Atlas / MCP servers / lennix1337 / GeneXus 18

GeneXus 18BLOCK

Name: GeneXus 18
Author: lennix1337

mcp/lennix1337/genexus-18

MCP server by lennix1337 · ai agent · ai agents · ai tools · Audited 2026-10-08

GeneXus MCP server with native SDK support for GeneXus 16–18 plus basic legacy compatibility for GeneXus 8, 9, 10.1–10.3, and 15 via reflection/COM drivers.

Verdict

BLOCK

Grade

Trust score

33 /100

Exposed tools

76 71r · 2w · 3d

Transport

stdio · streamable-http

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://www.npmjs.com/package/genexus-mcp) [](https://www.npmjs.com/package/genexus-mcp) [](https://opensource.org/licenses/MIT) [](https://safeskill.dev/scan/lennix1337-genexus18mcp) [](https://lobehub.com/mcp/lennix1337-genexus18mcp)

¿Hablás español? → Guía de inicio en español Fala português? → Guia de início em português Stuck? → Troubleshooting guide

GeneXus MCP Server lets AI agents — Claude Desktop, Claude Code, Cursor, Antigravity, and any MCP-compatible client — read, edit, analyze, and refactor objects inside a Knowledge Base supported by the selected native SDK or legacy compatibility driver. Native SDK paths work with the real GeneXus SDK and legacy paths use explicit reflection/COM adapters; neither path relies on a parsed copy of the KB.

In practice: you point the MCP at your KB, then ask your AI assistant things like "list all transactions with attribute CustomerId", "add a rule to the Order transaction that validates the total", or "refactor this procedure to use the new SDT" — and it does it.

Multi-version GeneXus support

The same MCP distribution supports the official native SDK majors listed in the generated compatibility document. It also includes basic, best-effort compatibility for the legacy versions listed there through separate drivers; that path is not equivalent to full native-SDK support. A process can route each declared KB to its own SDK/driver; --gx remains the convenient

Read from source at commit f14e66e3ca4bOBSERVED · 2026-10-08

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code (npm)

claude mcp add genexus-mcp -- npx -y [email protected]

Exposed tools (76)

71 read · 2 write · 3 destructive. Blast radius: 3 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`Add`	write	Adds an item to the collection.
`AddDays`	read	Adds days.
`AddSeconds`	read	Adds seconds.
`Audio`	read	Audio asset reference.
`Blob`	read	Binary Large Object.
`BlobFile`	read	Reference to a file stored in a folder.
`Boolean`	read	Logical value (True/False).
`CharAt`	read	Returns the character at the specified index.
`Character`	read	Fixed-length character string.
`Clear`	destructive	Removes all items from the collection.
`Contains`	read	Checks if the string contains a substring.
`Count`	read	Returns the number of items in the collection.
`DAdd`	read	Adds a number of days to a Date or DateTime value.
`DDiff`	read	Returns the difference in days between two Date or DateTime values.
`Date`	read	Date value.
`DateTime`	read	Date and time value.
`Day`	read	Returns the day.
`Default`	read	Assigns a default value to an attribute or variable.
`EndsWith`	read	Checks if the string ends with a substring.
`Error`	read	Displays an error message and stops execution if a condition is met.
`FromJson`	read	Loads the collection from a JSON string.
`FromString`	read	Parses a string into a numeric value.
`GUID`	read	Globally Unique Identifier.
`HTMLClean`	read	Cleans HTML content.
`Hidden`	read	Hides an attribute in the form.
`Hour`	read	Returns the hour.
`If`	read	Conditional execution block.
`Iif`	read	Returns one of two values depending on the result of a logical expression.
`Image`	read	Image asset reference.
`IndexOf`	read	Finds substring position.
`IsEmpty`	read	Checks if a value is empty (null or zero/blank).
`IsMatch`	read	Checks if the string matches a regular expression.
`IsNull`	read	Checks if a value is null.
`Item`	read	Returns an item from the collection by index.
`LastIndexOf`	read	Returns the last index of a substring.
`Len`	read	Returns the length of a string.
`Length`	read	Returns string length.
`LongVarChar`	read	Large variable-length character string.
`Lower`	read	Converts a string to lowercase.
`Minute`	read	Returns the minute.
`Month`	read	Returns the month.
`Msg`	read	Displays a message to the user.
`New`	read	Creates a new record in a table.
`NoAccept`	read	Prevents editing of an attribute or variable.
`Now`	read	Returns the current date and time of the local machine.
`NullValue`	read	Returns the null value of a given expression or attribute.
`Numeric`	read	Numeric value with optional decimals.
`Order`	write	Specifies the order of records in a Transaction or Data Provider.
`Parm`	read	Defines the parameters of the object.
`Prompt`	read	Calls a prompt object for an attribute or variable.
`Ref`	read	Defines a referential integrity rule.
`Remove`	destructive	Removes an item from the collection by index.
`Replace`	read	Replaces all occurrences of a string within another string.
`Round`	read	Rounds the value.
`ServerNow`	read	Returns the current date and time of the application server.
`SetEmpty`	read	Sets to empty value.
`StartsWith`	read	Checks if the string starts with a substring.
`Str`	read	Converts a numeric value to a string.
`Sub`	read	Defines a subroutine.
`Substr`	read	Returns a substring from a string.
`TAdd`	read	Adds a number of seconds to a DateTime value.
`TDiff`	read	Returns the difference in seconds between two DateTime values.
`ToFormattedString`	read	Converts to formatted string.
`ToJson`	read	Returns a JSON representation of the collection.
`ToLower`	read	Converts to lowercase.
`ToString`	read	Converts to string.
`ToUpper`	read	Converts to uppercase.
`Today`	read	Returns the current date.
`Trim`	read	Removes leading and trailing spaces.
`Truncate`	destructive	Truncates decimals.
`Upper`	read	Converts a string to uppercase.
`Val`	read	Converts a string to a numeric value.
`VarChar`	read	Variable-length character string.
`Video`	read	Video asset reference.
`YMDtoD`	read	Returns a Date value from Year, Month, and Day.
`Year`	read	Returns the year.

Trust audit

BLOCKgrade F · trust 33/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (5 observation(s))
Network: declared (3 observation(s))
Shell: declared (3 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

CRITICALHard-coded secrets · secret.private_key · CWE-798, CWE-321

src/GxMcp.Worker.Tests/SecurityAuditServiceTests.cs:43

var hits = SecurityAuditService.ScanText("-----BEGIN RSA PRIVATE KEY-----\nMIIEvAIBADANBgkq\n-----END RSA PRIVATE KEY-----");

CRITICALHard-coded secrets · secret.private_key · CWE-798, CWE-321

src/GxMcp.Worker/Services/SecurityAuditService.cs:195

if (text.Contains("-----BEGIN RSA PRIVATE KEY-----") || text.Contains("-----BEGIN PRIVATE KEY-----"))

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

cli/lib/config.js:1049

if (/^(?:-e|-p|--eval(?:=|$)|--print(?:=|$)|--check(?:=|$))/.test(arg)) {

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHPrompt injection · prompt.credential_read · CWE-94, CWE-1427

.gemini/skills/nexa/SKILL.md:147

* Read `*.env.gx` to get environment name and generator

Why it matters. asks the agent to read credentials

HIGHPrompt injection · prompt.rtl_override · CWE-94, CWE-1427

docs/sdk-probe/INDEX.md:15245

- `+` — 0 methods, 0 props

Why it matters. bidirectional override can render text differently from how it is read

HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427

docs/sdk-probe/INDEX.md:15245

- `+` — 0 methods, 0 props

Why it matters. invisible characters in instruction text

Fix. strip non-printing characters

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

cli/commands/axi.js:408

const fallback = 'http://127.0.0.1:5000/mcp';