MCP.Market

Cynicalsally MCP server

by w1ckedxt·io.github.w1ckedxt/cynicalsally·v0.7.0·97 stars
No reviews yet

Brutally honest code reviews: scores, real issues, and usable fixes. CLI + MCP server.

C69/100grade C
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
C69/100

full report

Adoption
Growing

97 stars41 downloads/wk

Reviews

Write one

Nobody has reviewed Cynicalsally yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Cynicalsally tools (8)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • sally_brainstorm

    Pitch an idea or architecture and Sally names the three ways it falls apart at scale — cheaper than a post-mortem. Use when the user wants feedback on an idea, approach, design decision, or trade-off before building it. Sends only the provided description to the Cynical Sally backend — never stored, never used for training. Read-only: never modifies files. Returns a markdown verdict with risks and

  • sally_explain

    Have Sally explain what a piece of code actually does, in plain English — no hand-holding, just the cold, clear truth. Use when the user wants a snippet or file explained, asks 'what does this do', or inherited code nobody documented. Sends only the provided code to the Cynical Sally backend — never stored, never used for training. Read-only: never modifies files. Returns a markdown explanation in

  • sally_frontend

    Sally roasts frontend/UI code — wasteful re-renders, load-bearing z-index, accessibility sins, and questionable component design. Use for HTML/CSS/JSX/Vue/Svelte or other UI code; for general-purpose code use sally_roast instead. Sends only the provided code to the Cynical Sally backend — never stored, never used for training. Read-only: never modifies files. Returns markdown with categorized issu

  • sally_marketing

    Sally reviews marketing copy, branding, and landing-page text before your customers do it less kindly. Use when the user wants copy, taglines, or brand messaging critiqued — returns before/after rewrites with the reasoning. Sends only the provided text to the Cynical Sally backend — never stored, never used for training. Read-only: never modifies files. Premium tool: one free use per month on the

  • sally_refactor

    Sally proposes concrete refactors with before/after code and explains why the original would haunt your 3am on-call rotation. Use when the user wants code improved, cleaned up, simplified, or modernized. Sends only the provided code to the Cynical Sally backend — never stored, never used for training. Read-only: suggestions come back as markdown, nothing is applied to files. Premium tool: one free

  • sally_review_pr

    Sally reviews a PR diff like a senior engineer with time, opinions, and no reason to be polite — catching what automated tools miss. Use when the user wants a pull request, commit, or unified diff reviewed before merging. Sends only the provided diff to the Cynical Sally backend — never stored, never used for training. Read-only: never modifies files. Returns a markdown review with a verdict and c

  • sally_roast

    Get a brutally honest code review from Cynical Sally — a 0–10 score, real issues backed by evidence, and fixes you can actually use. Use this whenever the user wants code reviewed, critiqued, roasted, or asks 'what does Sally think'. Pass `paths` (files or directories Sally reads herself, skipping binaries and secrets) OR `files` with inline content. quick = a fast, sharp take (90 free per month p

  • sally_usage

    Check the user's Cynical Sally quota and account status: tier (Free or Full Suite), remaining quick roasts and Full Truth reviews this month, per-tool premium trials, and the email linked to this device. Use when the user asks how many roasts they have left, what plan they're on, or why a Sally tool just hit a quota wall. Takes no parameters. Sends only the anonymous device ID to the Cynical Sally

Public scan report

scanner v0.1.9 · 2026-09-26 · same rubric, same numbers if you re-run it

1 high
  • Code scan53 source files scanned13/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 84 days ago12/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Findings (1)

  • highShell command built from a string (injection risk)exec.shell-concat
    dist/commands/tools.js: …]/g, ""); content = execSync(`gh pr diff ${safePr}`, { encoding: "utf-8", maxBuffer…
Overall 69/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Cynicalsally compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
69/100
higher than 33% of 48,255 servers
Tools
8
the typical server has 7
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
97
more than 95% of 28,688 servers
Downloads a week
41
more than 33% of 12,191 servers with a package

What its tools let an agent do: 8 read

Install Cynicalsally in Claude Code, Cursor or VS Code

Runs npx -y @cynicalsally/cli on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add cynicalsally -- npx -y @cynicalsally/cli
Add to Cursor

What the publisher says

From the Cynicalsally repository's README, as published. We do not edit it. Read it on GitHub

<!-- mcp-name: io.github.w1ckedxt/cynicalsally -->

Cynical Sally

Brutally honest code reviews. In your terminal and your AI editor. Because "You're absolutely right" is probably absolutely wrong. npm i -g @cynicalsally/cli · MCP server for Claude Code, Cursor &amp; Windsurf

Your AI pair programmer is lying to you. Sally isn't.

She's the senior engineer your code hoped it'd never meet. Scores from 0 to 10, real issues backed by evidence, and fixes you can actually use.

Works as a CLI tool and as an MCP server in Claude Code, Cursor, and Windsurf.

Install

npm install -g @cynicalsally/cli

Or run without installing:

npx @cynicalsally/cli roast ./src/

Requirements: Node.js 18+

See exactly what leaves your machine

Sending code to a server you don't control deserves more than "trust me." So Sally lets you verify it instead:

sally roast --dry-run ./src/

--dry-run collects everything as if it were about to roast — then sends nothing. Instead it prints the exact payload: every file path, byte size, and token estimate; which files were held back and why (.env, keys, certs, binaries, .gitignore matches, size limits); and writes a local SHA-256 receipt to .sally/ so you can verify byte-for-byte what would have been uploaded.

WOULD SEND 3 files · 91 B · ~24 tokens (est.)
  src/app.ts        36 B   ~9 tok   68a3be428746…

HELD BACK 2 items — kept on your machine
  ✖ secret (2) — looks like a secret — never leaves your machine
      .env
      server.key

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Cynicalsally: common questions

Is Cynicalsally MCP server safe?
With care: it is graded C, so read the findings first (69/100). Read the Cynicalsally safety report
How do I install Cynicalsally?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Cynicalsally need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Cynicalsally maintained?
The last commit was 123 days ago (2026-07-04). The latest release is v0.7.0.
How does Cynicalsally compare with other MCP servers?
safety score 69/100 (higher than 33% of 48,255 servers); tools 8 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.