MITBenAHammond/code-auditor-mcp

Code Auditor

Your codebase has rules your AI agent doesn't know. Install one skill — it enforces them on every edit it makes.

Two commands to install everywhere:

npm install -g code-auditor-mcp
code-audit install --agent all

Claude Code, Cursor, Codex, Gemini CLI, and any SKILL.md agent. Blocking hooks on Claude Code and Codex; MCP reporting everywhere. code-audit install --list shows the matrix.

How It Works

Audit the whole codebase to clean up your code, and let your agent keep it clean on every edit. Either way, the analysis is deterministic.

Clean up your code

code-audit audit

Run it against any TypeScript, JavaScript, Go, or CSS/SCSS project and get a complete, structured report of everything that's wrong. Fix the real problems, baseline the rest, and start from a clean slate.

  1. →

    Deterministic, not model-driven

    Tree-sitter and ast-grep do the analysis — findings are identical every run, with any model or with none at all.

  2. →

    A report you can act on

    HTML · JSON · CSV · SARIF 2.1.0

    File, line, severity, rule id, and a message for every finding. Baseline the known issues as debt and only the new ones stand out.

Keep it clean

code-audit changed --fail-on critical

Once installed, your agent audits only the files it just touched. Critical violations are caught and fixed before they reach the repo — without re-reading the whole codebase, so model costs stay low.

  1. →

    Install the skill

    code-audit install --agent claude

    Drops a SKILL.md plus a PostToolUse hook into your agent — Claude Code and Codex.

  2. →

    It audits the diff

    code-audit changed --fail-on critical

    Only the files that changed, not the whole project. The hook fires after every Write and Edit.

  3. →

    Critical violations block the edit

    no-lodash · critical · src/utils/format.ts:3

    The agent reads the rule id, severity, file, line, and message — fixes it — and only passing code reaches your repo.

TypeScript, JavaScript, Go, and CSS/SCSS — parsed with tree-sitter and ast-grep grammars.

What It Catches

Thirteen analyzers across TypeScript, JavaScript, Go, and CSS/SCSS — the bugs your agent introduces and your review misses.

SQL injection

`SELECT * FROM users WHERE id = ${id}`

String-built queries. The data-access analyzer flags injection, tenant leaks, and N+1s before they reach review.

Cross-tenant leak

SELECT * FROM orders // no org filter

A multi-tenant query missing WHERE org_id = ?. One customer's data, another customer's screen.

Banned import

import _ from "lodash"

You banned lodash. The agent imports it anyway. It finds out in the edit, not the PR.

Circular dependency

a.ts → b.ts → a.ts

Broken tree-shaking and undefined at import time, caught before it ships.

The full catalog — thirteen analyzers

SOLID Principles

The five principles, enforced mechanically.

DRY Violations

Copy-paste, caught before it's debt.

Data Access & Security

SQL injection, tenant leaks, N+1s.

Documentation Quality

Undocumented exports are future bugs.

React Best Practices

The mistakes that survive review.

Schema Awareness

Queries referencing columns that don't exist.

Invariant Rules

Your team's rules, enforced as hard invariants.

Schema Definitions

When schema and code disagree.

API Contract

Endpoints, fields, auth vs the contract.

Dependency Graph

Cycles, coupling, hubs, orphans.

Styles

Token drift, z-index sprawl.

Conventions

Mines your code's conventions, flags deviations.

Cross-Domain

What's visible only across boundaries.

Diff-Scoped, Every Edit

Your agent runs code-audit changed on the files it just touched, not the whole project. Each analyzer returns structured violations — file, line, severity, rule id, and a message the agent can read and fix.

JSON output
SARIF 2.1.0 output
CSV output
HTML output