# CodeInspectus

CodeInspectus scans application code for security issues and helps an agent fix findings and run another scan. It works locally.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 49
- Author: Synvoya
- License: Apache-2.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/Synvoya/codeinspectus
- Updated: 2026-10-03
- HTML: https://affpapa.org/en/nevibecode/mcp/codeinspectus

## What it does

The server brings together Opengrep, Gitleaks, and Trivy with CodeInspectus rules for AI-generated code. Checks cover issues such as exposed client-side secrets, unsafe Supabase settings, risky model output, and vulnerable GitHub Actions workflows. Findings use a shared schema keyed to CWE, with framework mappings presented as code-level coverage.

An agent can scan a project, explain the results, and help address them before scanning again. Scans run on the local machine without outbound network traffic. Node.js 22 or later is required. On Linux, Opengrep needs glibc; on Alpine/musl it is unavailable, so selecting it leaves aggregate scan coverage partial. That affects how much of the project the selected engines can check.

## Requirements
- Needs: Node.js (commands run via npx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add codeinspectus -- npx -y codeinspectus
```

### Codex

**Platform CLI**
```bash
codex mcp add codeinspectus -- npx -y codeinspectus
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "codeinspectus": {
            "command": "npx",
            "args": [
                "-y",
                "codeinspectus"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "codeinspectus": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "codeinspectus"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add codeinspectus npx -y codeinspectus
```

## When to use it
- find security flaws in AI-generated application code
- check for leaked secrets and dependency CVEs
- spot unsafe Supabase authorization patterns
- map findings to CWE and compliance frameworks
- rescan a project after code fixes

## Example prompts
- Scan this project with CodeInspectus and explain the security findings.
- Check the code for exposed secrets and vulnerabilities, then help me fix them.
- Rescan the project after these fixes and compare the new findings with the previous run.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [GitHub](https://affpapa.org/en/nevibecode/mcp/github.md) — MCP server · ★ 33918
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [Netdata](https://affpapa.org/en/nevibecode/mcp/netdata.md) — MCP server · ★ 81115
- [Front-End Checklist](https://affpapa.org/en/nevibecode/mcp/front-end-checklist.md) — MCP server · ★ 74559
- [Scrapling MCP Server](https://affpapa.org/en/nevibecode/mcp/scrapling-mcp-server.md) — MCP server · ★ 89433

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md