Atlas / MCP servers / zxfgds / Code Indexer

Code IndexerCAUTION

mcp/zxfgds/code-indexer
Verdict
CAUTION
Grade
C
Trust score
75 /100
Exposed tools
8 8r · 0w · 0d
Transport
stdio
License
—
Stars
34
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

基于模型上下文协议(Model Context Protocol)的智能代码检索工具,为AI大语言模型提供高效精确的代码库检索能力。

English Version

项目简介

MCP代码索引器是一个专为AI大语言模型设计的代码检索工具。它通过向量化索引和语义理解,帮助AI更好地理解和分析代码库,显著提升代码相关任务的处理效率和准确性。

项目地址:https://github.com/zxfgds/mcp-code-indexer

主要特性

  • 智能代码检索
  • 基于语义的代码搜索,理解代码含义而不仅是关键字匹配
  • 支持跨语言代码检索
  • 智能代码片段提取,自动识别完整的代码上下文
  • 代码分析能力
  • 代码结构分析(类、函数、依赖关系)
  • 代码质量评估
  • 文档和注释提取
  • 相似代码检测
  • 代码度量统计
  • 项目依赖分析
  • 优化的上下文处理
  • 智能Token消耗控制,减少不必要的上下文信息
  • 结构化的代码上下文提供
  • 多项目并行索引和检索支持
  • 持久化项目识别,避免重复索引
  • 完整MCP协议支持
  • 符合MCP数据交互规范
  • 提供丰富的工具集
  • 支持异步操作和进度反馈

应用场景

Claude Desktop应用

  • 增强代码理解:帮助Claude更准确地理解用户的代码库,提供更精准的建议和解答
  • 智能代码导航:快速定位相关代码片段,提高问答效率
  • 代码质量改进:通过代码分析功能,提供更专业的代码优化建议
  • 项目依赖管理:帮助理解和管理项目依赖关系
  • 文档生成辅助:基于代码注释和结构分析,协助生成技术文档

VSCode扩展

  • 实时代码分析:在编辑器中直接获取代码分析结果
  • 智能代码推荐:基于项目上下文提供更准确的代码建议
  • 重构辅助:识别可优化的代码模式,辅助代码重构
  • 依赖关系可视化:直观展示代码依赖关系
  • 团队协作增强:帮助团队成员更好地理解代码库

安装说明

  1. 安装依赖
pip install -r requirements.txt
  1. 安装工具
python setup.py install

配置说明

Claude Desktop配置

编辑配置文件:%APPDATA%\Claude\claude_desktop_config.json

{
"mcpServers": {
"code-indexer": {
"command": "python",
"args": ["-m", "server.app"],
"cwd": "安装目录路径",
"env": {},
"disabled": false,
"alwaysAllow": []
}
}
}

VSCode扩展配置

编辑配置文件:%APPDATA%\Code\User\globalStorage\rooveterinaryinc.roo-cline\settings\cline_mcp_settings.json

{
"mcpServers": {
"code-indexer": {
"command": "python",
"args": ["-m", "server.app"],
"cwd": "安装目录路径",
"env": {},
"disabled": false,
"alwaysAllow": []
}
}
}

使用说明

基本功能

  1. 项目识别
使用identify_project工具识别项目
  1. 索引项目
使用index_project工具索引项目代码
  1. 搜索代码
使用search_code工具搜索相关代码片段

高级功能

  1. 获取代码结构
使用get_code_structure工具分析代码结构
  1. 分析代码质量
使用analyze_code_quality工具评估代码质量
Read from source at commit 6c3903d2560dOBSERVED · 2026-10-08
Advertisement
02

Exposed tools (8)

8 read · 0 write · 0 destructive.

ToolRiskDescription
analyze_code_qualityread分析代码质量指标
analyze_dependenciesread分析项目依赖关系
find_similar_coderead查找相似代码片段
get_code_metricsread获取代码度量数据
get_code_structureread获取代码结构信息(类、函数、依赖关系)
identify_projectread识别代码项目,返回项目ID和状态
index_projectread索引代码项目,生成向量索引
search_coderead搜索代码,返回相关代码片段
03

Trust audit

CAUTIONgrade C · trust 75/100 Install with care. The audit found things worth knowing before you trust its output.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (7 observation(s))
Shell
declared (1 observation(s))
Dependencies
not all pinned
Secrets in source
none-found

Findings (14)

MEDIUMInventory / provenance · inv.binary · CWE-1104
mcp_code_indexer/parsers/javascript.dll
javascript.dll
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
mcp_code_indexer/parsers/php.dll
php.dll
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
mcp_code_indexer/parsers/python.dll
python.dll
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
client/cli.py:39
parser.add_argument('--server', type=str, default='http://127.0.0.1:5000',
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
client/plugin.py:23
def __init__(self, server_url: str = "http://127.0.0.1:5000"):
LOWInventory / provenance · inv.no_license · CWE-1104
Why it matters. no LICENSE file and no repo licence
Fix. add a licence
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
mcp_code_indexer/code_optimizer.py:69
content_hash = hashlib.md5(content.encode()).hexdigest()
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
mcp_code_indexer/indexer.py:114
return hashlib.md5(id_str.encode()).hexdigest()
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
mcp_code_indexer/project_identity.py:128
file_hash = hashlib.md5(f.read()).hexdigest()
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
mcp_code_indexer/project_identity.py:194
return hashlib.md5(id_str.encode()).hexdigest()
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
mcp_code_indexer/utils/file_utils.py:183
file_hash = hashlib.md5()
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
requirements.txt
flask, fastapi, uvicorn, mcp, chromadb, sentence-transformers, torch, tree-sitter
Why it matters. 14 requirement(s) not pinned with ==
Fix. pin exact versions
INFOInventory / provenance · inv.oversize · CWE-1104
mcp_code_indexer/parsers/rust.dll
mcp_code_indexer/parsers/rust.dll
Why it matters. 1076736 bytes not read
INFOInventory / provenance · inv.oversize · CWE-1104
mcp_code_indexer/parsers/typescript.dll
mcp_code_indexer/parsers/typescript.dll
Why it matters. 1418240 bytes not read

Gates applied: no_behavioural_pass, no_license.

Audited 2026-10-08 · audit v0.4.1 · source sha 6c3903d2560dfull audit observations/trust-audit/mcp-server/zxfgds__code-indexer.json · Report an issue / request a re-scan
04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-086c3903d2560dCAUTIONC75first audit
05

Questions

What tools does Code Indexer expose?

8 in total: 8 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Code Indexer safe to connect to an agent?

With care. The audit graded it C (75/100) and found 14 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does Code Indexer need?

No credential environment variables were found in its source, so it appears to need none.

How does Code Indexer run?

It speaks stdio, so it runs as a local process your client starts.

How current is this page?

The grade is for one exact copy of the source (6c3903d2560d), read on 2026-10-08. The repository is watched and re-audited when it changes.

Advertisement