code-auditor-mcp — Claude Code MCP server: how to install
An MCP server that checks the code your agent writes against rules in .codeauditor.json. On Claude Code and Codex it can stop a bad edit before it lands.
claude mcp add --transport http code-auditor-mcp https://www.codeauditormcp.com/api/mcpWhat code-auditor-mcp does
code-auditor-mcp sits in the agent's edit loop and checks each change against rules you keep in .codeauditor.json. The agent can write those rules itself when you ask. There are seven rule kinds, from import-ban to no-raw-values, and a malformed config fails the audit loudly.
Blocking depends on the tool. Claude Code and Codex stop the edit when a rule has gating: true, and the agent then fixes the violation. Cursor only gets a warning after the edit has happened. Gemini CLI and Copilot have no hook, so they use the MCP tools alone. If you want hard enforcement, pick Claude Code or Codex.
You need Node 18+. Node 23.4+ uses the built-in node:sqlite, so nothing gets compiled. On Node 18 through 23.3 the fallback is better-sqlite3, and on npm 11.2+ its install script needs a one-time approval or the native part stays unbuilt. The code index lives in the OS cache, outside your repo.
What it helps with
- ban a module like lodash from imports across the project
- keep
src/languages/from importing anything insrc/analyzers/ - restrict who may call
chargeCustomer()tosrc/api/ - block
new Function(...)with an ast-grep pattern - audit only the files changed since main
Example prompts for the agent
- Audit the whole codebase, then step through the findings with
code-audit next-file, one file at a time. - Write a naming rule in
.codeauditor.json: exports insrc/hooks/must begin withuse. - Refresh the index and check only files that differ from main.
How to install code-auditor-mcp
1Platform CLI: remote server
claude mcp add --transport http code-auditor-mcp https://www.codeauditormcp.com/api/mcp2Platform CLI
claude mcp add code-auditor-mcp -- npx -y code-auditor-mcp1Platform CLI: remote server
codex mcp add code-auditor-mcp --url https://www.codeauditormcp.com/api/mcp2Platform CLI
codex mcp add code-auditor-mcp -- npx -y code-auditor-mcpConfig file
{
"mcpServers": {
"code-auditor-mcp": {
"url": "https://www.codeauditormcp.com/api/mcp"
}
}
}{
"mcpServers": {
"code-auditor-mcp": {
"command": "npx",
"args": [
"-y",
"code-auditor-mcp"
]
}
}
}Config file
{
"servers": {
"code-auditor-mcp": {
"type": "http",
"url": "https://www.codeauditormcp.com/api/mcp"
}
}
}{
"servers": {
"code-auditor-mcp": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"code-auditor-mcp"
]
}
}
}1Platform CLI: remote server
gemini mcp add -t http code-auditor-mcp https://www.codeauditormcp.com/api/mcp2Platform CLI
gemini mcp add code-auditor-mcp npx -y code-auditor-mcpStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about code-auditor-mcp
How do I install code-auditor-mcp in Claude Code?
Run claude mcp add code-auditor-mcp -- npx -y code-auditor-mcp. That starts the server locally through npx.
What does code-auditor-mcp do?
It checks edits made by an AI agent against project rules in .codeauditor.json, such as import bans, module boundaries, call limits and ast-grep patterns. The agent sees the violation right away and can fix it.
Does it block edits in every agent?
No. Blocking works on Claude Code and Codex for rules with gating: true. Cursor's hook only warns, and Gemini CLI and Copilot have no hook, so they get the MCP tools only.
