CodeSampleXBLOCK
An open compatibility testing network: does this library API actually run on your version, OS and runtime? Real build evidence, verified samples, and the environment each result came from.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/r2cuerdame/CodeSampleX/releases/latest) [](https://github.com/r2cuerdame/CodeSampleX/releases) [](https://github.com/r2cuerdame/CodeSampleX/blob/main/LICENSE) [](DATA_TERMS.md) [](https://github.com/r2cuerdame/CodeSampleX/actions/workflows/release.yml) [](https://github.com/r2cuerdame/CodeSampleX/blob/main/go.mod)
Tested. Not guessed.
Languages: English · 한국어 · 日本語 · 简体中文 · Español · Français · Deutsch · Português (BR) · Русский
CodeSampleX is an open compatibility testing network for developer libraries, runtimes and toolchains. It does not summarize documentation and it does not collect anecdotes. It records what real builds actually did, in environments recorded rather than assumed — then shows you where things worked, where they broke, and in which environment.
Two things are the asset, and a third is a bonus:
- Evidence — real builds on real developer machines, with the environment, stage, structured termination, and secret-safe normalized failure fingerprint. Missing or legacy failure detail is shown as an Evidence gap, never invented
306d4ed0bd53OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add csx-sample-axios-upload --env API_KEY=${API_KEY} --env API_TOKEN=${API_TOKEN} --env DB_PASSWORD=${DB_PASSWORD} --env EMPTY_TOKEN=${EMPTY_TOKEN} -- npx -y [email protected]{
"mcpServers": {
"csx-sample-axios-upload": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"API_KEY": "${API_KEY}",
"API_TOKEN": "${API_TOKEN}",
"DB_PASSWORD": "${DB_PASSWORD}",
"EMPTY_TOKEN": "${EMPTY_TOKEN}"
}
}
}
}Exposed tools (1)
1 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
convert_temperature | read |
Trust audit
BLOCKgrade F · trust 27/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (4 observation(s))
- Shell
- declared (3 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
"exec(compile(" + repr(helper) + ", '<bounded-transport>', 'exec'), shared.__dict__)\n""exec(compile(" + repr(collector) + ", '<farm-sql-phases>', 'exec'))\n").encode("utf-8")"exec(compile(" + repr(helper) + ", '<bounded-transport>', 'exec'), shared.__dict__)\n"CSX_DSN: postgres://csx:e2e-only@db:5432/csx?sslmode=disable
typescript7 ~ typescript
- **Never tell the user you fixed or confirmed anything.** Reporting confirms
triages it — so never tell the user a bug has been filed, accepted or fixed.
client-correlated evidence the installed CLI captures. Do not tell the user that a footprint
# Public v1 E2E Report (goal.md §25)
__init__.cpython-310.pyc
compat.cpython-310.pyc
body=$(docker compose exec -T server wget -q -T 5 -t 1 -O- http://127.0.0.1:8080/healthz 2>/dev/null) || status=$?
served_body=$(run_probe served-revision docker compose exec -T server wget -q -T 5 -t 1 -O- http://127.0.0.1:8080/version)
docker compose exec -T server wget -q -T 5 -t 1 -O- http://127.0.0.1:8080/version |
match = re.fullmatch(r"(-?)(?:(?:([0-9]{1,6})h)?(?:([0-9]{1,6})m)?([0-9]{1,6})(?:\.([0-9]{1,9}))?s|([0-9]{1,9})(?:\.([0-9]{1,9}))?(ms|us|μs|μs|ns))", value)scale = {"ms": 1000000, "us": 1000, "μs": 1000, "μs": 1000, "ns": 1}[match[8]]CSX_TEST_DSN: postgres://csx:[email protected]:5432/csx?sslmode=disable
CSX_TEST_DSN="postgres://csx:csx@localhost:5432/csx?sslmode=disable" \
source = "postgres://csx:p%40ss@db:5432/csx?sslmode=disable&application_name=foreign&application_name=other"
CSX_TEST_DSN="postgres://csx:csx@localhost:55433/csx" \
SECRET = "credential-DO-NOT-EMIT-private-coordinate"
SECRET = "DO-NOT-EMIT-token-host-session-coordinate"
const token = "csx_author_v1_SECRETargvVALUE"
const token = "csx_author_v1_compat-secret"
const token = "csx_author_v1_report-test"
Gates applied: instruction_override, no_behavioural_pass.
306d4ed0bd53full audit observations/trust-audit/mcp-server/r2cuerdame__codesamplex.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 306d4ed0bd53 | BLOCK | F | 27 | first audit |
Questions
What is the CodeSampleX MCP server?
An open compatibility testing network: does this library API actually run on your version, OS and runtime? Real build evidence, verified samples, and the environment each result came from.
What tools does CodeSampleX expose?
1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is CodeSampleX safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (27/100) and found 9 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does CodeSampleX need?
It reads API_KEY, API_TOKEN, DB_PASSWORD, EMPTY_TOKEN, PRODUCTION_KEY_PATH and TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does CodeSampleX run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as csx-sample-axios-upload at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (306d4ed0bd53), read on 2026-10-11. The repository is watched and re-audited when it changes.