Codeaudit MCP server

by infoinlet-marketplace·io.github.infoinlet-marketplace/mcp-codeaudit·v0.1.1

Security audit for AI agents — scan code/diffs for leaked secrets, check deps via OSV.

C65/100grade C

What users say

No reviews yet

Safety scan

C65/100

Adoption

New

24 downloads/wk

Reviews

Nobody has reviewed Codeaudit yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

scan_dependencies
Check dependencies for known vulnerabilities via OSV.dev. Provide a package.json (npm) or requirements.txt (PyPI).
scan_secrets
Scan code/text for leaked secrets (AWS/GitHub/OpenAI/Stripe keys, private keys, JWTs, assigned passwords). Returns redacted findings with line numbers.

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

no findings

Code scan5 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenancerepository not readable: repo not found3/15
Maintainer identityno repository or website to verify2/10

Overall 65/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

Against every graded Security MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 65/100; higher than 20% of 915 Security servers
Tools: 2; the typical Security server has 6
Tools that change things: 0%; typical: 0%. Fewer write tools means less an agent can break
Downloads a week: 24; more than 10% of 248 Security servers with a package

What its tools let an agent do: 2 read

Runs npx -y @infoinlet/mcp-codeaudit on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add mcp-codeaudit -- npx -y @infoinlet/mcp-codeaudit

Is Codeaudit MCP server safe?: With care: it is graded C, so read the findings first (65/100). Read the Codeaudit safety report
How do I install Codeaudit?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Codeaudit need an API key?: Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Codeaudit maintained?: The latest release is v0.1.1.
What can I use instead of Codeaudit?: Servers from other publishers that do the same job: Zn Gate MCP server, Secret Scanner MCP server and Secret Scanner MCP server.
How does Codeaudit compare with other Security MCP servers?: safety score 65/100 (higher than 20% of 915 Security servers); tools 2 (the typical Security server has 6); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Same job from other publishers: the closest match first, then the best rated.

Zn Gate
The local security layer for coding agents: secret redaction, injection checks and an MCP proxy.
not reviewed
Growing
B
Secret Scanner
Scans files for leaked secrets and API keys
More from 4hmetuyar →
not reviewed
Growing
A
Secret Scanner
Scans files for leaked secrets and API keys
More from GuardBee →
not reviewed
Growing
A
Kastell
Server security audit (413 checks), hardening, and fleet management across 4 cloud providers.
not reviewed
Growing
B
Inkog
Security co-pilot for AI agents. Scan for vulnerabilities, audit MCP servers, verify governance.
not reviewed
Growing
B