# code-factory

Gathers local audit evidence for Python changes, connecting AST security checks, test results, and patch review.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 6
- Author: zrk222
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/zrk222/code-factory
- Updated: 2026-10-23
- HTML: https://affpapa.org/en/nevibecode/mcp/code-factory

## What it does

The server exposes Code Factory audit capabilities to coding agents. It performs bounded AST security inspection on Python sources, tracking input values as they flow toward HTTP, filesystem, or SQL sinks. A basic scan reads code without executing project runtime scripts, requiring no Docker containers or tenant configuration.

Audit traces keep track of check statuses alongside the proposed patch. Missing test reports or absent evaluations are recorded as incomplete rather than clean passes. The integrated JUnit module inspects reports up to 10,000 cases. Running native worker execution requires separate environment and safety setups.

## Requirements
- Needs: Python and uv (commands run via uvx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add code-factory -- uvx factoryline-code-factory
```
uvx runs the command named after the package; if the README names another one, use uvx --from factoryline-code-factory <command>

### Codex

**Platform CLI**
```bash
codex mcp add code-factory -- uvx factoryline-code-factory
```
uvx runs the command named after the package; if the README names another one, use uvx --from factoryline-code-factory <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "code-factory": {
            "command": "uvx",
            "args": [
                "factoryline-code-factory"
            ]
        }
    }
}
```
uvx runs the command named after the package; if the README names another one, use uvx --from factoryline-code-factory <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "code-factory": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "factoryline-code-factory"
            ]
        }
    }
}
```
uvx runs the command named after the package; if the README names another one, use uvx --from factoryline-code-factory <command>

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add code-factory uvx factoryline-code-factory
```
uvx runs the command named after the package; if the README names another one, use uvx --from factoryline-code-factory <command>

## When to use it
- inspect Python source for unsanitized data flowing to SQL or file sinks
- bind JUnit test results to incoming code patches
- flag incomplete audit evidence before accepting agent changes
- compare candidate repairs against affected checks

## Example prompts
- Run a code-factory scan on the root directory and list the security findings
- Review the latest Python diff and check for incomplete audit evidence
- Ingest our JUnit report using code-factory to identify affected tests

## Similar
- [Front-End Checklist](https://affpapa.org/en/nevibecode/mcp/front-end-checklist.md) — MCP server · ★ 74569
- [Codebase Memory](https://affpapa.org/en/nevibecode/mcp/codebase-memory.md) — MCP server · ★ 47577
- [Serena MCP: the IDE for your agent](https://affpapa.org/en/nevibecode/mcp/serena-mcp-the-ide-for-your-agent.md) — MCP server · ★ 30739
- [Repomix](https://affpapa.org/en/nevibecode/mcp/repomix.md) — MCP server · ★ 29037
- [Repowise](https://affpapa.org/en/nevibecode/mcp/repowise.md) — MCP server · ★ 7925
- [sem](https://affpapa.org/en/nevibecode/mcp/sem.md) — MCP server · ★ 3427

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md