Codebase Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Codebase Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Remote MCP server that indexes your repos and lets AI agents search them semantically.
Developers connect by adding a URL — no local install needed.
Edit config.yaml:
repos:
- name: my-backend
path: /path/to/local/repo
extensions: [".py", ".ts", ".java"]
- name: my-frontend
url: https://github.com/your-org/frontend.git
branch: main
extensions: [".ts", ".tsx"]With Docker:
docker compose up --buildWithout Docker:
python -m venv .venv && source .venv/bin/activate
pip install mcp chromadb sentence-transformers tree-sitter tree-sitter-python tree-sitter-javascript tree-sitter-typescript tree-sitter-java pyyaml gitpython pydantic pydantic-settings structlog uvicorn
python -m src.serverFirst run downloads the embedding model (~80MB) and indexes all repos. Subsequent runs are incremental (only changed files).
Claude Desktop — edit ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"codebase": {
"url": "http://localhost:8080/mcp"
}
}
}Cursor — edit .cursor/mcp.json:
{
"mcpServers": {
"codebase": {
"url": "http://localhost:8080/mcp"
}
}
}Claude Code — edit .mcp.json:
{
"mcpServers": {
"codebase": {
"url": "http://localhost:8080/mcp"
}
}
}Replace localhost:8080 with your server's actual address when hosting remotely.
| Tool | What it does |
|---|---|
semantic_search(query) | Natural language search: "how does auth work" |
get_entity(name) | Exact lookup: "show me UserService" |
get_file_skeleton(file_path) | File structure without bodies (saves tokens) |
list_repos() | What's indexed |
reindex() | Trigger re-indexing |
All tools accept an optional repo_name parameter to filter by repo.
IDE (Claude/Cursor) → Streamable HTTP → MCP Server → ChromaDB
↑
tree-sitter AST chunking
+ sentence-transformers embeddings
+ git clone/pull on scheduleall-MiniLM-L6-v2, or jina-embeddings-v2-base-code for better code search)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.