Code Inspectus MCP Server

A local-first, privacy-preserving security MCP server and CLI. Any AI coding agent (Claude Code, Cursor, Codex, Windsurf, Cline, Aider) can invoke CodeInspectus to scan AI-generated / "vibe-coded" code for real vulnerabilities, map findings to compliance frameworks as honest code-level coverage, and drive a scan → fix → rescan loop - fully on your machine, with no account and zero network egress at scan time. Its README documents 7 tools, including codeinspectus_scan, codeinspectus_setup, codeinspectus_rescan.

People who work with ai generated code, appsec and devsecops and want it reachable from Claude, Cursor, VS Code, or another MCP client. The project is written in TypeScript.

VERIFIED ACTIVE

LAST COMMIT 2026-09-07 · ★ 46 · #23 OF 204 MAINTAINED SECURITY · VERIFIED 2026-09-18

Apache-2.0 · TypeScript servers · how we verify → /methodology

01 · Install Code Inspectus

Claude Code

claude mcp add synvoya-codeinspectus -- npx -y codeinspectus

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "synvoya-codeinspectus": {
      "command": "npx",
      "args": [
        "-y",
        "codeinspectus"
      ]
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as local process (stdio) - runs on your machine with your user's permissions

license Apache-2.0 - declared in the repository

npm package codeinspectus - unscoped; check the name against the project README before installing

registry namespace io.github.Synvoya is GitHub-verified and matches the repo owner

03 · What Code Inspectus can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

What you can build

An agent gets 7 documented tools, including codeinspectus_scan, codeinspectus_setup, codeinspectus_rescan, codeinspectus_compliance_report, codeinspectus_explain_finding.

The 7 tools it gives your agent

Extracted from the project's README - what CodeInspectus lets an agent do.

codeinspectus_scan: - Full local scan of a path (engines + AI checks). Returns CWE-keyed findings, detected technologies, exact native-pack and Pub dependency coverage, remediations,
codeinspectus_setup: - Offline setup plan, saved decline choices, or approval-gated verified downloads to ~/.codeinspectus; never writes to the target repository.
codeinspectus_rescan: - Re-scan after fixes; diffs vs a prior scan → resolved / remaining / introduced, with fresh technology and pack coverage.
codeinspectus_compliance_report: - Per-framework code-level control coverage (not certification).
codeinspectus_explain_finding: - Deep explanation + full remediation for one finding.
codeinspectus_generate_sbom: - CycloneDX/SPDX SBOM using Trivy plus native Pub inventory/fallback (written to the managed dir by default, or a path you choose).
codeinspectus_list_rules: - Active detectors, native-pack inventory/rule ownership, engine versions, detection-DB + Trivy/Pub DB provenance and freshness, and structured machine setup/repa

Latest releases

v3.2.0 · 2026-09-07

AI Provenance Audit · CodeInspectus 3.2 adds bounded, read-only repository provenance inspection: · Detects explicit AI attribution in supported source/config headers, local Git Co-Authored-By trailers, and image…

v3.1.0 · 2026-08-25

CodeInspectus 3.1.0 introduces the Repository Trust & Provenance foundation and its first deterministic capability: bounded source-integrity inspection.\n\n## What’s new\n\n- Detects dangerous bidirectional controls…

v2.6.0 · 2026-08-22

CodeInspectus 2.6.0 makes complete local scanning easier for nontechnical users without weakening the project's consent, integrity, or zero-egress boundaries. · What’s new · Guided first-use setup. Interactive npx…

04 · Who maintains Code Inspectus

CodeInspectus is maintained by synvoya. It's the only MCP server we track from this author; the repo dates to Jul 2026.

05 · Facts

repository: github.com/synvoya/codeinspectus
website: https://codeinspectus.com/
category: security - ranked #23 of 204 actively-maintained security servers as of 2026-09-18.
release cadence: 10+ releases in the last 90 days (latest 2026-09-07)
registry: io.github.Synvoya/codeinspectus (active, first published 2026-07-06 · 13 versions)
packages: npm:codeinspectus

06 · Code Inspectus FAQ

Is Code Inspectus still maintained?

Yes - as of 2026-09-18, its last commit was 2026-09-07 and it shipped 10+ releases in the last 90 days. We re-verify nightly.

What can Code Inspectus do?

An agent gets 7 documented tools, including codeinspectus_scan, codeinspectus_setup, codeinspectus_rescan, codeinspectus_compliance_report, codeinspectus_explain_finding.

How do I install Code Inspectus?

Run `npx -y codeinspectus`. You can also paste the ready-made client config above.

Does Code Inspectus run locally?

Yes - it's a stdio server: it runs on your machine (via npx) with your user's permissions. Your data stays local unless the server itself calls external APIs.

07 · Alternatives to Code Inspectus

Alternatives to Code Inspectus

Maintained security servers if Code Inspectus isn't the fit.

Pairs well with

Servers that cover what Code Inspectus doesn't - only shown when the pairing reason fits the companion.

More security MCP servers · Wass MCP · Universal Connector MCP · Agent News by The Agent Times · Totem · Thingctx

More TypeScript MCP servers · Recon Crypto MCP · VaultPilot MCP · Factorial HR · Tago Io MCP Server · Talonic · see all