CodeInspectus MCP server

Read from the package source without running it. The installed server may list more.

• codeinspectus_compliance_report

  Produce a per-framework code-level control-coverage view for a prior scan (NIST CSF 2.0, ISO 27001:2022, SOC 2, CIS v8.1, Essential Eight, OWASP Web/LLM). Reports 'X of N code-visible controls have findings' with the code-visible subset as the explicit denominator. This is NOT a compliance audit, certification, or attestation \u2014 code-level evidence only.

• codeinspectus_explain_finding

  Return a deep explanation and full remediation plan for a single finding id from a prior scan: what the weakness is, why it matters, concrete fix steps, and references.

• codeinspectus_generate_sbom

  Generate a CycloneDX or SPDX SBOM for the target project using Trivy plus the first-party offline Pub lockfile inventory, with native Pub fallback when Trivy is unavailable. Writes the SBOM file to the chosen output path and returns its location and component count. Offline.

• codeinspectus_list_rules

  List the active detectors and engine versions, the CodeInspectus detection-database version and date, Trivy vulnerability-DB freshness, bundled Pub advisory-database provenance/freshness, and the custom CodeInspectus AI-code rules and native detector packs currently shipped.

• codeinspectus_rescan

  Re-run a scan after fixes were applied and diff against a prior scan_id (or the most recent scan of the same path). Reports which findings are resolved, which remain, and which were newly introduced, plus fresh technology and native-pack execution coverage. Repository-trust artifacts are diffed separately with fail-closed resolved, remaining, introduced and not-rechecked states. Use this to verify

• codeinspectus_scan
• codeinspectus_setup

  Inspect external-engine health and exact platform download sizes, save declined choices, or install selected Opengrep/Gitleaks/Trivy components after explicit confirmation. Plan is offline. Install writes only to ~/.codeinspectus, verifies immutable pins/publisher provenance, and never modifies the target repository.

• Code scan30 source files scanned3/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitylocal package, no credentials required12/15
• Maintenancelast push 13 days ago15/15
• Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

CodeInspectus: common questions

Is CodeInspectus MCP server safe?

With care: it is graded C, so read the findings first (58/100). Read the CodeInspectus safety report

How do I install CodeInspectus?

It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.

Does CodeInspectus need an API key?

Not as far as the registry entry and our scan can tell: no credentials are declared or required.

Is CodeInspectus maintained?

The last commit was 13 days ago (2026-09-07). The latest release is v3.2.0.

What can I use instead of CodeInspectus?

Servers from other publishers that do the same job: Reversecore MCP server, MCPProxy MCP server and SecHelix MCP server. Compare all CodeInspectus alternatives.