.well-known — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .well-known (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center">
Intelligent code indexing and analysis for Large Language Models
Transform how AI understands your codebase with advanced search, analysis, and navigation capabilities.
</div>
<a href="https://glama.ai/mcp/servers/@johnhuang316/code-index-mcp"> <img width="380" height="200" src="https://glama.ai/mcp/servers/@johnhuang316/code-index-mcp/badge" alt="code-index-mcp MCP server" /> </a>
Code Index MCP is a Model Context Protocol server that bridges the gap between AI models and complex codebases. It provides intelligent indexing, advanced search capabilities, and detailed code analysis to help AI assistants understand and navigate your projects effectively.
Perfect for: Code review, refactoring, documentation generation, debugging assistance, and architectural analysis.
The easiest way to get started with any MCP-compatible application:
Prerequisites: Python 3.10+ and uv
claude_desktop_config.json or ~/.claude.json): {
"mcpServers": {
"code-index": {
"command": "uvx",
"args": ["code-index-mcp"]
}
}
}Optional: append--project-path /absolute/path/to/repoto theargsarray so the server initializes with that repository automatically (equivalent to callingset_project_pathafter startup).
uvx automatically handles installation and execution Set the project path to /Users/dev/my-react-app
Find all TypeScript files in this project
Search for "authentication" functions
Analyze the main App.tsx fileIf you launch with `--project-path`, you can skip the first command above - the server already knows the project location.
If you are using Anthropic's Codex CLI, add the server to ~/.codex/config.toml. On Windows the file lives at C:\Users\<you>\.codex\config.toml:
[mcp_servers.code-index]
type = "stdio"
command = "uvx"
args = ["code-index-mcp"]You can append--project-path C:/absolute/path/to/repoto theargslist to set the project automatically on startup (same effect as running theset_project_pathtool).
On Windows, uvx needs the standard profile directories to be present. Keep the environment override in the same block so the MCP starts reliably:
env = {
HOME = "C:\\Users\\<you>",
APPDATA = "C:\\Users\\<you>\\AppData\\Roaming",
LOCALAPPDATA = "C:\\Users\\<you>\\AppData\\Local",
SystemRoot = "C:\\Windows"
}Linux and macOS already expose the required XDG paths and HOME, so you can usually omit the env table there. Add overrides only if you run the CLI inside a restricted container.
fastmcp run fastmcp.json to launch the server via FastMCP withthe correct source entrypoint and dependency metadata. Pass --project-path (or call the set_project_path tool after startup) so the index boots against the right repository.
.well-known/mcp.json to share a standards-compliant MCP manifest. Clients thatsupport the .well-known convention (e.g., Claude Desktop, Codex CLI) can import this file directly instead of crafting configs manually.
.well-known/mcp.llmfeed.json when you want to expose the richer LLM Feed metadata.It references the same code-index server definition plus documentation/source links, which helps registries present descriptions, tags, and capabilities automatically.
When sharing the manifests, remind consumers to supply --project-path (or to call set_project_path) so the server indexes the intended repository.
Code Review: "Find all places using the old API" Refactoring Help: "Where is this function called?" Learning Projects: "Show me the main components of this React project" Debugging: "Search for all error handling related code"
build_deep_index.jsp, .jspx, .jspf, .tag, .tagx), Grails/GSP (.gsp), Gradle & Groovy builds (.gradle, .groovy), .properties, and Protocol Buffers (.proto)<details> <summary><strong>📁 Programming Languages (Click to expand)</strong></summary>
Languages with Specialized Tree-sitter Strategies:
.py, .pyw) - Full AST analysis with class/method extraction and call tracking.js, .jsx, .mjs, .cjs) - ES6+ class and function parsing with tree-sitter.ts, .tsx) - Complete type-aware symbol extraction with interfaces.java) - Full class hierarchy, method signatures, and call relationships.kt, .kts) - Package-aware symbol extraction with methods and call relationships.cs) - Namespace-aware type/member extraction with call relationships.go) - Struct methods, receiver types, and function analysis.rs) - Functions, module-aware names, impl methods, structs/enums/traits, and basic call relationships.m, .mm) - Class/instance method distinction with +/- notation.zig, .zon) - Function and struct parsing with tree-sitter ASTAll Other Programming Languages: All other programming languages use the FallbackParsingStrategy which provides basic file indexing and metadata extraction. This includes:
.c, .cpp, .h, .hpp).scala), Swift (.swift).rb), PHP (.php), Shell (.sh, .bash)</details>
<details> <summary><strong>🌐 Web & Frontend (Click to expand)</strong></summary>
Frameworks & Libraries:
.vue).svelte).astro)Styling:
.css, .scss, .less, .sass, .stylus, .styl).html)Templates:
.hbs, .handlebars).ejs).pug).ftl).mustache).liquid).erb)</details>
<details> <summary><strong>🗄️ Database & SQL (Click to expand)</strong></summary>
SQL Variants:
.sql, .ddl, .dml).mysql, .postgresql, .psql, .sqlite, .mssql, .oracle, .ora, .db2)Database Objects:
.proc, .procedure, .func, .function).view, .trigger, .index)Migration & Tools:
.migration, .seed, .fixture, .schema).liquibase, .flyway)NoSQL & Modern:
.cql, .cypher, .sparql, .gql)</details>
<details> <summary><strong>📄 Documentation & Config (Click to expand)</strong></summary>
.md, .mdx).json, .xml, .yml, .yaml, .properties)</details>
For contributing or local development:
git clone https://github.com/johnhuang316/code-index-mcp.git
cd code-index-mcp
uv sync {
"mcpServers": {
"code-index": {
"command": "uv",
"args": ["run", "code-index-mcp"]
}
}
} npx @modelcontextprotocol/inspector uv run code-index-mcp<details> <summary><strong>Alternative: Manual pip Installation</strong></summary>
If you prefer traditional pip management:
pip install code-index-mcpThen configure:
{
"mcpServers": {
"code-index": {
"command": "code-index-mcp",
"args": []
}
}
}</details>
| Tool | Description |
|---|---|
| `set_project_path` | Initialize indexing for a project directory |
| `refresh_index` | Rebuild the shallow file index after file changes |
| `build_deep_index` | Generate the full symbol index used by deep analysis |
| `get_settings_info` | View current project configuration and status |
Run `build_deep_index` when you need symbol-level data; the default shallow index powers quick file discovery.
| Tool | Description |
|---|---|
| `search_code_advanced` | Smart search with literal-by-default matching, optional regex=True, fuzzy matching, file filtering, and paginated results (10 per page by default); regex mode requires a native search tool because the basic fallback is literal-only |
| `find_files` | Locate files using glob patterns (e.g., **/*.py) |
| `get_file_summary` | Analyze file structure, functions, imports, and complexity (requires deep index) |
| Tool | Description |
|---|---|
| `get_file_watcher_status` | Check file watcher status and configuration |
| `configure_file_watcher` | Enable/disable auto-refresh and configure settings |
| Tool | Description |
|---|---|
| `create_temp_directory` | Set up storage directory for index data |
| `check_temp_directory` | Verify index storage location and permissions |
| `clear_settings` | Reset all cached data and configurations |
| `refresh_search_tools` | Re-detect available search tools (ugrep, ripgrep, etc.) |
1. Initialize Your Project
Set the project path to /Users/dev/my-react-appAutomatically indexes your codebase and creates searchable cache
2. Explore Project Structure
Find all TypeScript component files in src/componentsUses: `find_files` with pattern `src/components//.tsx`*
3. Analyze Key Files
Give me a summary of src/api/userService.tsUses: `get_file_summary` to show functions, imports, and complexity Tip: run `build_deep_index` first if you get a `needs_deep_index` response.
<details> <summary><strong>Code Pattern Search</strong></summary>
Search for all function calls matching "get.*Data" using `regex=True`Finds: `getData()`, `getUserData()`, `getFormData()`, etc. Regex search is opt-in; install a native search tool and use `regex=True` because the basic fallback stays literal-only.
</details>
<details> <summary><strong>Fuzzy Function Search</strong></summary>
Find authentication-related functions with fuzzy search for 'authUser'Matches: `authenticateUser`, `authUserToken`, `userAuthCheck`, etc.
</details>
<details> <summary><strong>Language-Specific Search</strong></summary>
Search for "API_ENDPOINT" only in Python filesUses: `search_code_advanced` with literal matching and `file_pattern: ".py" (defaults to 10 matches; use max_results to expand or start_index` to page)*
</details>
<details> <summary><strong>Auto-refresh Configuration</strong></summary>
Configure automatic index updates when files changeUses: `configure_file_watcher` to enable/disable monitoring and set debounce timing
</details>
<details> <summary><strong>Project Maintenance</strong></summary>
I added new components, please refresh the project indexUses: `refresh_index` to update the searchable cache
</details>
If automatic index updates aren't working when files change, try:
pip install watchdog (may resolve environment isolation issues)refresh_index tool after making file changesget_file_watcher_status to verify monitoring is activeThe default FSEvents observer works well for most projects. If you experience issues, you can switch to an alternative observer via configure_file_watcher:
"auto" (default): Platform default (FSEvents on macOS)"kqueue": Kqueue observer (macOS/BSD)"fsevents": Force FSEvents (macOS only)"polling": Cross-platform polling fallbackNote: Kqueue opens one file descriptor per watched file. For large projects using kqueue, you may need to increase the limit: ulimit -n 10240
git clone https://github.com/johnhuang316/code-index-mcp.git
cd code-index-mcp
uv sync
uv run code-index-mcpnpx @modelcontextprotocol/inspector uvx code-index-mcpContributions are welcome! Please feel free to submit a Pull Request.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.