Atlas / MCP servers / yy1588133 / Code Merge

Code MergeSAFE

mcp/yy1588133/code-merge
Verdict
SAFE
Grade
B
Trust score
89 /100
Exposed tools
3 2r · 1w · 0d
Transport
stdio
License
MIT
Stars
21
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://mseep.ai/app/yy1588133-code-merge-mcp)

Code Merge MCP 是一个基于 Model Context Protocol (MCP) 的服务器实现,专为代码文件内容提取、合并和分析而设计。它提供了一套强大的工具,帮助大语言模型(如GPT、Claude)更有效地处理和分析代码库。

核心功能

  • 文件树生成:生成项目文件结构的树状视图
  • 代码合并:将多个文件的内容合并为单一输出
  • 代码分析:提供代码统计信息,如行数和函数数量
  • 智能过滤:支持 .gitignore 规则和自定义黑名单

技术架构

本项目基于 Model Context Protocol (MCP) SDK 构建,使用 Node.js 实现。主要组件包括:

  • MCP 服务器:处理客户端请求并提供工具功能
  • 工具模块:实现各种代码处理功能
  • 核心库:提供文件系统操作和过滤功能

工具说明

1. get_file_tree

生成项目文件结构的树状视图,支持多种过滤选项。

参数:

  • path:目标目录路径
  • use_gitignore:是否使用 .gitignore 规则(可选)
  • ignore_git:是否忽略 .git 目录(可选)
  • custom_blacklist:自定义黑名单项目(可选)

示例输出:

project/
├── src/
│   ├── main.js
│   └── utils/
│       └── helper.js
├── tests/
│   └── test.js
└── README.md

2. merge_content

将多个文件的内容合并为单一输出,适合准备用于大语言模型的代码分析。

参数:

  • path:目标文件或目录路径
  • compress:是否压缩输出(可选)
  • use_gitignore:是否使用 .gitignore 规则(可选)
  • ignore_git:是否忽略 .git 目录(可选)
  • custom_blacklist:自定义黑名单项目(可选)

输出:包含合并后的文件内容和统计信息

3. analyze_code

分析代码文件并提供统计信息,如行数和函数数量。

参数:

  • path:目标文件或目录路径
  • language:可选的语言过滤器
  • countLines:是否统计代码行数
  • countFunctions:是否统计函数数量

输出:包含代码分析结果的统计信息

安装与使用

环境要求

  • Node.js (v16.x 或更高版本推荐)
  • npm (通常随 Node.js 一起安装)

从 Git 仓库获取项目

# 克隆仓库
git clone https://github.com/yourusername/code-merge-mcp.git
cd code-merge-mcp

# 安装依赖
npm install

VS Code 配置

在 VS Code 的 mcp_settings.json 中添加:

{
"mcpServers": {
"code-merge": {
"command": "node",
"args": [
"/src/main.js"
],
}
}
}

将 ` 替换为实际路径,例如 C:\Users\username\code-merge-mcp`。

项目结构

code-merge-mcp/
├── bin/                # 可执行文件目录
│   ├── cli.js           # 命令行入口点
│   └── mcp-server.js    # MCP服务器入口点
├── src/
│   ├── core/           # 核心功能模块
│   │   ├── compressor.js   # 内容压缩
│   │   ├── file-
Read from source at commit ebc374f61f6fOBSERVED · 2026-10-10
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add code-merge-mcp -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "code-merge-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}
03

Exposed tools (3)

2 read · 1 write · 0 destructive.

ToolRiskDescription
analyze_codereadAnalyzes code files and provides statistics.
get_file_treereadRetrieves the file tree structure of the project.
merge_contentwriteMerges content from multiple files into a single output file.
04

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
none-observed
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (3)

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
src/core/file-cache.js:34
return crypto.createHash('md5').update(filePath).digest('hex');
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
src/core/tree-cache.js:34
return crypto.createHash('md5').update(`${dirPath}:${optionsStr}`).digest('hex');
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/sdk, ignore, zod
Why it matters. 3 dependency range(s) float
Fix. pin exact versions or ship a lockfile

Gates applied: no_behavioural_pass.

Audited 2026-10-10 · audit v0.4.1 · source sha ebc374f61f6ffull audit observations/trust-audit/mcp-server/yy1588133__code-merge.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-10ebc374f61f6fSAFEB89first audit
06

Questions

What tools does Code Merge expose?

3 in total: 2 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Code Merge safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does Code Merge need?

No credential environment variables were found in its source, so it appears to need none.

How does Code Merge run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as code-merge-mcp at 0.3.1.

How current is this page?

The grade is for one exact copy of the source (ebc374f61f6f), read on 2026-10-10. The repository is watched and re-audited when it changes.

Advertisement