aptu-coderCAUTION
mcp/clouatre-labs/aptu-coder
aptu-coder: MCP server for AST analysis, call graphs, and code structure (tree-sitter)
Verdict
CAUTION
Grade
C
Trust score
78 /100
Exposed tools
—
Transport
streamable-http
License
Apache-2.0
Stars
6
01
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
aptu-coder
A Model Context Protocol (MCP) code-intelligence server that gives AI coding agents pre-parsed symbol tables and call graphs instead of raw file bytes, cutting token usage by up to 59% in the cited benchmark conditions (see Benchmarks). OpenSSF silver certified: fewer than 1% of open source projects reach this level.
[!NOTE] Native agent tools (regex search, path matching, file reading) handle targeted lookups well. aptu-coder handles the mechanical, non-AI work: mapping directory structure, extracting symbols, and tracing call graphs, so a coding agent's context window is spent reasoning instead of re-deriving structure on every call.Most code-intelligence tooling for AI agents indexes a codebase into a cloud embedding or vector store and retrieves by similarity search. aptu-coder instead parses the codebase into a structural graph on-device with tree-sitter and serves it locally over MCP: no source code leaves the machine, and retrieval is exact (symbol tables and call graphs) rather than approximate (nearest-neighbor similarity).
Benchmarks
Auth migration task on Claude Code against Django (Python) source tree. Full methodology.
Read from source at commit
cacef13000c5OBSERVED · 2026-10-1002
Trust audit
CAUTIONgrade C · trust 78/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (4 observation(s))
- Network
- declared (6 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (25)
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
crates/aptu-coder/src/main.rs:107
tracing::info!(port, "Listening on http://127.0.0.1:{port}/mcp");MEDIUMAuth / authz · mcp.remote_no_auth · CWE-287, CWE-862
streamable-http
Why it matters. a network transport with no auth environment variable found
Fix. require a token
LOWInventory / provenance · inv.hidden_file · CWE-1104
.commitlintrc.yml
.commitlintrc.yml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.jscpd.json
.jscpd.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.markdownlint.jsonc
.markdownlint.jsonc
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
crates/aptu-coder-core/src/completion.rs:189
let results = path_completions(root, "../../");
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
crates/aptu-coder-core/src/completion.rs:192
"expected empty results for parent traversal attempt (../../)"
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
crates/aptu-coder/tests/resources_integration.rs:702
"aptu-overflow://slot-0/../../etc/passwd",
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
docs/benchmarks/v10/run.sh:20
REPO_ROOT="$(cd "$SCRIPT_DIR/../../../.." && pwd)"
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
docs/benchmarks/v9/run.sh:20
REPO_ROOT="$(cd "$SCRIPT_DIR/../../../.." && pwd)"
LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319
scripts/tests/test_bench_v19_snapshots.py:105
{"Location": "http://169.254.169.254/latest/meta-data"},Why it matters. cloud metadata endpoint: the classic SSRF credential grab
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
.github/workflows/ci.yml:416
if curl -sf -o /dev/null -X POST http://127.0.0.1:8080/mcp \
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
.github/workflows/ci.yml:435
--url http://127.0.0.1:8080/mcp \
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.md:125
uri: http://127.0.0.1:49200/mcp
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.md:133
claude mcp add --transport http aptu-coder http://127.0.0.1:49200/mcp
LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
docs/benchmarks/v10/results/runs/R01-session.jsonl:5
{"parentUuid":"ad2156ba-6d53-4a8a-a082-2c976bb28420","isSidechain":false,"message":{"model":"claude-sonnet-4-6","id":"msg_bdrk_01NtMM3Bxd9ffrP2JQXKgaRq","type":"message","role":"assistant","content":[LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
docs/benchmarks/v10/results/runs/R01-session.jsonl:8
{"parentUuid":"32c897dc-5d27-4b17-974d-8dc0c17465ed","isSidechain":false,"message":{"model":"claude-sonnet-4-6","id":"msg_bdrk_01NVDiTsN8DrzkrPGq1YQAfP","type":"message","role":"assistant","content":[LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
docs/benchmarks/v10/results/runs/R01-session.jsonl:15
{"parentUuid":"8c613dd4-f776-4973-bde9-16791ae80a37","isSidechain":false,"message":{"model":"claude-sonnet-4-6","id":"msg_bdrk_015cGMMwuAoH9uvyPg1THM6G","type":"message","role":"assistant","content":[LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
docs/benchmarks/v10/results/runs/R01-session.jsonl:18
{"parentUuid":"58614313-3c4e-4554-9d25-4625f5829869","isSidechain":false,"message":{"model":"claude-sonnet-4-6","id":"msg_bdrk_01CaosC6AQz54RZCL6UARNWg","type":"message","role":"assistant","content":[LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
docs/benchmarks/v10/results/runs/R05-session.jsonl:5
{"parentUuid":"b64f7340-01d2-4270-b106-55b49ba683c2","isSidechain":false,"message":{"model":"claude-sonnet-4-6","id":"msg_bdrk_01LqNkWQj1uSCcj6Mugm6cAT","type":"message","role":"assistant","content":[LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
docs/MCP-BEST-PRACTICES.md:256
As of 2026-07-28, Streamable HTTP is stateless: session IDs, the `Mcp-Session-Id` header, the standalone GET/SSE stream, and `Last-Event-ID` resumability were all removed from the spec. Every request
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
docs/METRICS.md:248
`scripts/mcp-metrics.py` is a zero-dependency Python CLI (stdlib only, Python 3.8+) for interactive analysis of the aptu-coder JSONL metrics corpus. It reads daily-rotated files from the same XDG path
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
docs/audit/2026-09-22-v18-benchmark-readiness.md:34
| R6 | Analysis-only profile (4 analyze tools only) as a client-profile arm; edit/exec tools duplicate agent built-ins in analysis workloads | CONFIRMED | Build after the sealed run; est. 35-45% tools
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
docs/audit/2026-09-25-small-codebase-fit.md:38
| S3 | `outputSchemas` are ~3.4k tokens/session (47% of tool surface) with per-field description prose; prior audits only covered descriptions/inputSchema | CONFIRMED (live `tools/list`: analyze_file
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
docs/benchmarks/v17/methodology.md:116
The global CLAUDE.md still imports @RTK.md, so the model could voluntarily invoke `rtk` even with hooks disabled. Session transcripts must be checked post-hoc for non-allowlisted tool usage before sco
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
Gates applied: no_behavioural_pass.
Audited 2026-10-10 · audit v0.4.1 · source sha
cacef13000c5full audit observations/trust-audit/mcp-server/clouatre-labs__aptu-coder.json · Report an issue / request a re-scan03
Audit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | cacef13000c5 | CAUTION | C | 78 | first audit |
04
Questions
What is the aptu-coder MCP server?
aptu-coder: MCP server for AST analysis, call graphs, and code structure (tree-sitter)
Is aptu-coder safe to connect to an agent?
With care. The audit graded it C (78/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does aptu-coder need?
No credential environment variables were found in its source, so it appears to need none.
How does aptu-coder run?
It speaks streamable-http, so it runs as a service you connect to over the network.
How current is this page?
The grade is for one exact copy of the source (cacef13000c5), read on 2026-10-10. The repository is watched and re-audited when it changes.