codesightCAUTION
Universal AI context generator. Saves thousands of tokens per conversation in Claude Code, Cursor, Copilot, Codex, and more.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Your AI assistant wastes thousands of tokens every conversation just figuring out your project. codesight fixes that in one command.
4,000+ downloads and counting.
Zero dependencies. AST precision. 30+ framework detectors. 14 ORM parsers. 14 MCP tools. One `npx` call.
Works with TypeScript, JavaScript, Python, Go, Ruby, Elixir, Java, Kotlin, Rust, PHP, Dart, Swift, C#, and BrightScript/BrighterScript ( Roku). TypeScript projects get full AST precision. Everything else uses battle-tested regex detection across the same 30+ frameworks.
[](https://www.npmjs.com/package/codesight) [](https://www.npmjs.com/package/codesight) [](https://www.npmjs.com/package/codesight) [](https://github.com/Houseofmvps/codesight/stargazers) [](LICENSE)
[](https://x.com/kaileskkhumar) [](https://www.linkedin.com/in/kailesk-khumar) [](https://houseofmvps.com) [](https://www.kailxlabs.co)
**Built by [Kailesk Kh
36a71636268dOBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add test --env API_KEY=${API_KEY} --env SECRET=${SECRET} -- npx -y test{
"mcpServers": {
"test": {
"command": "npx",
"args": [
"-y",
"test"
],
"env": {
"API_KEY": "${API_KEY}",
"SECRET": "${SECRET}"
}
}
}
}Exposed tools (14)
13 read · 0 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
codesight_get_blast_radius | read | Blast radius analysis. Given a file (or list of files), returns all transitively affected files, routes, models, and middleware. Use before making changes to understand impact. |
codesight_get_coverage | read | Get test coverage summary: which routes and models have corresponding tests. Shows coverage percentage and lists uncovered endpoints. |
codesight_get_env | read | Get environment variables across the codebase with required/default status and source file. |
codesight_get_events | read | Get event queues, Kafka topics, Redis pub/sub channels, and EventEmitter events detected in the project. Useful for understanding async data flows. |
codesight_get_hot_files | read | Get the most-imported files in the project. These have the highest blast radius — changes here affect the most other files. |
codesight_get_knowledge | read | Get the knowledge map for a second-brain or docs folder: decisions made, open questions, recurring themes, people mentioned, and an index of all notes by type (ADR, meeting, retro, spec, etc.). Run |
codesight_get_routes | read | Get API routes with methods, paths, params, tags, and handler files. Supports filtering by prefix, tag, or HTTP method. |
codesight_get_schema | read | Get database models with fields, types, constraints, and relations. Optionally filter by model name. |
codesight_get_summary | read | Compact project summary (~500 tokens). Stack, key stats, high-impact files, required env vars. Use this first before diving deeper. |
codesight_get_wiki_article | read | Read a specific wiki article by name. Each article covers one subsystem in narrative form (~300-500 tokens). Use for targeted questions: |
codesight_get_wiki_index | read | Get the wiki index (~200 tokens). Lists all available wiki articles with one-line summaries. Read this at session start for instant project orientation. If wiki not generated, run |
codesight_lint_wiki | read | Health check the wiki. Finds orphan articles, missing cross-links, and articles that may be stale. Run after making significant changes to verify wiki integrity. |
codesight_refresh | destructive | Force re-scan the project. Use after making significant changes to get updated context. |
codesight_scan | read | Full codebase scan. Returns complete AI context map with routes, schema, components, libraries, config, middleware, and dependency graph. Use this for initial project understanding. |
Trust audit
CAUTIONgrade B · trust 86/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (7 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (17)
codesight-reference-ast.wasm
console.log(` Token budget: trimmed to ~${estimatedTokens} tokens (limit: ${maxTokens})`);const exFiles = files.filter((f) => f.endsWith(".ex") || f.endsWith(".exs"));for (const file of exFiles) {codesight_refresh
.gitmodules
return createHash("sha1").update(content).digest("hex").slice(0, 12);import type { CodesightPlugin, ProjectInfo } from "../../types.js";import type { CodesightPlugin, ProjectInfo } from "../../types.js";import type { CodesightPlugin, ProjectInfo } from "../../types.js";import type { CodesightPlugin, ProjectInfo } from "../../types.js";const { parseYAML } = await import("../../dist/plugins/cicd/yaml-parser.js");@types/node, tsx, typescript
celery, redis
celery
django
drizzle-orm
Gates applied: no_behavioural_pass.
36a71636268dfull audit observations/trust-audit/mcp-server/houseofmvps__codesight.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 36a71636268d | CAUTION | B | 86 | first audit |
Questions
What is the codesight MCP server?
Universal AI context generator. Saves thousands of tokens per conversation in Claude Code, Cursor, Copilot, Codex, and more.
What tools does codesight expose?
14 in total: 13 read-only, 0 that write, and 1 that can delete or overwrite (codesight_refresh). Every one is listed on this page with its risk.
Is codesight safe to connect to an agent?
With care. The audit graded it B (86/100) and found 17 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does codesight need?
It reads API_KEY and SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (36a71636268d), read on 2026-10-12. The repository is watched and re-audited when it changes.