codelocalBLOCK
The open-source Project Brain for AI coding. Connect ChatGPT, Codex, Claude and MCP-compatible agents to your projects, local tools and persistent knowledge. Fork it, build with it, and help shape the open AI development stack. 🧠⚡
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
One Project Brain. Any AI client. Your machine.
[](https://www.npmjs.com/package/codelocal) [](./LICENSE) [](https://go.dev/) [](https://modelcontextprotocol.io/)
CodeLocal is a universal MCP layer for AI coding. It connects ChatGPT, Codex, Claude and other MCP-compatible clients to one durable Project Brain plus controlled access to the project folders you explicitly authorize on your own machine.
The model reasons. CodeLocal remembers, routes and executes.
Why CodeLocal
Most AI coding tools treat each chat, client or machine as a fresh start. CodeLocal is designed around the opposite idea: your project intelligence should survive the interface you happen to use today.
- One Project Brain — preserve verified decisions, project context, rules, Experience and reusable skills.
- Any compatible AI client — use ChatGPT, Codex, Claude or another MCP-capable agent against the same project intelligence.
- Controlled local execution — files, Git, terminal and optional automation run against workspaces you explicitly authorize.
- Multi-workspace by design — one local runtime can keep many projects available and activate them lazily.
- Local-first source access — repository source and local indexes stay on your machine by default; Cloud is used for identity, routing and sanitized durable continuity.
We are not trying to rebuild Codex, Claude Desktop, DeepSeek Harness, Cursor or another AI coding client. AI clients are interfaces. CodeLocal is the shared intelligence and execution layer behind them.
How it works
You ↓ MCP-compatible AI clients ChatGPT · Codex · Claude · other agents ↕ MCP over HTTPS + OAuth CodeLocal Project Brain durable rules · decisions
4a083f8b551dOBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add web --env ALLOW_LEGACY_DEVICE_TOKEN=${ALLOW_LEGACY_DEVICE_TOKEN} --env CODELOCAL_CREDENTIAL_FILE=${CODELOCAL_CREDENTIAL_FILE} --env CODELOCAL_DEVICE_AUTH_SECRET=${CODELOCAL_DEVICE_AUTH_SECRET} --env CODELOCAL_TEST_SECRET=${CODELOCAL_TEST_SECRET} -- npx -y @codelocal/[email protected]{
"mcpServers": {
"web": {
"command": "npx",
"args": [
"-y",
"@codelocal/[email protected]"
],
"env": {
"ALLOW_LEGACY_DEVICE_TOKEN": "${ALLOW_LEGACY_DEVICE_TOKEN}",
"CODELOCAL_CREDENTIAL_FILE": "${CODELOCAL_CREDENTIAL_FILE}",
"CODELOCAL_DEVICE_AUTH_SECRET": "${CODELOCAL_DEVICE_AUTH_SECRET}",
"CODELOCAL_TEST_SECRET": "${CODELOCAL_TEST_SECRET}"
}
}
}
}Exposed tools (2)
2 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
CodeLocal | read | AI coding workspace connected to your authorized local runtime. |
mcp_call | read |
Trust audit
BLOCKgrade F · trust 48/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (7 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (6 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
for _, pattern := range []string{"authorization: bearer", "-----begin private key-----", "api_key=", "apikey=", "access_token=", "refresh_token=", "token=", "secret=", "password=", "client_secret", "pExec(context.Context, string, ...any) (pgconn.CommandTag, error)
try { const dynamicImport = new Function("m", "return import(m)") as (m: string) => Promise<any>; await dynamicImport("node-pty"); pty = true; } catch {}const result = await exec(command, args, root, 4000);
const dynamicImport = new Function("m", "return import(m)") as (module: string) => Promise<any>;const dynamicImport = new Function("m", "return import(m)") as (m: string) => Promise<any>;for _, marker := range []string{"/.git/", "/.ssh/", "/.aws/", "/.gnupg/", "/.gcloud/", "/.azure/"} {for _, marker := range []string{"/.ssh/", "/.aws/", "/.gnupg/", "/.gcloud/", "/.azure/"} {dirtySinceVerify = false
REDIS_URL=redis://default:password@host:6379/0
- Tool execution still passes through CodeLocal MCP call policy/approval boundaries; using the hosted backend does not bypass action safety.
ARG CODELOCAL_BACKEND_URL=http://127.0.0.1:3333
endpoint := "http://127.0.0.1:" + strconv.Itoa(port)
const token = "test-account-token-not-a-real-credential";
const secret = "0123456789abcdef0123456789abcdef"
const token = "probe-secret-123456789"
input := "before\n-----BEGIN PRIVATE KEY-----\nsecret\n-----END PRIVATE KEY-----\nafter"
assert.equal(classifyCommand("cat ~/.ssh/id_rsa").blocked, true);_, err := blogMediaSlots("", json.RawMessage(`[{"type":"image","assetId":"../../secret"}]`))if got := safeMarkerProjectID("../../other-user"); got != "" {for _, input := range []string{"../secret", "/Users/example/repo", "../../other"} {"../../unsafe model": dashboardModelAuto,
writeKnowledgeFixture(t, web, "src/index.ts", "import { authenticate } from '../../backend/auth/api'\nexport function loginClient() { return authenticate() }\n")t.Fatalf("opaque secret declaration must never override exfiltration block: %#v", blockedDecision)t.Fatalf("direct secret exfiltration %q must remain blocked: %#v", command, decision)Gates applied: critical_finding, instruction_override, no_behavioural_pass.
4a083f8b551dfull audit observations/trust-audit/mcp-server/codelocal-cloud__codelocal.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 4a083f8b551d | BLOCK | F | 48 | first audit |
Questions
What is the codelocal MCP server?
The open-source Project Brain for AI coding. Connect ChatGPT, Codex, Claude and MCP-compatible agents to your projects, local tools and persistent knowledge. Fork it, build with it, and help shape the open AI development stack. 🧠⚡
What tools does codelocal expose?
2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is codelocal safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (48/100) and found 11 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does codelocal need?
It reads ALLOW_LEGACY_DEVICE_TOKEN, CODELOCAL_CREDENTIAL_FILE, CODELOCAL_DEVICE_AUTH_SECRET, CODELOCAL_TEST_SECRET, DEVICE_TOKEN, MCP_AUTH_SECRET, MCP_USER_PASSWORD and VBEE_ACCESS_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does codelocal run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @codelocal/web at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (4a083f8b551d), read on 2026-10-12. The repository is watched and re-audited when it changes.