATLAS_PROJECTS_ROOT=./tenantsEach tenant's projects live in ./tenants/{tenantId}/, with strict path-boundary enforcement.
| Variable | Default | Description |
|---|---|---|
CODEATLAS_API_KEY | — | API key for authenticating with remote server |
CODEATLAS_API_URL | https://your-server.com/api | Remote CodeAtlas server URL |
CODEATLAS_MULTI_TENANT | false | Enable multi-tenant isolation |
CODEATLAS_PROJECTS_ROOT | ./tenants | Root directory for tenant sandboxes |
CODEATLAS_PROJECT_DIR | process.cwd() | Default project path |
NODE_ENV | production | Environment mode |
codeatlas-mcp in your project directory or point it with --projectDirpackage.json, pyproject.toml, composer.jsonMIT © 2026 Giau Phan
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.