Atlas / MCP servers / jeremydev87 / Codingbuddy

CodingbuddyBLOCK

Name: Codingbuddy
Author: jeremydev87

mcp/jeremydev87/codingbuddy

MCP server by jeremydev87 · ai agents · ai coding · ai coding assistant · Audited 2026-10-08

Codingbuddy orchestrates 29 specialized AI agents to deliver code quality comparable to a team of human experts through a PLAN → ACT → EVAL workflow.

Verdict

BLOCK

Grade

Trust score

48 /100

Exposed tools

90 82r · 8w · 0d

Transport

sse · stdio · streamable-http

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

English | 한국어 | 中文 | 日本語 | Español

[](https://github.com/JeremyDev87/codingbuddy/actions/workflows/dev.yml) [](https://www.npmjs.com/package/codingbuddy) [](https://opensource.org/licenses/MIT)

Prove your AI coding is actually improving.

Codingbuddy is a multi-AI MCP server that orchestrates 37 specialist agents across 9 AI tools — and measures the impact on your code quality with every session.

What's New in v5.6.0 — HUD Statusbar Wave

Breathing Buddy Face — the buddy face reacts to your session phase (idle / thinking / active / blocked / victory) so the status bar feels alive.
Cost Velocity Indicator — session spend-rate badge with 🔥 / ↗ / → / 💤 trend glyphs tells you whether you're on a slow planning pass or a hot refactor burn.
Cache Savings Badge — quantifies prompt-cache discounts as 💰$N.NN saved so you see the value of caching in real time.
Mode Rainbow Coloring — per-mode ANSI truecolor gradients (PLAN ◇ / ACT ◆ / EVAL ◈ / AUTO ◊) with NO_COLOR env support for CI and greyscale terminals.
Smart Context Bar — visual [████░░░░░░] 42% progress bar replaces plain Ctx:42% text with warning and danger thresholds.
Adaptive Layout Engine — HUD fits narrow terminals gracefully with fit_segments adaptive truncation.
Rate-limit Severity Icons — visual warnings when you approach API rate limits.

Session Impact Report

At the end of every session, codingbuddy shows you what actually happened:

┌─────────────────────────────────────────────────┐
│            Session Impact Report                │
├─────

Read from source at commit fd8cebf5ab0bOBSERVED · 2026-10-08

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add codingbuddy-rules --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env API_KEY=${API_KEY} --env MCP_SSE_TOKEN=${MCP_SSE_TOKEN} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "codingbuddy-rules": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "API_KEY": "${API_KEY}",
        "MCP_SSE_TOKEN": "${MCP_SSE_TOKEN}"
      }
    }
  }
}

Exposed tools (90)

82 read · 8 write · 0 destructive.

Tool	Risk	Description
`Agent`	read	Description
`Changelog`	read	Project changelog with recent changes and version history
`Codingbuddy`	read	desc
`Default`	read	Generic project template
`Express`	read	Express.js backend API server
`FE`	read	d
`NestJS`	read	NestJS backend framework with dependency injection
`Next.js`	read	Next.js fullstack React framework with App Router
`Node.js`	read	Generic Node.js project (CLI tools, libraries, etc.)
`React`	read	React frontend application (Vite, CRA, etc.)
`Test`	read	Test agent
`activate`	read	One-shot entry point for collective intelligence workflow.
`activate_agent`	read	Activate a specific specialist agent with project context
`agent-discussion`	read	Internal agent discussion skill
`agent_discussion`	read	Structured specialist discussion for collective intelligence workflows.
`analyze_file`	read	Analyze a source file for code quality metrics including complexity,
`analyze_task`	read	[DEPRECATED — Use activate + /dream instead] Analyze a task to provide contextual recommendations including risk assessment, relevant checklists, specialist recommendations, and workflow suggestions.
`api-design`	read	API design patterns
`api-development`	read	API development stack
`architecture`	read	Architecture specialist
`auto`	read	Auto-generated Teams coordination layer
`bad-regex-skill`	read	Skill with invalid regex
`brainstorming`	read	Explore design options through collaborative dialogue
`cleanup_context`	write	Manually trigger context document cleanup at ${CONTEXT_FILE_PATH}. Summarizes older sections to reduce document size while preserving recent history. Normally happens automatically when size thresholds are exceeded, but can be called manually if needed.
`cleanup_context_archives`	read	Auto-cleanup old archived contexts. Archives older than the specified days are summarized into _summary.md and deleted. Keeps recent archives intact.
`create_briefing`	write	[DEPRECATED — Use Claude Code Memory for cross-session context] Capture current session state into a briefing document for cross-session recovery.
`database-migration`	read	DB migration skill
`debugging`	read	Systematic debugging
`dispatch_agents`	read	Get Task-tool-ready dispatch parameters for agents. Returns structured data that can be directly used with Claude Code Task tool, eliminating manual prompt assembly. Use this to bridge the gap between agent recommendation and execution.
`docker-setup`	read	Docker configuration
`documentation-generation`	read	Generate documentation
`drifted-stack`	read	Stack with wrong field name
`enabled-skill`	read	Model invocation enabled skill
`eval-specialists`	read	EVAL mode specialist team
`executing-plans`	write	Execute implementation plans
`frontend-design`	read	Frontend design patterns
`frontend-review`	read	Frontend review stack
`full-stack`	read	Full-stack development team
`generate_checklist`	read	Generate contextual checklists based on file patterns and domains. Automatically detects relevant checklist items from security, accessibility, performance, testing, code-quality, and SEO domains based on file patterns and import analysis.
`get_agent_details`	read	Get detailed profile of a specific AI agent
`get_agent_system_prompt`	read	Get complete system prompt for a specialist agent to be executed as a Claude Code subagent. Use this to prepare an agent for parallel execution via Task tool.
`get_code_conventions`	read	Get project configuration including tech stack, architecture, conventions, and language settings
`get_context_history`	read	List recent archived context documents from ${ARCHIVE_DIR}/. Each archive is a previous session
`get_project_config`	read	Get project configuration including tech stack, architecture, conventions, and language settings
`get_rule_impact_report`	read	Generate a formatted markdown impact report showing rule effectiveness: top rules by usage, unused rules, domain coverage, estimated time saved, and trend analysis
`get_rule_insights`	read	Analyze accumulated rule tracking data to provide effectiveness insights: violation frequency, unused/redundant rules, trend analysis, and improvement suggestions
`get_session_impact`	read	Get impact summary for a session including events, issues prevented, agents dispatched, and checklists generated.
`get_skill`	read	Get skill content by name. Returns the full skill definition including name, description, and instructions content.
`git-workflow`	read	Git workflow management
`incident-response`	read	Incident response skill
`invocable-skill`	read	User invocable skill
`list_agent_stacks`	read	List available agent stack presets. Each stack defines a primary agent and specialist combination for common workflows.
`list_skills`	read	List all available skills with optional filtering
`my-plugin`	read	A test plugin
`my_tool`	read	...
`no-role`	read	Missing required role field
`parse_mode`	read
`pipeline_status`	read	Get the status of a pipeline execution including stage results and progress.
`plain-skill`	read	No triggers
`pr_quality_report`	write	Run specialist agents on changed files and generate a Quality Report for PR description
`pre_release_check`	read	Comprehensive pre-release validation. Auto-detects project language and checks version sync, lockfile consistency, and manifest validity.
`prepare_parallel_agents`	read	Prepare multiple specialist agents for parallel execution via Claude Code Task tool. Returns prompts and hints for launching agents concurrently.
`recommend_skills`	read	Recommend skills based on user prompt with multi-language support.
`refactoring`	read	Code refactoring
`restart_tui`	write	Restart the TUI client when it becomes unresponsive or shows a blank screen.
`resume_pipeline`	read	Resume a failed pipeline from the failed stage. Preserves completed stage results and re-executes from the failure point.
`resume_session`	read	[DEPRECATED — Use Claude Code Memory for session resume] Load a previous session briefing to restore context and continue work.
`review_pr`	read	Fetch PR metadata, diff, checklists, and specialist recommendations for EVAL-mode PR review. Returns structured data for comprehensive code review.
`role`	read	Role name (e.g. frontend-developer)
`run_pipeline`	write	Run a sequential task pipeline. Stages execute in order, with each stage receiving the previous stage output as input.
`search_context_archives`	read	Search across all archived context documents by keyword. Finds past decisions, notes, and tasks from previous sessions. Returns matching lines with surrounding context.
`search_rules`	read	Search for rules and guidelines
`security-audit`	read	Security audit skill
`set_project_root`	write	[DEPRECATED - Will be removed in v2.0.0] Set the project root directory. Use this when the MCP server is launched from a different directory than the target project. RECOMMENDED: Configure project root in mcp-servers settings or use --project-root CLI flag instead.
`solution-architect`	read	Test description
`suggest_config_updates`	read	Analyze the project and suggest config updates based on detected changes (new frameworks, dependencies, patterns)
`suggest_rules`	read	Analyze execution history for repeated failure patterns and generate draft rule suggestions.
`systematic-debugging`	read	Debug systematically
`tdd`	read	Test-driven development
`test`	read	test
`test-agent`	read	A test agent
`test-driven-development`	read	TDD workflow
`test-skill`	read	Test skill
`test_tool`	read	Test tool for unit testing
`validate_parallel_issues`	read	Validate whether GitHub issues can be safely executed in parallel by checking file overlap.
`validate_plugin_manifest`	read	Validate a Claude Code plugin manifest (plugin.json) against the known schema. Returns validation results with actionable fix suggestions.
`widget-slot-architecture`	read	Next.js Parallel Routes Widget Slot pattern
`writing-plans`	write	Create comprehensive implementation plans
`ws`	read	team
`ws-1`	read	team

Trust audit

BLOCKgrade F · trust 48/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (5 observation(s))
Network: declared (4 observation(s))
Shell: declared (9 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

apps/mcp-server/src/shared/esm-import.ts:31

const dynamicImport = new Function('s', 'return import(s)') as (

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/claude-code-plugin/hooks/lib/rule_checker.py:119

"Dangerous eval() call — arbitrary code execution risk",

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHPrompt injection · prompt.credential_read · CWE-94, CWE-1427

packages/rules/.ai-rules/skills/tmux-master/SKILL.md:363

# Read an environment variable

Why it matters. asks the agent to read credentials

MEDIUMInventory / provenance · inv.binary · CWE-1104

apps/mcp-server/.yarn/install-state.gz

install-state.gz

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

packages/claude-code-plugin/hooks/tests/test_rule_checker.py:136

code = 'API_KEY = "sk-1234567890abcdef1234567890abcdef"'

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

packages/claude-code-plugin/hooks/tests/test_rule_checker.py:141

code = 'password = "my_super_secret_password"'

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

packages/claude-code-plugin/hooks/tests/test_rule_checker.py:245

"content": 'SECRET = "hardcoded_secret_value_12345678"',

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

packages/claude-code-plugin/hooks/tests/test_rule_checker.py:279

API_KEY = "sk-proj-real-secret-key-1234567890ab"

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

packages/claude-code-plugin/hooks/tests/test_rule_checker.py:311

code = 'API_KEY = "sk-1234567890abcdef1234567890abcdef"'

LOWInventory / provenance · inv.hidden_file · CWE-1104

.markdownlint.json

.markdownlint.json

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.prettierignore

.prettierignore

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.yarnrc.yml

.yarnrc.yml

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

apps/landing-page/.prettierignore

.prettierignore

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

apps/mcp-server/.vercelignore

.vercelignore

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.symlink · CWE-1104

SECURITY.md

SECURITY.md

Why it matters. link not followed

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

apps/mcp-server/src/context/context-serializer.utils.spec.ts:116

expect(content).toContain('## EVAL (12:00)');

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

apps/mcp-server/src/keyword/keyword.service.spec.ts:194

it('parses eval (lowercase)', async () => {

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

apps/mcp-server/src/keyword/keyword.service.spec.ts:445

it('parses evaluar as EVAL (lowercase)', async () => {

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59

packages/claude-code-plugin/src/utils.spec.ts:209

expect(isPathSafe('/root/.ssh/id_rsa')).toBe(false);