Atlas / MCP servers / anrgct / Codebase

CodebaseBLOCK

mcp/anrgct/codebase-1

A vector embedding-based code semantic search tool with MCP server and multi-model integration. Can be used as a pure CLI tool. Supports Ollama for fully local embedding and reranking, enabling complete offline operation and privacy protection for your code repository

Verdict
BLOCK
Grade
F
Trust score
55 /100
Exposed tools
3 2r · 1w · 0d
Transport
sse · streamable-http
License
—
Stars
122
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://www.npmjs.com/package/@autodev/codebase) [](https://github.com/anrgct/autodev-codebase) [](https://opensource.org/licenses/MIT)

A vector embedding-based code semantic search tool with MCP server and multi-model integration. Can be used as a pure CLI tool. Supports Ollama for fully local embedding and reranking, enabling complete offline operation and privacy protection for your code repository.

# Semantic code search - Find code by meaning, not just keywords
╭─ ~/workspace/autodev-codebase 
╰─❯ codebase search "user manage" --demo
Found 20 results in 5 files for: "user manage"

==================================================
File: "hello.js"
==================================================
(L7-20)
class UserManager {
constructor() {
this.users = [];
}

addUser(user) {
this.users.push(user);
console.log('User added:', user.name);
}

getUsers() {
return this.users;
}
}
......

# Call graph analysis - Trace function call relationships and execution paths
╭─ ~/workspace/autodev-codebase 
╰─❯ codebase call --demo --query="app,addUser"
Connections between app, addUser:

Found 2 matching node(s):
- demo/app:L1-29
- demo/hello.UserManager.addUser:L12-15

Direct connections:
- demo/app:L1-29 → demo/hello.UserManager.addUser:L12-15

Chains found:
- demo/app:L1-29 → demo/hello.UserManager.addUser:L12-15

# Code outline with AI summaries - Understand code structure at a glance
╭─ ~/workspace/autodev-codebase 
╰─❯ codebase outline 'hello.js' --demo --summarize
# hello.js (23 lines)
└─ Defines a greeting function that logs a personalized hello message and returns a welcome string. Implements a UserManager class managing an array of users with methods 
Read from source at commit 6cd509855b44OBSERVED · 2026-10-07
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add codebase --env API_KEY=${API_KEY} --env STAGE3_TOKENS=${STAGE3_TOKENS} -- npx -y @autodev/[email protected]
claude-desktop
{
  "mcpServers": {
    "codebase": {
      "command": "npx",
      "args": [
        "-y",
        "@autodev/[email protected]"
      ],
      "env": {
        "API_KEY": "${API_KEY}",
        "STAGE3_TOKENS": "${STAGE3_TOKENS}"
      }
    }
  }
}
03

Exposed tools (3)

2 read · 1 write · 0 destructive.

ToolRiskDescription
additionread两个数字相加
finishwriteYou are an ADVISOR — you have NO other tools. You cannot search, read files, run code, or inspect the codebase.
fooread
04

Trust audit

BLOCKgrade F · trust 55/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (8 observation(s))
Network
declared (7 observation(s))
Shell
declared (6 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
scripts/evidence/260524-layer-sweep.sh:86
echo "[2/2] Running eval (search layer=$local_search_layer)..."
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHPrompt injection · review.instruction_override · CWE-94, CWE-1427
<tool:finish>
You are an ADVISOR — you have NO other tools. You cannot search, read files, run code, or inspect the codebase.
Why it matters. The finish tool instructs the agent to set aside its own capabilities and instructions, restricting it to an advisor role with no tool access.
Fix. rewrite it so the instruction says plainly what it does, and asks the user before it acts
MEDIUMInventory / provenance · inv.binary · CWE-1104
vendor/llama-addon/binaries/mac-arm64-metal/libggml-base.dylib
libggml-base.dylib
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
vendor/llama-addon/binaries/mac-arm64-metal/libggml-blas.dylib
libggml-blas.dylib
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
vendor/llama-addon/binaries/mac-arm64-metal/libggml-cpu.dylib
libggml-cpu.dylib
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
vendor/llama-addon/binaries/mac-arm64-metal/libggml-metal.dylib
libggml-metal.dylib
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
vendor/llama-addon/binaries/mac-arm64-metal/libggml.metal.b9370.2da1n284.dylib
libggml.metal.b9370.2da1n284.dylib
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
scripts/evidence/260524-repro-kq-softmax-nan.ts:203
console.log(`[case] shape warning: nTokens=${nTokens} differs from query token count=${nQueryTokens}`);
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
scripts/evidence/260525-evidence-embedding-failure.ts:90
console.log(`Token count: ${nTokens}`);
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
scripts/evidence/260525-evidence-embedding-failure.ts:91
console.log(`Per-token embeddings all identical? ${allSame ? "✅ YES (late-chunking IS a no-op)" : "❌ NO (late-chunking COULD work)"}`);
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
scripts/evidence/260525-evidence-embedding-failure.ts:105
console.log(`\nSingle-chunk last-token (NONE):`);
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
scripts/evidence/260525-evidence-embedding-failure.ts:124
console.log(`\nMulti-chunk last-token (NONE, late-chunking simulation):`);
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
scripts/evidence/260602-escalate-e2e-deepseek.ts:56
const proxyUrl = `http://127.0.0.1:${handle.port}`
MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94
scripts/evidence/260525-test-midlayer-embd.ts:252
console.log(`\n🔍 语义变化最大发生在: L${jumpLayer - 1} → L${jumpLayer} (Δcos = ${maxJump.toFixed(4)})`);
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
src/code-index/embedders/__tests__/mistral.spec.ts:32
const apiKey = "test-mistral-api-key"
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
src/code-index/embedders/__tests__/mistral.spec.ts:46
const apiKey = "test-mistral-api-key"
LOWInventory / provenance · inv.hidden_file · CWE-1104
vendor/node-llama-cpp/.version
.version
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.no_license · CWE-1104
Why it matters. no LICENSE file and no repo licence
Fix. add a licence
LOWInventory / provenance · inv.symlink · CWE-1104
AGENTS.md
AGENTS.md
Why it matters. link not followed
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
src/code-index/vector-store/qdrant-client.ts:516
const segmentHash = createHash('md5')
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
scripts/evidence/260525-verify-late-chunking.ts:12
const CODE_PATH = path.resolve(import.meta.dirname ?? __dirname, "../../demo/model.py")
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
scripts/evidence/260602-escalate-e2e-deepseek.ts:19
import { startEscalateServer } from '../../src/escalate/server'
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
scripts/evidence/260605-decode-attention-prod-impl.ts:16
import { QRRankerHighlighter } from "../../src/code-index/highlighters/qrranker";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
scripts/evidence/260605-decode-attention-prod-impl.ts:17
import { QRRankerReranker } from "../../src/code-index/rerankers/qrranker";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
scripts/evidence/260605-decode-attention-prod-impl.ts:18
import type { RerankerCandidate } from "../../src/code-index/interfaces";

Gates applied: no_behavioural_pass, no_license.

Audited 2026-10-07 · audit v0.4.1 · source sha 6cd509855b44full audit observations/trust-audit/mcp-server/anrgct__codebase-1.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-076cd509855b44BLOCKF55first audit
06

Questions

What is the Codebase MCP server?

A vector embedding-based code semantic search tool with MCP server and multi-model integration. Can be used as a pure CLI tool. Supports Ollama for fully local embedding and reranking, enabling complete offline operation and privacy protection for your code repository

What tools does Codebase expose?

3 in total: 2 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Codebase safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (55/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does Codebase need?

It reads API_KEY and STAGE3_TOKENS from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Codebase run?

It speaks sse and streamable-http, so it runs as a service you connect to over the network. It is published on npm as @autodev/codebase at 1.0.1.

How current is this page?

The grade is for one exact copy of the source (6cd509855b44), read on 2026-10-07. The repository is watched and re-audited when it changes.

Advertisement