Claude CodeSAFE
MCP Server connects with claude code local command.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
⚠️ Maintenance Ended (2026-08-25)
This project is no longer maintained. No further updates, including security fixes, will be made. The repository has been archived and the npm package has been marked as deprecated. Existing installations will continue to work, but use at your own risk — dependency vulnerabilities reported after this date will not be addressed.
If you need equivalent functionality, please fork the repository or look for actively maintained alternatives.
[0.1.9] - 2026-03-06
Security Update
- Add pnpm overrides to pin transitive dependencies to patched versions.
hono^4.12.4 (fixes serveStatic path traversal, SSE CRLF injection, Cookie attribute injection, basicAuth/bearerAuth timing)@hono/node-server>=1.19.10 (fixes authorization bypass via encoded slashes)ajv>=8.18.0 (fixes ReDoS with$dataoption)qs>=6.14.2 (fixes DoS via arrayLimit bypass)
[0.1.8] - 2026-02-05
Security Update
- Update @modelcontextprotocol/sdk version.
- Add zod dependency to satisfy peer dependency requirements.
- Bump TypeScript version for compatibility with updated dependencies.
Overview
The claude-code-mcp project is an MCP server for Claude Code.
It calls the locally installed Claude Code command and provides the following tools: explain_code, review_code, fix_code, edit_code, test_code, simulate_command, and your_own_query. The server is implemented using Node.js and the MCP SDK, receiving JSON format requests from clients via stdio. Internally, it adopts Base64 encoding to smoothly process special characters (newlines, quotation marks, etc.) in natural language text, resulting in improved stability and flexibility. Its main roles are receiving requests, encoding input, generating and executing commands, and returning execution results in JSON format. This project has been confirmed to work in Claude Code CLI environments (Ubuntu/WSL2, etc.).
9daa1628b55fOBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add claude-code-mcp -- npx -y @kunihiros/[email protected]
{
"mcpServers": {
"claude-code-mcp": {
"command": "npx",
"args": [
"-y",
"@kunihiros/[email protected]"
]
}
}
}Exposed tools (7)
6 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
edit_code | write | Edits the given code based on instructions. |
explain_code | read | Provides detailed explanation of the given code. |
fix_code | read | Fixes bugs or issues in the given code. |
review_code | read | Reviews the given code. |
simulate_command | read | Simulates the execution of a given command. |
test_code | read | Generates tests for the given code. |
your_own_query | read | Sends a custom query with context. |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (4 observation(s))
- Network
- none-observed
- Shell
- declared (2 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (5)
path.resolve(__dirname, '../../.env'), // ビルド後の環境
const projectLogPath = path.resolve(__dirname, '../../claude-code-server.log');
path.resolve(__dirname, '../../.env'), // ビルド後の環境
const projectLogPath = path.resolve(__dirname, '../../claude-code-server.log');
@modelcontextprotocol/sdk, dotenv, winston, zod, @types/dotenv, @types/node, typescript
Gates applied: no_behavioural_pass.
9daa1628b55ffull audit observations/trust-audit/mcp-server/kunihiros__claude-code-1.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | 9daa1628b55f | SAFE | B | 89 | first audit |
Questions
What is the Claude Code MCP server?
MCP Server connects with claude code local command.
What tools does Claude Code expose?
7 in total: 6 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Claude Code safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Claude Code need?
No credential environment variables were found in its source, so it appears to need none.
How does Claude Code run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @kunihiros/claude-code-mcp at 0.1.9.
How current is this page?
The grade is for one exact copy of the source (9daa1628b55f), read on 2026-10-08. The repository is watched and re-audited when it changes.