# Attocode Code Intelligence (pypi · attocode-code-intel)

Local code search, symbol navigation and change impact for coding agents. No model, no API key.

- Trust score: 74/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-04

## Components

- pypi · `attocode-code-intel`: 74/100 (this document), [markdown](https://verifymcp.io/servers/eren23-attocode-code-intel/attocode-code-intel.md), [page](https://verifymcp.io/servers/eren23-attocode-code-intel/attocode-code-intel)

## Channel facts

- Registry: `pypi`
- Package: `attocode-code-intel`
- Version: `0.1.26`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-04.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - Runs hatchling.build at install time, a recognised build step with no custom scripting around it.
  - 1 of 73 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to eren23/attocode).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 0 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 40/100
  - 0% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1771 tokens (~104/item across 17 items; 16 tools + 1 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 13/100
  - Stability observed for 4 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 74/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 21% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 16 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 18 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the Attocode Code Intelligence MCP server?

Attocode Code Intelligence runs locally as a PyPI package, launched with uvx attocode-code-intel. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add eren23-attocode-code-intel -- uvx attocode-code-intel
```

### Cursor

```json
{
  "mcpServers": {
    "eren23-attocode-code-intel": {
      "command": "uvx",
      "args": [
        "attocode-code-intel"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "eren23-attocode-code-intel": {
      "command": "uvx",
      "args": [
        "attocode-code-intel"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add eren23-attocode-code-intel -- uvx attocode-code-intel
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "eren23-attocode-code-intel": {
      "type": "local",
      "command": [
        "uvx",
        "attocode-code-intel"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add eren23-attocode-code-intel --command uvx --arg attocode-code-intel
```

### Hermes

```yaml
mcp_servers:
  eren23-attocode-code-intel:
    command: "uvx"
    args: ["attocode-code-intel"]
```

### Netclaw

```json
{
  "McpServers": {
    "eren23-attocode-code-intel": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "attocode-code-intel"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add eren23-attocode-code-intel -t stdio -c uvx -a attocode-code-intel
```

### Other

```json
{
  "mcpServers": {
    "eren23-attocode-code-intel": {
      "command": "uvx",
      "args": [
        "attocode-code-intel"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-04 (score 74, 0)

- [security regression] Tool safety: pass → unverified
- [security regression] Stability: 0.10 → unverified
- [functional regression] Capabilities: pass → unverified
- [functional regression] Schema quality: 0 → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] Package version: 0.1.25 → 0.1.26

### 2026-11-03 (score 74, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-11-02 (score 59, −14)

- [security regression] Malware scan: pass → unverified
- [functional] Package version: 0.1.24 → 0.1.25

### 2026-11-01 (score 73, +15)

- [security regression] Tool safety: pass → unverified
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional regression] Capabilities: pass → unverified
- [functional regression] Schema quality: 0 → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Stability: unverified → 0.03
- [functional] Package version: 0.1.23 → 0.1.24

### 2026-10-31 (score 58)

First indexed and scored.

## MCP tools (16)

### `impact_analysis` (~63 tokens)

List the files that a change to the given files can affect: the files that import them, directly or through other files.

Input parameters:

- `changed_files` (array, required)
- `max_tokens` (integer)
- `workspace` (string): Project path (default: this project)

### `cross_references` (~146 tokens)

Find where a symbol is defined and each place that references it: calls, imports and attribute accesses.

Args:
    file_path: When names collide, select the definition in this repository-relative file.
    line: Select the definition by its start line.
    cursor: Continue a paged result.
    page_size: References per page, 1 to 100 (default 20).

Input parameters:

- `cursor` (string)
- `file_path` (string)
- `line` (integer)
- `max_tokens` (integer)
- `page_size` (integer)
- `symbol_name` (string, required)
- `workspace` (string): Project path (default: this project)

### `call_graph` (~108 tokens)

Follow the calls of a function or method.

Args:
    symbol: Function or method name, qualified or bare.
    direction: "callees" (what it calls) or "callers" (what calls it).
    depth: Maximum number of hops (default 1).

Input parameters:

- `depth` (integer)
- `direction` (string)
- `max_tokens` (integer)
- `symbol` (string, required)
- `workspace` (string): Project path (default: this project)

### `dependencies` (~47 tokens)

Show what a file imports and which files import it.

Input parameters:

- `max_tokens` (integer)
- `path` (string, required)
- `workspace` (string): Project path (default: this project)

### `symbols` (~48 tokens)

List the functions, classes and methods that a file defines.

Input parameters:

- `max_tokens` (integer)
- `path` (string, required)
- `workspace` (string): Project path (default: this project)

### `search_symbols` (~140 tokens)

Find symbol definitions by name, best match first: exact, prefix, substring, case-insensitive and camelCase or snake_case parts.

Args:
    name: A name or part of one, for example "parse_file" or "Router".
    kind: Optional filter: function, class, method, variable, constant, interface or type.
    task_hint: Optional task text that orders equal matches.

Input parameters:

- `kind` (string)
- `limit` (integer)
- `max_tokens` (integer)
- `name` (string, required)
- `task_hint` (string)
- `workspace` (string): Project path (default: this project)

### `inspect_symbol` (~164 tokens)

Get a symbol in one call: definition, source excerpt, references, imports and candidate tests.

A name is enough. For an ambiguous name, the result lists choices: give the repository-relative file_path
and the definition start line to select one. Add task_hint to order the excerpts and tests for your task.
For a long definition, follow next_source or set source_start_line. Keep each context_ranges group with
its excerpt. Missing relationships do not prove absence.

Input parameters:

- `file_path` (string)
- `line` (integer)
- `max_tokens` (integer)
- `source_start_line` (integer)
- `symbol_name` (string, required)
- `task_hint` (string)
- `workspace` (string): Project path (default: this project)

### `explore_codebase` (~130 tokens)

List one directory level: subdirectories with file counts and languages, and files with importance and top symbols.

Args:
    path: Directory relative to the project root ("" for the root).
    importance_threshold: Minimum file importance, 0.0 to 1.0.
    task_hint: Optional task text that orders the files.

Input parameters:

- `importance_threshold` (number)
- `max_items` (integer)
- `max_tokens` (integer)
- `path` (string)
- `task_hint` (string)
- `workspace` (string): Project path (default: this project)

### `project_summary` (~57 tokens)

Summarize the project: purpose, size, entry points, architecture, layout, dependency layers, tech stack, tests and build.

Input parameters:

- `max_tokens` (integer)
- `workspace` (string): Project path (default: this project)

### `bootstrap` (~115 tokens)

Find where a behavior is implemented in an unfamiliar repository.

With task_hint, the result has the code that matches the task, a project summary, a map and the conventions.

Args:
    task_hint: What you want to find or change.
    indexing_depth: "auto" (default), "eager", "lazy" or "minimal".

Input parameters:

- `indexing_depth` (string)
- `max_tokens` (integer)
- `task_hint` (string)
- `workspace` (string): Project path (default: this project)

### `relevant_context` (~119 tokens)

Show the files around the given files: what they import and what imports them, with their top symbols.

Args:
    files: Center file paths.
    depth: Number of hops, 1 or 2 (default 1).
    task_hint: Optional task text that orders the files.

Input parameters:

- `depth` (integer)
- `files` (array, required)
- `include_symbols` (boolean)
- `max_tokens` (integer)
- `task_hint` (string)
- `workspace` (string): Project path (default: this project)

### `review_change` (~93 tokens)

Review changed files for security issues, rule violations and convention problems in one report.

Args:
    files: Files to review (default: the files that git reports as changed).
    mode: "quick" (security only) or "full".

Input parameters:

- `files` (array)
- `max_tokens` (integer)
- `mode` (string)
- `workspace` (string): Project path (default: this project)

### `suggest_tests` (~69 tokens)

Suggest candidate tests using imports and syntax; optionally focus on a symbol and task.

Input parameters:

- `files` (array, required)
- `max_tokens` (integer)
- `symbol_name` (string)
- `task_hint` (string)
- `workspace` (string): Project path (default: this project)

### `semantic_search` (~147 tokens)

Search the code by meaning with a natural-language query. Returns files, functions and classes, best first.

Args:
    query: For example "authentication middleware".
    file_filter: Optional glob, for example "*.py".
    branch: Remote service only. Local search reads the working tree.
    mode: "auto" (default), "keyword", or "vector" (waits for embeddings).

Input parameters:

- `branch` (string)
- `file_filter` (string)
- `max_tokens` (integer)
- `mode` (string)
- `query` (string, required)
- `top_k` (integer)
- `workspace` (string): Project path (default: this project)

### `fast_search` (~159 tokens)

Search file contents with a regular expression. A trigram index selects the candidate files first.

Args:
    pattern: A regular expression, for example "def process_.*event".
    path: Optional subdirectory relative to the project root.
    selectivity_threshold: Skip the index when more than this share of files can match (default 0.10).
    explain: Add search diagnostics to the output.

Input parameters:

- `case_insensitive` (boolean)
- `explain` (boolean)
- `max_results` (integer)
- `max_tokens` (integer)
- `path` (string)
- `pattern` (string, required)
- `selectivity_threshold` (number)
- `workspace` (string): Project path (default: this project)

### `capabilities` (~41 tokens)

Available tools, profiles, workspace selection, and optional enhancements.

Input parameters:

- `max_tokens` (integer)
- `workspace` (string): Project path (default: this project)

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Dependencies. The full working is on the page: https://verifymcp.io/servers/eren23-attocode-code-intel/attocode-code-intel#diagnostics

## Score history

- 2026-11-04: 74
- 2026-11-03: 74
- 2026-11-02: 59
- 2026-11-01: 73
- 2026-10-31: 58

## Common questions

### What is the Attocode Code Intelligence MCP server?

Attocode Code Intelligence is an MCP server listed in the public MCP registry as io.github.eren23/attocode-code-intel. Local code search, symbol navigation and change impact for coding agents. No model, no API key. This page covers its PyPI package (attocode-code-intel).

### Is the Attocode Code Intelligence MCP server safe to use?

Attocode Code Intelligence scores 74 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 4 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Attocode Code Intelligence MCP server expose?

Attocode Code Intelligence exposes 16 tools: impact_analysis, cross_references, call_graph, dependencies, symbols, and 11 more. Their descriptions and schemas cost roughly 1,646 tokens of context every time the server is loaded.

### Is the Attocode Code Intelligence MCP server still maintained?

Attocode Code Intelligence is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Attocode Code Intelligence MCP server under?

Attocode Code Intelligence declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- PyPI project: https://pypi.org/project/attocode-code-intel/
- Socket report: https://socket.dev/pypi/package/attocode-code-intel
- Repository: https://github.com/eren23/attocode
- Changelog RSS feed: https://verifymcp.io/servers/eren23-attocode-code-intel/attocode-code-intel.xml
- Changelog JSON feed: https://verifymcp.io/servers/eren23-attocode-code-intel/attocode-code-intel.json
- HTML version of this page: https://verifymcp.io/servers/eren23-attocode-code-intel/attocode-code-intel