# ellmos CodeCommander (npm · ellmos-codecommander-mcp)

Developer MCP server: code analysis, JSON repair, imports, diffs, regex, format conversion.

- Trust score: 59/100 (low)
- Change this week: +13
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `ellmos-codecommander-mcp`: 59/100 (this document), [markdown](https://verifymcp.io/servers/ellmos-ai-ellmos-codecommander-mcp/ellmos-codecommander-mcp.md), [page](https://verifymcp.io/servers/ellmos-ai-ellmos-codecommander-mcp/ellmos-codecommander-mcp)

## Channel facts

- Registry: `npm`
- Package: `ellmos-codecommander-mcp`
- Version: `1.3.16`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (160 of 164), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (160 of 164), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 2 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 46/100
  - AI-judged instruction clarity (fair).
  - Context-footprint check failed: tool/resource definitions use about 2533 tokens (~115/item across 22 items; 22 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add ellmos-ai-ellmos-codecommander-mcp -- npx -y ellmos-codecommander-mcp
```

### Codex

```bash
codex mcp add ellmos-ai-ellmos-codecommander-mcp -- npx -y ellmos-codecommander-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "ellmos-ai-ellmos-codecommander-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "ellmos-codecommander-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add ellmos-ai-ellmos-codecommander-mcp --command npx --arg -y --arg ellmos-codecommander-mcp
```

### Hermes

```yaml
mcp_servers:
  ellmos-ai-ellmos-codecommander-mcp:
    command: "npx"
    args: ["-y", "ellmos-codecommander-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "ellmos-ai-ellmos-codecommander-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "ellmos-codecommander-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 59, +39)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] License: unverified → pass
- [functional improvement] Schema quality: unverified → fair
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional] Licence: MIT

### 2026-08-01 (score 20, −8)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 28, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (22)

### `cc_analyze_code` (~68 tokens)

Analyze Code

Analyzes a Python file: classes, functions, imports, metrics.

Args:
  \- path (string): Path to the Python file

Returns:
  \- Classes with methods, functions, import analysis, LOC, complexity

Input parameters:

- `path` (string, required): Path to the Python file

### `cc_analyze_methods` (~86 tokens)

Analyze Methods

Detailed method analysis of a Python file.

Args:
  \- path (string): Path to the Python file
  \- class_name (string, optional): Only methods of this class

Returns:
  \- Methods with parameters, decorators, complexity, data flow

Input parameters:

- `class_name` (string): Only analyze this class
- `path` (string, required): Path to the Python file

### `cc_extract_classes` (~149 tokens)

Extract Classes

Extracts Python classes and functions from a file as separate text blocks.

Args:
  \- path (string): Path to the Python file
  \- output_dir (string, optional): Output directory (otherwise display only)
  \- include_content (boolean, optional): Include pycutter-style code blocks in the response
  \- max_chars (number, optional): Maximum response characters for included code

Useful for code review and documentation.

Input parameters:

- `include_content` (boolean): Include extracted class/helper content in the MCP response
- `max_chars` (integer): Maximum characters of included extracted content
- `output_dir` (string): Output directory
- `path` (string, required): Path to the Python file

### `cc_organize_imports` (~99 tokens)

Organize Imports

Organizes Python imports per PEP 8: sorted, deduplicated, grouped.

Args:
  \- path (string): Path to the Python file
  \- dry_run (boolean): Preview only

Groups: 1) __future__ 2) stdlib 3) third-party 4) local

Input parameters:

- `dry_run` (boolean): Preview only
- `path` (string, required): Path to the Python file

### `cc_diagnose_imports` (~65 tokens)

Diagnose Imports

Diagnoses import issues: missing modules, circular imports, unused imports.

Args:
  \- path (string): Path to the Python file

Detects: Missing modules, suspected circular imports, import issues

Input parameters:

- `path` (string, required): Path to the Python file

### `cc_check_indentation` (~91 tokens)

Check Python Indentation

Prüft Python-Dateien auf fehlende Doppelpunkte, unindentierte return/yield-Zeilen und gemischte Tab-/Leerzeichen-Einrückung

Input parameters:

- `max_issues` (integer): Maximum number of issues to include
- `path` (string, required): Python file or directory to check
- `recursive` (boolean): Recurse into subdirectories when path is a directory

### `cc_generate_python_code` (~285 tokens)

Generate Python Code

Generiert Python-Code-Snippets aus BACH-abgeleiteten Templates ohne Dateien zu schreiben

Input parameters:

- `act` (string): Act block for test generation
- `arrange` (string): Arrange block for test generation
- `assertions` (string): Assert block for test generation
- `base` (string): Base exception class for exception generation
- `bases_json` (string): JSON array of class base names
- `body` (string): Function or method body
- `content` (string): Module content
- `description` (string): Module or CLI description
- `docstring` (string): Docstring
- `fields_json` (string): JSON array of dataclass fields
- `imports_json` (string): JSON array of import lines for module generation
- `init_params_json` (string): JSON array of __init__ parameters for classes
- `kind` (string): Template kind
- `main_body` (string): CLI main body
- `name` (string): Generated item name
- `params_json` (string): JSON array of parameters: [{"name":"x","type":"int","default":"0"}]
- `return_type` (string): Return type annotation for functions
- `spec_json` (string): Optional full JSON spec. If set, it is merged with the explicit fields.
- `target` (string): Target name for test generation

### `cc_runtime_import_diagnose` (~115 tokens)

Runtime Import Diagnose

Führt BACH-abgeleitete Python-Runtime-Importdiagnosen in isolierten Subprozessen aus

Input parameters:

- `max_modules` (integer): Maximum auto-discovered modules to import
- `modules` (string): Optional module list: package.mod:Class,other.module
- `path` (string, required): Python project directory or file
- `python_path` (string): Python executable path; defaults to PYTHON/PYTHON_EXECUTABLE/python
- `timeout_seconds` (integer): Timeout per isolated import subprocess

### `cc_python_structural_edit` (~270 tokens)

Python Structural Edit

Prüft und wendet BACH-abgeleitete strukturelle Python-Edits mit Vorschau, Testdatei und Backup-Schutz an

Input parameters:

- `class_name` (string): Target class for position=in_class
- `content` (string): Inserted code or replacement line content
- `create_backup` (boolean): Create a backup when mode=apply
- `edit_file` (string): Edit file path for merge_edit_file
- `element` (string): Class/function/method name, e.g. MyClass.method
- `elements` (string): Comma-separated element names for create_edit_file
- `indent_spaces` (integer): Indent inserted non-empty lines
- `line` (integer): 1-based line for position=line or replace_line
- `mode` (string): preview returns a diff, test writes a .test.py file, apply writes the source
- `operation` (string, required): Structural edit operation
- `output_path` (string): Optional output path for test or edit-file modes
- `path` (string, required): Python file to inspect or edit
- `position` (string): Insert position for operation=insert
- `python_path` (string): Python executable path for syntax checks
- `syntax_check` (boolean): Compile-check edited Python before writing

### `cc_fix_json` (~99 tokens)

Fix JSON

Automatically repairs common JSON errors.

Args:
  \- path (string): Path to the JSON file
  \- dry_run (boolean): Only show issues
  \- create_backup (boolean): Create backup

Repairs: BOM, trailing commas, single quotes, comments, NUL bytes

Input parameters:

- `create_backup` (boolean): Create backup
- `dry_run` (boolean): Preview only
- `path` (string, required): Path to the JSON file

### `cc_validate_json` (~45 tokens)

Validate JSON

Validates JSON with detailed error information and position.

Args:
  \- path (string): Path to the JSON file

Input parameters:

- `path` (string, required): Path to the JSON file

### `cc_fix_encoding` (~103 tokens)

Fix Encoding

Repairs encoding errors (Mojibake, double UTF-8).

Args:
  \- path (string): Path to the file
  \- dry_run (boolean): Preview only
  \- create_backup (boolean): Create backup

Repairs 27+ Mojibake patterns (German, French, Spanish).

Input parameters:

- `create_backup` (boolean): Create backup
- `dry_run` (boolean): Preview only
- `path` (string, required): Path to the file

### `cc_cleanup_file` (~178 tokens)

Cleanup File

Cleans up source code files: BOM, NUL bytes, trailing whitespace, line endings.

Args:
  \- path (string): Path to the file
  \- remove_bom (boolean): Remove BOM
  \- remove_trailing_whitespace (boolean): Trailing whitespace
  \- normalize_line_endings (string): "lf" | "crlf"
  \- remove_nul_bytes (boolean): Remove NUL bytes
  \- dry_run (boolean): Preview only

Input parameters:

- `dry_run` (boolean): Preview only
- `normalize_line_endings` (string): Line endings
- `path` (string, required): Path to the file
- `remove_bom` (boolean): Remove BOM
- `remove_nul_bytes` (boolean): NUL bytes
- `remove_trailing_whitespace` (boolean): Trailing whitespace

### `cc_convert_format` (~182 tokens)

Convert Format

Converts between JSON, CSV, INI, YAML, TOML, XML, and TOON formats.

Args:
  \- input_path (string): Source file
  \- output_path (string): Target file
  \- input_format (string): "json" | "csv" | "ini" | "yaml" | "toml" | "xml" | "toon"
  \- output_format (string): "json" | "csv" | "ini" | "yaml" | "toml" | "xml" | "toon"
  \- json_indent (number): JSON indentation

Input parameters:

- `input_format` (string, required): Input format
- `input_path` (string, required): Source file
- `json_indent` (integer): JSON indentation
- `output_format` (string, required): Output format
- `output_path` (string, required): Target file

### `cc_fix_umlauts` (~100 tokens)

Fix Umlauts

Repairs broken German umlauts in source code files.

Args:
  \- path (string): Path to the file
  \- dry_run (boolean): Preview only
  \- create_backup (boolean): Create backup

Detects 70+ patterns of broken umlauts and replaces them correctly.

Input parameters:

- `create_backup` (boolean): Create backup
- `dry_run` (boolean): Preview only
- `path` (string, required): Path to the file

### `cc_scan_emoji` (~88 tokens)

Scan Emoji

Scans files for emojis and shows ASCII alternatives.

Args:
  \- path (string): Path to the file or directory
  \- recursive (boolean): Scan recursively
  \- extensions (string): Only certain extensions

Useful for systems that don't support Unicode/Emoji.

Input parameters:

- `extensions` (string): Extensions
- `path` (string, required): Path
- `recursive` (boolean): Recursive

### `cc_generate_licenses` (~104 tokens)

Generate Licenses

Generates a third-party license file for an npm or Python project.

Args:
  \- project_dir (string): Project directory
  \- output_path (string): Output file
  \- format (string): "text" | "json" | "csv"

Reads package.json (npm) or pip packages and collects license info.

Input parameters:

- `format` (string): Format
- `output_path` (string, required): Output file
- `project_dir` (string, required): Project directory

### `cc_md_to_html` (~102 tokens)

Markdown to HTML

Converts Markdown to formatted HTML (printable as PDF).

Args:
  \- input_path (string): Path to the Markdown file
  \- output_path (string): Path to the HTML output
  \- title (string, optional): Document title

Produces standalone HTML with CSS styling, printable as PDF via browser.

Input parameters:

- `input_path` (string, required): Markdown file
- `output_path` (string, required): HTML output
- `title` (string): Document title

### `cc_md_to_pdf` (~118 tokens)

Markdown to PDF

Converts Markdown to PDF using a headless browser (Edge/Chrome).

Args:
  \- input_path (string): Path to the Markdown file
  \- output_path (string): Path to the PDF output
  \- title (string, optional): Document title

Uses the same Markdown parser as cc_md_to_html. Requires Edge or Chrome.
Falls back to HTML if no browser is found.

Input parameters:

- `input_path` (string, required): Markdown file
- `output_path` (string, required): PDF output
- `title` (string): Document title

### `cc_diff_files` (~64 tokens)

Diff Files

Vergleicht zwei Dateien und zeigt Unterschiede im Unified-Diff-Format

Input parameters:

- `context_lines` (integer): Number of context lines (default: 3)
- `file_a` (string, required): Path to first file
- `file_b` (string, required): Path to second file

### `cc_regex_test` (~95 tokens)

Regex Tester

Testet reguläre Ausdrücke gegen Text oder Dateiinhalt

Input parameters:

- `file_path` (string): File to test against (alternative to text)
- `flags` (string): Regex flags (g, i, m, s, u)
- `pattern` (string, required): Regular expression pattern
- `replace_with` (string): Optional replacement string
- `text` (string): Text to test against (or use file_path)

### `cc_set_language` (~27 tokens)

Set the output language for CodeCommander tools

Input parameters:

- `language` (string, required): Language code

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/ellmos-ai-ellmos-codecommander-mcp/ellmos-codecommander-mcp#diagnostics

## Score history

- 2026-08-03: 59
- 2026-08-02: 59
- 2026-08-01: 20
- 2026-07-31: 28
- 2026-07-30: 46
- 2026-07-28: 46
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/ellmos-codecommander-mcp
- Socket report: https://socket.dev/npm/package/ellmos-codecommander-mcp
- Repository: https://github.com/ellmos-ai/ellmos-codecommander-mcp
- Changelog RSS feed: https://verifymcp.io/servers/ellmos-ai-ellmos-codecommander-mcp/ellmos-codecommander-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/ellmos-ai-ellmos-codecommander-mcp/ellmos-codecommander-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/ellmos-ai-ellmos-codecommander-mcp/ellmos-codecommander-mcp