codeaudit-mcp 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +58 -0
- package/dist/index.js +21817 -0
- package/package.json +47 -0
package/README.md
ADDED
|
@@ -0,0 +1,58 @@
|
|
|
1
|
+
# codeaudit-mcp
|
|
2
|
+
|
|
3
|
+
An MCP server that lets AI coding agents (Claude Code, Cursor, Cline, and
|
|
4
|
+
other MCP-compatible tools) check whether a package is real and
|
|
5
|
+
trustworthy **before** installing it — catching hallucinated ("phantom")
|
|
6
|
+
packages, typosquats, and known CVEs at the moment an agent is about to
|
|
7
|
+
`npm install`/`pip install` something.
|
|
8
|
+
|
|
9
|
+
Runs fully offline by default (no account needed) — same registry/CVE
|
|
10
|
+
checks as `npx codeaudit-scan`. Set `CODEAUDIT_TOKEN` to additionally get
|
|
11
|
+
an LLM-suggested real alternative for phantom packages that aren't a
|
|
12
|
+
simple typo of anything popular (e.g. `fastimagepro` → Pillow/imageio).
|
|
13
|
+
|
|
14
|
+
## Setup
|
|
15
|
+
|
|
16
|
+
Add to your agent's MCP config, pointing at `npx codeaudit-mcp`:
|
|
17
|
+
|
|
18
|
+
**Claude Code** (`.claude/mcp.json` or via `claude mcp add`):
|
|
19
|
+
|
|
20
|
+
```json
|
|
21
|
+
{
|
|
22
|
+
"mcpServers": {
|
|
23
|
+
"codeaudit": {
|
|
24
|
+
"command": "npx",
|
|
25
|
+
"args": ["-y", "codeaudit-mcp"],
|
|
26
|
+
"env": { "CODEAUDIT_TOKEN": "" }
|
|
27
|
+
}
|
|
28
|
+
}
|
|
29
|
+
}
|
|
30
|
+
```
|
|
31
|
+
|
|
32
|
+
**Cursor** (`.cursor/mcp.json`): identical shape to the above.
|
|
33
|
+
|
|
34
|
+
**Any other MCP-compatible client**: use the same `command`/`args` —
|
|
35
|
+
`npx -y codeaudit-mcp` — with `CODEAUDIT_TOKEN` as an optional env var.
|
|
36
|
+
|
|
37
|
+
Then add one line to your agent's instructions file (e.g. `CLAUDE.md`) so
|
|
38
|
+
the agent actually calls it — an MCP tool's description alone doesn't force
|
|
39
|
+
an agent to invoke it:
|
|
40
|
+
|
|
41
|
+
> Before installing any new package, call the CodeAudit `verify_package`
|
|
42
|
+
> tool.
|
|
43
|
+
|
|
44
|
+
## Tools
|
|
45
|
+
|
|
46
|
+
- `verify_package({ name, ecosystem? })` — checks one package.
|
|
47
|
+
- `verify_packages({ packages: [{ name, ecosystem? }] })` — checks several
|
|
48
|
+
at once (e.g. every new line in a manifest diff).
|
|
49
|
+
|
|
50
|
+
`ecosystem` (`"npm"` or `"pypi"`) is optional — omit it and the tool tries
|
|
51
|
+
npm first, then PyPI.
|
|
52
|
+
|
|
53
|
+
## Getting a token (optional)
|
|
54
|
+
|
|
55
|
+
A `CODEAUDIT_TOKEN` is the same per-repo token used by `codeaudit-scan
|
|
56
|
+
--upload` — generate one from your repository's settings page at
|
|
57
|
+
[codeaudit.dev](https://codeaudit.dev), or via `POST
|
|
58
|
+
/repos/:repoId/cli-token` if self-hosting.
|