MCP.Market

koment MCP server

by janpuc·io.github.janpuc/koment·v1.1.0·1 stars

Read and write checked code rationale stored outside source comments.

A90/100grade A
What users say
No reviews yet
Be the first
Safety scan
A90/100

full report

Adoption
New

1 stars

Reviews

Write one

Nobody has reviewed koment yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

koment tools

No tool declarations could be read from the package source. They show once the server is installed.

Public scan report

scanner v0.1.9 · 2026-09-24 · same rubric, same numbers if you re-run it

no findings
  • –Code scanpackage could not be scannedn/a
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 2 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year9/10
Overall 90/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How koment compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
90/100
higher than 83% of 48,255 servers
GitHub stars
1
more than 65% of 28,688 servers

Install koment in Claude Code, Cursor or VS Code

claude mcp add koment -- docker run -i --rm ghcr.io/janpuc/koment:1.1.0
Add to Cursor

What the publisher says

From the koment repository's README, as published. We do not edit it. Read it on GitHub

koment

Keep the why next to your code — checked, so it can't quietly rot.

The problem

Someone wrote retry 5 times instead of 3, and there was a good reason. Six months later nobody remembers it, so it gets "simplified" back to 3 and the bug returns.

A comment was supposed to prevent that. Comments rot: they sit next to the code without being attached to it, and when the code changes nothing tells you the comment just became a lie. Your AI agent then reads that lie and acts on it.

What koment does

You record the reason outside the source, anchored to the exact lines it explains. Then koment watches those lines. Change them, and it says so:

$ koment check
internal/auth/token.go
  drifted   gotcha        internal/auth/token.go  01KZN63VC5SZASDYJBMPDC03WB
    Without it, clients whose clock runs fast get logged out mid-request. Bit
    us in #412.
1 annotation across 1 file: 1 drifted
koment: 1 annotation no longer resolves; revisit it or update the anchor

Exit code 1. The build stops. Nobody silently inherits a reason that no longer describes the code.

The records are YAML in .koment/, in your git repository. No database, no service, no account. They review in the same pull request as the change that motivated them.

See it running → — koment's own annotations, published by a workflow you can copy.

For AI agents

This is where it earns its keep. Agents write explanatory comments constantly, and they edit code without reading why it was written that way. koment makes both of those fail immediately, while the agent is still working:

reasoning as an annotation instead.

  • It writes a comment → the edit is refused, with instructions to record the

the annotation is revisited.

  • It edits annotated code without checking → the turn cannot finish until

One MCP server serves Claude Code, Cursor, Codex, opencode, Hermes, Zed and the rest, so every agent reads the same reasoning through the same interface. Set yours up →

Humans get the same loop in the editor: a squiggle under the comment, and a quick fix offering convert to annotation or keep it, on the record.

Install

brew install koment-dev/tap/koment

Other ways

mise use -g github:koment-dev/koment          # mise
go install github.com/koment-dev/koment/cmd/koment@latest
docker run --rm -v "$PWD:/repo" -w /repo ghcr.io/koment-dev/koment:3 check

In GitHub Actions, uses: koment-dev/koment@v3. Or take a checksum-listed binary for Linux, macOS or Windows on amd64/arm64 from the latest release — every other channel is built from those same artifacts.

Try it in a minute

From inside any git repository:

koment bootstrap

That sets up .koment/ and wires whichever agents you use. Now record a reason and watch it get checked:

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

koment: common questions

Is koment MCP server safe?
Yes, by our scan: it is graded A (90/100). Read the koment safety report
How do I install koment?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does koment need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is koment maintained?
The last commit was 43 days ago (2026-09-22). The latest release is v1.1.0.
How does koment compare with other MCP servers?
safety score 90/100 (higher than 83% of 48,255 servers); github stars 1 (more than 65% of 28,688 servers). Full comparison.