ModelsAtlas
Explore
Atlas / MCP servers / codescene-oss / CodeScene

CodeSceneBLOCK

mcp/codescene-oss/codescene
MCP server by codescene-oss · Audited 2026-10-07
⚑ Report / re-scanSource ↗

The CodeScene MCP Server exposes CodeScene’s Code Health analysis as local AI-friendly tools.

Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
—
Transport
stdio
License
NOASSERTION
Stars
66
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://codescene.io/projects/72556) [](https://codescene.io/projects/72556) [](https://codescene.io/projects/72556)

The CodeScene MCP Server exposes CodeScene's Code Health analysis as local AI-friendly tools.

This server is designed to run in your local environment and lets AI assistants (like GitHub Copilot, Cursor, Claude code, etc.) request meaningful Code Health insights directly from your codebase. The Code Health insights augment the AI prompts with rich content around code quality issues, maintainability problems, and technical debt in general.

The repository also includes a downloadable set of public agent skills in skills/ for teams that want to reuse CodeScene MCP workflows in their own agentic pipelines.

Getting Started with CodeScene MCP

Want AI to perform the setup? Start with skills/installing-and-activating-codescene-mcp/SKILL.md.

  1. Setting up Authentication to the MCP Server — see Authentication.
  2. Install the MCP Server using one of the installation options below.
  3. Add the MCP Server to your AI assistant. See the detailed instructions for your environment in the installation guide.
  4. Copy the agent guidance that matches your license into your repository: AGENTS-full.md for CodeScene Core users, AGENTS-standalone.md for standalone license users, or .amazonq/rules for Amazon Q. Also copy any relevant public skills for reusable workflow prompts.
  5. Explore the [available tools](d
Read from source at commit b59cb85d0123OBSERVED · 2026-10-07
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code (npm)
claude mcp add codehealth-mcp -- npx -y @codescene/[email protected]
03

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (4 observation(s))
Network
declared (4 observation(s))
Shell
declared (2 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (19)

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
src/errors.rs:180
stderr: "secret token=abc123 /home/user/.ssh/id_rsa".into()
Why it matters. touches a credential store
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
src/config/validation.rs:173
assert!(validate_https_url("onprem_url", "http://127.0.0.1").is_ok());
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
src/config/validation.rs:174
assert!(validate_https_url("onprem_url", "http://127.0.0.1:8080").is_ok());
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
src/config/validation.rs:175
assert!(validate_https_url("onprem_url", "http://127.0.0.1/path").is_ok());
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
src/config/validation.rs:180
assert!(validate_https_url("onprem_url", "http://0.0.0.0").is_ok());
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
tests/e2e/tests/configure.rs:165
let token = "super-secret-token-12345";
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
tests/e2e/tests/standalone_license.rs:103
let token = "cst_fake_pat_for_integration_test";
LOWInventory / provenance · inv.hidden_file · CWE-1104
npm/.c8rc.json
.c8rc.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
vscode/.vscodeignore
.vscodeignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
mcp-apps/usage-overview/vite.config.ts:10
outDir: "../../src/docs/apps",
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/e2e/main.rs:320
include_str!("../../docs/AGENTS-full.md"),
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/e2e/tests/analytics_tracking.rs:293
Some(include_str!("../../../docs/AGENTS-full.md")),
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/mcp-apps/usage-overview-config.test.ts:4
import viteConfig from "../../mcp-apps/usage-overview/vite.config";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/mcp-apps/usage-overview.test.tsx:8
import { App, Dashboard, dashboardData, recentActivity } from "../../mcp-apps/usage-overview/src/main";
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
npm/tests/download.test.js:71
resolve(`http://127.0.0.1:${addr.port}`);
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
mcp-apps/usage-overview/package.json
@modelcontextprotocol/ext-apps, @modelcontextprotocol/sdk, react, react-dom, @testing-library/react, @types/react, @types/react-dom, @vitejs/plugin-react
Why it matters. 14 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
npm/package.json
c8
Why it matters. 1 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
vscode/package.json
@types/node, @types/vscode, @vscode/vsce, c8, esbuild, typescript
Why it matters. 6 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWInventory / provenance · mcp.no_tools_extracted · CWE-1104
server.json
Why it matters. the tool list is enumerated at runtime by tools/list, not declared in source
Fix. the page says so rather than showing an empty table

Gates applied: no_behavioural_pass.

Audited 2026-10-07 · audit v0.4.1 · source sha b59cb85d0123full audit observations/trust-audit/mcp-server/codescene-oss__codescene.json · Report an issue / request a re-scan
04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-07b59cb85d0123BLOCKD69first audit
05

Questions

What is the CodeScene MCP server?

The CodeScene MCP Server exposes CodeScene’s Code Health analysis as local AI-friendly tools.

Is CodeScene safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What credentials does CodeScene need?

No credential environment variables were found in its source, so it appears to need none.

How does CodeScene run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as codescene-codehealth-mcp at 0.0.0.

How current is this page?

The grade is for one exact copy of the source (b59cb85d0123), read on 2026-10-07. The repository is watched and re-audited when it changes.

Advertisement