# code-auditor-mcp

An MCP server that checks the code your agent writes against rules in .codeauditor.json. On Claude Code and Codex it can stop a bad edit before it lands.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 8
- Author: BenAHammond
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/BenAHammond/code-auditor-mcp
- Updated: 2026-10-23
- HTML: https://affpapa.org/en/nevibecode/mcp/code-auditor-mcp

## What it does

code-auditor-mcp sits in the agent's edit loop and checks each change against rules you keep in `.codeauditor.json`. The agent can write those rules itself when you ask. There are seven rule kinds, from `import-ban` to `no-raw-values`, and a malformed config fails the audit loudly.

Blocking depends on the tool. Claude Code and Codex stop the edit when a rule has `gating: true`, and the agent then fixes the violation. Cursor only gets a warning after the edit has happened. Gemini CLI and Copilot have no hook, so they use the MCP tools alone. If you want hard enforcement, pick Claude Code or Codex.

You need Node 18+. Node 23.4+ uses the built-in `node:sqlite`, so nothing gets compiled. On Node 18 through 23.3 the fallback is `better-sqlite3`, and on npm 11.2+ its install script needs a one-time approval or the native part stays unbuilt. The code index lives in the OS cache, outside your repo.

## Requirements
- Needs: Node.js (commands run via npx)
- Remote server: `https://www.codeauditormcp.com/api/mcp`

## Install

### Claude Code (native platform)

1. **Platform CLI: remote server**
```bash
claude mcp add --transport http code-auditor-mcp https://www.codeauditormcp.com/api/mcp
```

2. **Platform CLI**
```bash
claude mcp add code-auditor-mcp -- npx -y code-auditor-mcp
```

### Codex

1. **Platform CLI: remote server**
```bash
codex mcp add code-auditor-mcp --url https://www.codeauditormcp.com/api/mcp
```

2. **Platform CLI**
```bash
codex mcp add code-auditor-mcp -- npx -y code-auditor-mcp
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "code-auditor-mcp": {
            "url": "https://www.codeauditormcp.com/api/mcp"
        }
    }
}
```
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "code-auditor-mcp": {
            "command": "npx",
            "args": [
                "-y",
                "code-auditor-mcp"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "code-auditor-mcp": {
            "type": "http",
            "url": "https://www.codeauditormcp.com/api/mcp"
        }
    }
}
```
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "code-auditor-mcp": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "code-auditor-mcp"
            ]
        }
    }
}
```

### Gemini CLI

1. **Platform CLI: remote server**
```bash
gemini mcp add -t http code-auditor-mcp https://www.codeauditormcp.com/api/mcp
```

2. **Platform CLI**
```bash
gemini mcp add code-auditor-mcp npx -y code-auditor-mcp
```

## When to use it
- ban a module like lodash from imports across the project
- keep `src/languages/` from importing anything in `src/analyzers/`
- restrict who may call `chargeCustomer()` to `src/api/`
- block `new Function(...)` with an ast-grep pattern
- audit only the files changed since main

## Example prompts
- Audit the whole codebase, then step through the findings with `code-audit next-file`, one file at a time.
- Write a naming rule in `.codeauditor.json`: exports in `src/hooks/` must begin with `use`.
- Refresh the index and check only files that differ from main.

## Similar
- [Front-End Checklist](https://affpapa.org/en/nevibecode/mcp/front-end-checklist.md) — MCP server · ★ 74559
- [Codebase Memory](https://affpapa.org/en/nevibecode/mcp/codebase-memory.md) — MCP server · ★ 47392
- [Serena MCP: the IDE for your agent](https://affpapa.org/en/nevibecode/mcp/serena-mcp-the-ide-for-your-agent.md) — MCP server · ★ 30677
- [Repomix](https://affpapa.org/en/nevibecode/mcp/repomix.md) — MCP server · ★ 29027
- [Repowise](https://affpapa.org/en/nevibecode/mcp/repowise.md) — MCP server · ★ 7891
- [sem](https://affpapa.org/en/nevibecode/mcp/sem.md) — MCP server · ★ 3422

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md