MentorSAFE
A Model Context Protocol server providing LLM Agents a second opinion via AI-powered Deepseek-Reasoning R1 mentorship capabilities, including code review, design critique, writing feedback, and idea brainstorming through the Deepseek API.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.typescriptlang.org/) [](https://modelcontextprotocol.io/) []() [](https://opensource.org/licenses/Apache-2.0) []() [](https://github.com/cyanheads/mentor-mcp-server)
A Model Context Protocol server providing LLM Agents a second opinion via AI-powered Deepseek-Reasoning (R1) mentorship capabilities, including code review, design critique, writing feedback, and idea brainstorming through the Deepseek API. Set your LLM Agent up for success with expert second opinions and actionable insights.
Model Context Protocol
The Model Context Protocol (MCP) enables communication between:
- Clients: Claude Desktop, IDEs, and other MCP-compatible clients
- Servers: Tools and resources for task management and automation
- LLM Agents: AI models that leverage the server's capabilities
Table of Contents
- Features
- Installation
- Configuration
- Tools
- Examples
- Development
- Project Structure
- License
Features
Code Analysis
- Comprehensive code reviews
- Bug detection and prevention
- Style and best practices evaluation
- Performance optimization suggestions
- Security vulnerability assessment
Design & Architecture
- UI/UX design critiques
- Architectural diagram analysis
- Design pattern recommendations
- Accessibility evaluation
- Consistency checks
Content Enhancement
- Writing feedback and improvement
- Grammar and style analysis
- Documentation review
- Content cl
94135ece8c4eOBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mentor-mcp-server --env DEEPSEEK_API_KEY=${DEEPSEEK_API_KEY} --env DEEPSEEK_MAX_TOKENS=${DEEPSEEK_MAX_TOKENS} -- npx -y [email protected]{
"mcpServers": {
"mentor-mcp-server": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"DEEPSEEK_API_KEY": "${DEEPSEEK_API_KEY}",
"DEEPSEEK_MAX_TOKENS": "${DEEPSEEK_MAX_TOKENS}"
}
}
}
}Exposed tools (5)
5 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
brainstorm_enhancements | read | Generates creative ideas for improving a given concept, product, or feature, focusing on innovation, feasibility, and user value. |
code_review | read | Provides a code review for a given file or code snippet, focusing on potential bugs, style issues, performance bottlenecks, and security vulnerabilities. |
design_critique | read | Offers a critique of a design document, UI/UX mockup, or architectural diagram, focusing on usability, aesthetics, consistency, accessibility, and potential design flaws. |
second_opinion | read | Provides a second opinion on a user\ |
writing_feedback | read | Provides feedback on a piece of writing, such as an essay, article, or technical documentation, focusing on clarity, grammar, style, structure, and overall effectiveness. |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (6)
import type { LLMResponse, ChatMessage } from '../../types/index.js';import { config } from '../../config.js';import { sanitizeInput } from '../../utils/prompt.js';import type { ToolDefinition, BrainstormEnhancementsArgs, ToolResponse } from '../../types/index.js';import { makeDeepseekAPICall, checkRateLimit } from '../../api/deepseek/deepseek.js';@modelcontextprotocol/sdk, @types/node, axios, dotenv, typescript, openai
Gates applied: no_behavioural_pass.
94135ece8c4efull audit observations/trust-audit/mcp-server/cyanheads__mentor.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | 94135ece8c4e | SAFE | B | 89 | first audit |
Questions
What is the Mentor MCP server?
A Model Context Protocol server providing LLM Agents a second opinion via AI-powered Deepseek-Reasoning R1 mentorship capabilities, including code review, design critique, writing feedback, and idea brainstorming through the Deepseek API.
What tools does Mentor expose?
5 in total: 5 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Mentor safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Mentor need?
It reads DEEPSEEK_API_KEY and DEEPSEEK_MAX_TOKENS from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Mentor run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as mentor-mcp-server at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (94135ece8c4e), read on 2026-10-08. The repository is watched and re-audited when it changes.