codemcpBLOCK
CodeMCP is a workspace-aware execution, context, and agent orchestration server for AI clients.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
CodeMCP is a workspace-aware execution, context, and agent orchestration server for AI clients.
Single Go binary · OpenAI Secure MCP Tunnel · Linux, macOS, and Windows
[](https://github.com/mewisme/codemcp/releases/latest) [](https://github.com/mewisme/codemcp/actions/workflows/ci.yml) [](go.mod) [](LICENSE)
Get started · MCP profiles · Security · Documentation
CodeMCP runs locally and gives supported AI clients controlled access to explicitly registered projects. For ChatGPT, the primary path is OpenAI Secure MCP Tunnel: the local runtime makes an outbound connection to OpenAI, so the MCP server does not need a public inbound endpoint. Generic MCP clients can use the same runtime through local stdio or Streamable HTTP.
Overview
One runtime owns canonical feature execution. Workspace scope and permissions constrain host access, while instruction context, approvals, local control surfaces, Telegram, and managed integrations feed the same runtime. MCP profiles only change the client-facing projection:
- OpenAI profile — used by O
0d17e9a38500OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add admin -- npx -y [email protected]
{
"mcpServers": {
"admin": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (3)
3 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
long_schema | read | Schema overflow regression |
quality_fixture_tool | read | A deliberately long schema fixture used to verify detail scrolling and keyboard navigation. |
read_file | read | Read one file |
Trust audit
BLOCKgrade F · trust 49/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | FAIL |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (13 observation(s))
- Shell
- declared (6 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
verify-windows-setup-payload.sh
func (m *Manager) Eval(ctx context.Context, workspaceID, workspaceRoot, code string, timeout time.Duration) (EvalResult, error) {func (m *Manager) Exec(ctx context.Context, workspaceID, command string) (ExecResult, error) {string(semantic.RiskCritical): "Severe or clearly dangerous effects such as systemic destruction, credential/security compromise, broad exfiltration, or irreversible high-impact damage.",
const adminURL = "http://127.0.0.1:4473"
const miniAppURL = "http://127.0.0.1:4474/mini-app.html"
return <div className="space-y-4"><div className="grid gap-4 md:grid-cols-2"><Field label="URL"><Input required placeholder="http://127.0.0.1:3000/mcp" value={server.url || ""} onChange={(event) => upconst secret = "sk-browser-ui-secret-never-persist"
return json({ token: "mcp_test_one_time_secret", status: authStatus })const secret = "sk-runtime-manual-never-persist"
const secret = "approval-explain-super-secret"
cfg.Tunnel.APIKey = "runtime-secret-for-test"
streamable-http
.goreleaser.yaml
.pre-commit-config.yaml
.prettierignore
.prettierrc.json
badPaths := []string{"../escape", "/absolute", "C:/volume", "dir\\file", "SKILL.md", "a/../../escape"}got, err := os.ReadFile("../../frontend/src/lib/operation-presentation.generated.ts")for _, value := range []string{"../cm", "../../home/user/.cm/state", "C:/cm", "//server/share"} {const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../..")
"https://169.254.169.254/latest/meta-data/",
"https://169.254.169.254/latest/meta-data/",
if IsPublicIP(net.ParseIP("169.254.169.254")) {{ID: "meta", Transport: "http", URL: "https://169.254.169.254/latest/meta-data/"},Gates applied: no_behavioural_pass.
0d17e9a38500full audit observations/trust-audit/mcp-server/mewisme__codemcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 0d17e9a38500 | BLOCK | F | 49 | first audit |
Questions
What is the codemcp MCP server?
CodeMCP is a workspace-aware execution, context, and agent orchestration server for AI clients.
What tools does codemcp expose?
3 in total: 3 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is codemcp safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (49/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does codemcp need?
No credential environment variables were found in its source, so it appears to need none.
How does codemcp run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as admin at 0.0.1.
How current is this page?
The grade is for one exact copy of the source (0d17e9a38500), read on 2026-10-11. The repository is watched and re-audited when it changes.