codematrix-mcp 1.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +97 -0
- package/dist/index.js +22112 -0
- package/package.json +47 -0
package/README.md
ADDED
|
@@ -0,0 +1,97 @@
|
|
|
1
|
+
# codematrix-mcp
|
|
2
|
+
|
|
3
|
+
An MCP server that lets AI coding agents (Claude Code, Cursor, Cline, and
|
|
4
|
+
other MCP-compatible tools) check whether a package is real and
|
|
5
|
+
trustworthy **before** installing it — catching hallucinated ("phantom")
|
|
6
|
+
packages, typosquats, and known CVEs at the moment an agent is about to
|
|
7
|
+
`npm install`/`pip install` something — and check content for hardcoded
|
|
8
|
+
secrets before it's written to a file.
|
|
9
|
+
|
|
10
|
+
Runs fully offline by default (no account needed) — same registry/CVE
|
|
11
|
+
checks as `npx codematrix`. Set `CODEAUDIT_TOKEN` to additionally get
|
|
12
|
+
an LLM-suggested real alternative for phantom packages that aren't a
|
|
13
|
+
simple typo of anything popular (e.g. `fastimagepro` → Pillow/imageio).
|
|
14
|
+
|
|
15
|
+
## Setup
|
|
16
|
+
|
|
17
|
+
**Claude Code** — one command, no file editing:
|
|
18
|
+
|
|
19
|
+
```bash
|
|
20
|
+
claude mcp add codeaudit -- npx -y codematrix-mcp
|
|
21
|
+
```
|
|
22
|
+
|
|
23
|
+
(Add `-e CODEAUDIT_TOKEN=your-token` before `--` if you have one. Use
|
|
24
|
+
`claude mcp add --scope project ...` instead to check the config into the
|
|
25
|
+
repo for your whole team rather than just your own machine.)
|
|
26
|
+
|
|
27
|
+
**Cursor** — click to install:
|
|
28
|
+
|
|
29
|
+
[](cursor://anysphere.cursor-deeplink/mcp/install?name=codeaudit&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsImNvZGVtYXRyaXgtbWNwIl19)
|
|
30
|
+
|
|
31
|
+
Or manually via **Settings → MCP → Add new MCP server**, pointing the
|
|
32
|
+
command at `npx -y codematrix-mcp`.
|
|
33
|
+
|
|
34
|
+
**Any other MCP-compatible client** (Cline, Windsurf, etc.) — add this to
|
|
35
|
+
whatever JSON config the client reads (e.g. Cline's `cline_mcp_settings.json`):
|
|
36
|
+
|
|
37
|
+
```json
|
|
38
|
+
{
|
|
39
|
+
"mcpServers": {
|
|
40
|
+
"codeaudit": {
|
|
41
|
+
"command": "npx",
|
|
42
|
+
"args": ["-y", "codematrix-mcp"],
|
|
43
|
+
"env": { "CODEAUDIT_TOKEN": "" }
|
|
44
|
+
}
|
|
45
|
+
}
|
|
46
|
+
}
|
|
47
|
+
```
|
|
48
|
+
|
|
49
|
+
Then add a line to your agent's instructions file (e.g. `CLAUDE.md`) so
|
|
50
|
+
the agent actually calls these tools — an MCP tool's description alone
|
|
51
|
+
doesn't force an agent to invoke it:
|
|
52
|
+
|
|
53
|
+
> Before installing any new package, call the CodeAudit `verify_package`
|
|
54
|
+
> tool. Before writing or editing a file that could contain configuration
|
|
55
|
+
> or credentials, call `scan_secrets`.
|
|
56
|
+
|
|
57
|
+
### Windows: if `npx` fails to connect
|
|
58
|
+
|
|
59
|
+
Some Windows machines have an `npx` that fails to execute a resolved
|
|
60
|
+
package's bin shim even though the shim itself is correct (`claude mcp
|
|
61
|
+
list` reports "Failed to connect", and the server's log shows `'<bin-name>'
|
|
62
|
+
is not recognized as an internal or external command`). If you hit this,
|
|
63
|
+
skip `npx` entirely — install globally once and point the command straight
|
|
64
|
+
at the installed binary:
|
|
65
|
+
|
|
66
|
+
```bash
|
|
67
|
+
npm install -g codematrix-mcp
|
|
68
|
+
claude mcp add codeaudit -- codematrix-mcp
|
|
69
|
+
```
|
|
70
|
+
|
|
71
|
+
(For other clients, set `"command": "codematrix-mcp", "args": []` instead of
|
|
72
|
+
`npx`/`-y`/`codematrix-mcp`.) This bypasses the broken `npx` resolution step
|
|
73
|
+
entirely, at the cost of needing `npm update -g codematrix-mcp` manually for
|
|
74
|
+
future versions instead of `npx` always fetching latest.
|
|
75
|
+
|
|
76
|
+
## Tools
|
|
77
|
+
|
|
78
|
+
- `verify_package({ name, ecosystem?, version? })` — checks one package.
|
|
79
|
+
`version` is optional — when given, known-vulnerability checks run
|
|
80
|
+
against that version instead of the registry's latest.
|
|
81
|
+
- `verify_packages({ packages: [{ name, ecosystem? }] })` — checks several
|
|
82
|
+
at once (e.g. every new line in a manifest diff).
|
|
83
|
+
- `scan_secrets({ content, filePath? })` — checks file content for
|
|
84
|
+
hardcoded API keys, tokens and private keys before it's written. Returns
|
|
85
|
+
redacted matches only (e.g. `AKIA…(20 chars)`) — the actual secret value
|
|
86
|
+
is never echoed back. `filePath` is optional and used to skip files that
|
|
87
|
+
legitimately hold placeholders, such as `.env.example`.
|
|
88
|
+
|
|
89
|
+
`ecosystem` (`"npm"` or `"pypi"`) is optional — omit it and `verify_package`/
|
|
90
|
+
`verify_packages` try npm first, then PyPI.
|
|
91
|
+
|
|
92
|
+
## Getting a token (optional)
|
|
93
|
+
|
|
94
|
+
A `CODEAUDIT_TOKEN` is the same per-repo token used by `codematrix
|
|
95
|
+
--upload` — generate one from your repository's settings page at
|
|
96
|
+
[codeaudit.dev](https://codeaudit.dev), or via `POST
|
|
97
|
+
/repos/:repoId/cli-token` if self-hosting.
|