Attocode Code Intelligence
PYPI · ATTOCODE-CODE-INTEL
Local code search, symbol navigation and change impact for coding agents. No model, no API key.
Available components
Last scanned (17 hours ago)
Scores higher than 70% of PyPI servers
Category Code Search and Documentation
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- 1 of 73 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to eren23/attocode). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability40
- 0% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Fail
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 1771 tokens (~104/item across 17 items; 16 tools + 1 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management13
- Stability observed for 4 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage74
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 21% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 16 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 18 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 0
- Tool safety: pass → unverified ▼ security
- Stability: 0.10 → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Schema quality: 0 → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Package version: 0.1.25 → 0.1.26 functional
- 3 Nov 26 +15
- Malware scan: unverified → pass ▲ security
- 2 Nov 26 −14
- Malware scan: pass → unverified ▼ security
- Package version: 0.1.24 → 0.1.25 functional
- 1 Nov 26 +15
- Tool safety: pass → unverified ▼ security
- Malware scan: unverified → pass ▲ security
- Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
- Capabilities: pass → unverified ▼ functional
- Schema quality: 0 → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Stability: unverified → 0.03 ▲ functional
- Package version: 0.1.23 → 0.1.24 functional
- 31 Oct 26 58
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Analysed pypi/attocode-code-intel@0.1.26
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | pypi |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | eren23/attocode |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/eren23/attocode/.github/workflows/release-intelligence.yml@refs/tags/intel-v0.1.26 |
| Rekor log index | 3691077472 |
| Predicate type | PyPI publish attestation https://docs.pypi.org/attestations/publish/v1 |
| Subject digest | sha256:97b6cd547743e3604f0953aa3dcca6931a0ae245a1f1805b2fdeb0cc6604cc89 |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 73 packages
| Packages resolved | 73 |
|---|---|
| Stale | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
bootstrap ~115
Find where a behavior is implemented in an unfamiliar repository. With task_hint, the result has the code that matches the task, a project summary, a map and the conventions. Args: task_hint: What you want to find or change. indexing_depth: "auto" (default), "eager", "lazy" or "minimal".
| Name | Type | Req | Description |
|---|---|---|---|
| indexing_depth | string | – | – |
| max_tokens | integer | – | – |
| task_hint | string | – | – |
| workspace | string | – | Project path (default: this project) |
No output schema declared.
No examples provided.
call_graph ~108
Follow the calls of a function or method. Args: symbol: Function or method name, qualified or bare. direction: "callees" (what it calls) or "callers" (what calls it). depth: Maximum number of hops (default 1).
| Name | Type | Req | Description |
|---|---|---|---|
| depth | integer | – | – |
| direction | string | – | – |
| max_tokens | integer | – | – |
| symbol | string | yes | – |
| workspace | string | – | Project path (default: this project) |
No output schema declared.
No examples provided.
capabilities ~41
Available tools, profiles, workspace selection, and optional enhancements.
| Name | Type | Req | Description |
|---|---|---|---|
| max_tokens | integer | – | – |
| workspace | string | – | Project path (default: this project) |
No output schema declared.
No examples provided.
cross_references ~146
Find where a symbol is defined and each place that references it: calls, imports and attribute accesses. Args: file_path: When names collide, select the definition in this repository-relative file. line: Select the definition by its start line. cursor: Continue a paged result. page_size: References per page, 1 to 100 (default 20).
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | – |
| file_path | string | – | – |
| line | integer | – | – |
| max_tokens | integer | – | – |
| page_size | integer | – | – |
| symbol_name | string | yes | – |
| workspace | string | – | Project path (default: this project) |
No output schema declared.
No examples provided.
dependencies ~47
Show what a file imports and which files import it.
| Name | Type | Req | Description |
|---|---|---|---|
| max_tokens | integer | – | – |
| path | string | yes | – |
| workspace | string | – | Project path (default: this project) |
No output schema declared.
No examples provided.
explore_codebase ~130
List one directory level: subdirectories with file counts and languages, and files with importance and top symbols. Args: path: Directory relative to the project root ("" for the root). importance_threshold: Minimum file importance, 0.0 to 1.0. task_hint: Optional task text that orders the files.
| Name | Type | Req | Description |
|---|---|---|---|
| importance_threshold | number | – | – |
| max_items | integer | – | – |
| max_tokens | integer | – | – |
| path | string | – | – |
| task_hint | string | – | – |
| workspace | string | – | Project path (default: this project) |
No output schema declared.
No examples provided.
fast_search ~159
Search file contents with a regular expression. A trigram index selects the candidate files first. Args: pattern: A regular expression, for example "def process_.*event". path: Optional subdirectory relative to the project root. selectivity_threshold: Skip the index when more than this share of files can match (default 0.10). explain: Add search diagnostics to the output.
| Name | Type | Req | Description |
|---|---|---|---|
| case_insensitive | boolean | – | – |
| explain | boolean | – | – |
| max_results | integer | – | – |
| max_tokens | integer | – | – |
| path | string | – | – |
| pattern | string | yes | – |
| selectivity_threshold | number | – | – |
| workspace | string | – | Project path (default: this project) |
No output schema declared.
No examples provided.
impact_analysis ~63
List the files that a change to the given files can affect: the files that import them, directly or through other files.
| Name | Type | Req | Description |
|---|---|---|---|
| changed_files | array | yes | – |
| max_tokens | integer | – | – |
| workspace | string | – | Project path (default: this project) |
No output schema declared.
No examples provided.
inspect_symbol ~164
Get a symbol in one call: definition, source excerpt, references, imports and candidate tests. A name is enough. For an ambiguous name, the result lists choices: give the repository-relative file_path and the definition start line to select one. Add task_hint to order the excerpts and tests for your task. For a long definition, follow next_source or set source_start_line. Keep each context_ranges group with its excerpt. Missing relationships do not prove absence.
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | string | – | – |
| line | integer | – | – |
| max_tokens | integer | – | – |
| source_start_line | integer | – | – |
| symbol_name | string | yes | – |
| task_hint | string | – | – |
| workspace | string | – | Project path (default: this project) |
No output schema declared.
No examples provided.
project_summary ~57
Summarize the project: purpose, size, entry points, architecture, layout, dependency layers, tech stack, tests and build.
| Name | Type | Req | Description |
|---|---|---|---|
| max_tokens | integer | – | – |
| workspace | string | – | Project path (default: this project) |
No output schema declared.
No examples provided.
relevant_context ~119
Show the files around the given files: what they import and what imports them, with their top symbols. Args: files: Center file paths. depth: Number of hops, 1 or 2 (default 1). task_hint: Optional task text that orders the files.
| Name | Type | Req | Description |
|---|---|---|---|
| depth | integer | – | – |
| files | array | yes | – |
| include_symbols | boolean | – | – |
| max_tokens | integer | – | – |
| task_hint | string | – | – |
| workspace | string | – | Project path (default: this project) |
No output schema declared.
No examples provided.
review_change ~93
Review changed files for security issues, rule violations and convention problems in one report. Args: files: Files to review (default: the files that git reports as changed). mode: "quick" (security only) or "full".
| Name | Type | Req | Description |
|---|---|---|---|
| files | array | – | – |
| max_tokens | integer | – | – |
| mode | string | – | – |
| workspace | string | – | Project path (default: this project) |
No output schema declared.
No examples provided.
search_symbols ~140
Find symbol definitions by name, best match first: exact, prefix, substring, case-insensitive and camelCase or snake_case parts. Args: name: A name or part of one, for example "parse_file" or "Router". kind: Optional filter: function, class, method, variable, constant, interface or type. task_hint: Optional task text that orders equal matches.
| Name | Type | Req | Description |
|---|---|---|---|
| kind | string | – | – |
| limit | integer | – | – |
| max_tokens | integer | – | – |
| name | string | yes | – |
| task_hint | string | – | – |
| workspace | string | – | Project path (default: this project) |
No output schema declared.
No examples provided.
semantic_search ~147
Search the code by meaning with a natural-language query. Returns files, functions and classes, best first. Args: query: For example "authentication middleware". file_filter: Optional glob, for example "*.py". branch: Remote service only. Local search reads the working tree. mode: "auto" (default), "keyword", or "vector" (waits for embeddings).
| Name | Type | Req | Description |
|---|---|---|---|
| branch | string | – | – |
| file_filter | string | – | – |
| max_tokens | integer | – | – |
| mode | string | – | – |
| query | string | yes | – |
| top_k | integer | – | – |
| workspace | string | – | Project path (default: this project) |
No output schema declared.
No examples provided.
suggest_tests ~69
Suggest candidate tests using imports and syntax; optionally focus on a symbol and task.
| Name | Type | Req | Description |
|---|---|---|---|
| files | array | yes | – |
| max_tokens | integer | – | – |
| symbol_name | string | – | – |
| task_hint | string | – | – |
| workspace | string | – | Project path (default: this project) |
No output schema declared.
No examples provided.
symbols ~48
List the functions, classes and methods that a file defines.
| Name | Type | Req | Description |
|---|---|---|---|
| max_tokens | integer | – | – |
| path | string | yes | – |
| workspace | string | – | Project path (default: this project) |
No output schema declared.
No examples provided.
How do I install the Attocode Code Intelligence MCP server?
Attocode Code Intelligence runs locally as a PyPI package, launched with uvx attocode-code-intel. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · attocode-code-intel
claude mcp add eren23-attocode-code-intel -- uvx attocode-code-intel
What is the Attocode Code Intelligence MCP server?
Attocode Code Intelligence is an MCP server listed in the public MCP registry as io.github.eren23/attocode-code-intel. Local code search, symbol navigation and change impact for coding agents. No model, no API key. This page covers its PyPI package (attocode-code-intel).
Is the Attocode Code Intelligence MCP server safe to use?
Attocode Code Intelligence scores 74 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 4 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Attocode Code Intelligence MCP server expose?
Attocode Code Intelligence exposes 16 tools: impact_analysis, cross_references, call_graph, dependencies, symbols, and 11 more. Their descriptions and schemas cost roughly 1,646 tokens of context every time the server is loaded.
Is the Attocode Code Intelligence MCP server still maintained?
Attocode Code Intelligence is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Attocode Code Intelligence MCP server under?
Attocode Code Intelligence declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.