JavaLensSAFE
MCP server providing semantic Java code analysis for AI agents. Built on Eclipse JDT with tools for navigation, refactoring, search, and metrics.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/pzalutski-pixel/javalens-mcp/releases) [](LICENSE) [](https://openjdk.org/projects/jdk/21/)
An MCP server providing 75 semantic analysis tools for Java, built directly on Eclipse JDT for compiler-accurate code understanding.
Built for AI Agents
JavaLens exists because AI systems need compiler-accurate insights that reading source files cannot provide. When an AI uses grep or Read to find usages of a method, it cannot distinguish:
- A method call from a method with the same name in an unrelated class
- A field read from a field write
- An interface implementation from an unrelated class
- A cast to a type from other references to that type
This leads to incorrect refactorings, missed usages, and incomplete understanding of code behavior.
Compiler-Accurate Analysis
JavaLens provides compiler-accurate code analysis through Eclipse JDT—the same engine that powers Eclipse IDE. Unlike text search, JDT understands:
- Type resolution across inheritance hierarchies
- Method overloading and overriding
- Generic type arguments
- Import resolution and classpath dependencies
- Java source from version 1.1 through Java 25 (markdown Javadoc, module imports, compact source files, flexible constructor bodies)
- Lombok-generated members — a bundled agent makes
@Dataaccessors and the like resolve, so code using them is not flagged as undefined
Example: Finding all places where UserService.save() is called:
AI Training Bias Warning
⚠️ **Important for A
4a26264a4136OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add javalens-mcp -- npx -y [email protected]
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- none-observed
- Shell
- declared (2 observation(s))
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (3)
zip -r ../../../../javalens-${{ github.ref_name }}.zip javalens-${{ github.ref_name }}tar -czvf ../../../../javalens-${{ github.ref_name }}.tar.gz javalens-${{ github.ref_name }}Gates applied: no_behavioural_pass.
4a26264a4136full audit observations/trust-audit/mcp-server/pzalutski-pixel__javalens.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | 4a26264a4136 | SAFE | B | 89 | first audit |
Questions
What is the JavaLens MCP server?
MCP server providing semantic Java code analysis for AI agents. Built on Eclipse JDT with tools for navigation, refactoring, search, and metrics.
Is JavaLens safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does JavaLens need?
No credential environment variables were found in its source, so it appears to need none.
How does JavaLens run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as javalens-mcp at 1.3.0.
How current is this page?
The grade is for one exact copy of the source (4a26264a4136), read on 2026-10-08. The repository is watched and re-audited when it changes.