Code Auditor MCP server

Code Auditor

Architectural invariants enforced inside your AI agent's edit loop. When the agent writes code that breaks a project rule, Code Auditor catches it and blocks the edit. The agent sees the rule's message and fixes itself.

Install

npm install -g code-auditor-mcp
code-audit install --agent all

Two commands to install everywhere. code-audit install --agent all copies the skill to every AI coding tool on your machine. Use --agent for specific tools.

What you get per tool: the skill (SKILL.md), MCP server access, and hook wiring where the tool supports it (blocking on Claude Code and Codex, advisory on Cursor).

code-audit install --list   # see the support matrix

Claude Code users can also install via plugin:

claude plugin marketplace add BenAHammond/code-auditor-mcp
claude plugin install code-auditor

The hook auto-installs the auditor on first use via npx.

Requirements

Auditor uses the built-in node:sqlite module, so nothing needs to compile or download a prebuilt binary on install.

• Node 18+ to run. Node 23.4+ gets the zero-native-install path: Code

optional dependency whose install script must be approved once on npm 11.2+/12 (they block dependency install scripts by default): npm install-scripts approve better-sqlite3 && npm rebuild better-sqlite3 (with pnpm: pnpm approve-builds, then select better-sqlite3).

• On older Node (18–23.3), Code Auditor falls back to better-sqlite3, an

Prompt examples

"Index the codebase and run a full audit, then walk the violations file-by-file with code-audit next-file."

"Create a .codeauditor.json that bans lodash imports and prevents src/languages/ from importing anything in src/analyzers/."

"Run a full audit, fix the highest-priority file, and repeat code-audit next-file until the tree is clean."

"Sync the code index and audit only what changed vs main."

"Add an ast-pattern rule that blocks new Function(...)."

"Add a naming rule requiring hooks in src/hooks/ to start with use."

"Add a call-constraint so chargeCustomer() in src/services/payment.ts can only be called from src/api/."

Rule kinds

Seven kinds. The agent writes them to .codeauditor.json. Bad configs fail the audit, not silently.

Works with your agent

One skill, one CLI, one MCP server. Every agent gets the same audit engine — the hook contract is the only difference.

Shortened. The full README is on GitHub.