io.github.FelixWaweru/code-fundi-mcp
NPM · @CODEFUNDI/CODE-FUNDI-MCP · SCANNED SEP 20
CodeFundi MCP server for codebase mapping and blast-radius analysis.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 71 of 190 dependencies flagged as unhealthy (2 deprecated). View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 52 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability78
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2865 tokens (~106/item across 27 items; 27 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management90
- Stability observed for 27 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage98
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 94% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "code-fundi-chat" implies "send" and declares readOnlyHint instead, contradicting what its own name says it does. See how to fix → Fail
- An AI judge read all 27 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.FelixWaweru/code-fundi-mcp server?
io.github.FelixWaweru/code-fundi-mcp runs locally as an npm package, launched with npx -y @codefundi/code-fundi-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @codefundi/code-fundi-mcp
claude mcp add felixwaweru-code-fundi-mcp -- npx -y @codefundi/code-fundi-mcp
{
"mcpServers": {
"felixwaweru-code-fundi-mcp": {
"command": "npx",
"args": [
"-y",
"@codefundi/code-fundi-mcp"
]
}
}
} {
"servers": {
"felixwaweru-code-fundi-mcp": {
"command": "npx",
"args": [
"-y",
"@codefundi/code-fundi-mcp"
]
}
}
} codex mcp add felixwaweru-code-fundi-mcp -- npx -y @codefundi/code-fundi-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"felixwaweru-code-fundi-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"@codefundi/code-fundi-mcp"
],
"enabled": true
}
}
} openclaw mcp add felixwaweru-code-fundi-mcp --command npx --arg -y --arg @codefundi/code-fundi-mcp
mcp_servers:
felixwaweru-code-fundi-mcp:
command: "npx"
args: ["-y", "@codefundi/code-fundi-mcp"] {
"McpServers": {
"felixwaweru-code-fundi-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@codefundi/code-fundi-mcp"
]
}
}
} assistant mcp add felixwaweru-code-fundi-mcp -t stdio -c npx -a -y @codefundi/code-fundi-mcp
{
"mcpServers": {
"felixwaweru-code-fundi-mcp": {
"command": "npx",
"args": [
"-y",
"@codefundi/code-fundi-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 0
- Security disclosure: fail → unverified ▼ functional
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 −3
- Stability: pass → 0.80 functional
- 16 Sept 26 +1
- Stability: 0.97 → pass security
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 −3
- Stability: pass → 0.80 functional
- 9 Sept 26 +1
- Stability: 0.97 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@codefundi/code-fundi-mcp@0.1.4
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 190 packages
| Packages resolved | 190 |
|---|---|
| Deprecated | 2 |
| Stale | 70 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
code-fundi-activity-stats ~49
Get daily activity statistics for a given date range. Shows queries per day with credit costs.
| Name | Type | Req | Description |
|---|---|---|---|
| range | string | – | Time range per OpenAPI (default: 7d) |
No output schema declared.
No examples provided.
code-fundi-auth-authenticate ~205
Start Code-Fundi authentication (POST /v2/auth/authenticate). No existing API key required. Use auth_mode otp for new or returning users: set should_create_user true on first signup, false on sign-in. Sends a 6-digit email OTP (not a magic link); then call code-fundi-auth-verify after the human user provides the code. Password mode: pass password here (sent as X-CodeFundi-Auth-Password header only); should_create_user false for sign-in. On success with an active key, the API key is configured in-memory for this MCP session only.
| Name | Type | Req | Description |
|---|---|---|---|
| auth_mode | string | yes | Authentication mode: 'otp' for email code, 'password' for password-based |
| string | yes | Email address to authenticate | |
| password | string | – | Password (only used when auth_mode is 'password') |
| should_create_user | boolean | – | Set to true for new user registration (default: false) |
No output schema declared.
No examples provided.
code-fundi-auth-resend ~89
Resend the OTP email (POST /v2/auth/resend) when the previous code expired or was not received. Use after code-fundi-auth-authenticate, before code-fundi-auth-verify. Default type is signup for new accounts.
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | Email address to resend the code to | |
| type | string | – | Resend type (default: signup) |
No output schema declared.
No examples provided.
code-fundi-auth-verify ~123
Complete OTP sign-in (POST /v2/auth/verify). Requires the 6-digit code from the user's email after code-fundi-auth-authenticate. The human user must supply the token — ask them explicitly. On success, activates the API key and configures it in-memory for all subsequent tools in this MCP session. Persist CODEFUNDI_API_KEY in MCP config if the user wants auth to survive restarts.
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | Email address used in the authenticate step | |
| token | string | yes | 6-digit OTP verification code |
No output schema declared.
No examples provided.
code-fundi-chat ~210
Send a message to Code-Fundi AI (Fundi chat: POST /v1/fundi/chat). Supports threading, optional code context, indexed repository knowledge (`knowledge_id`), embeddings memory, and voice mode. Responses are streamed by the API and returned as plain text (or JSON when the server uses JSON mode).
| Name | Type | Req | Description |
|---|---|---|---|
| code_block | string | – | Optional code snippet combined with the question for code-aware answers |
| context | array | – | Previous conversation messages for context |
| conversation | string | – | Conversation ID for threading (continues a previous conversation) |
| embed | boolean | – | Enable conversation memory via embeddings (default false) |
| knowledge_id | array | – | Repository / data-source UUIDs to pull indexed knowledge context into the chat (API field `knowledge`) |
| model | string | – | AI model ID to use |
| prompt | string | yes | User message (sent to the API as `question`) |
| voice | boolean | – | Request voice/audio path on the server (default false) |
No output schema declared.
No examples provided.
code-fundi-conversation ~34
Get all messages in a conversation thread by its conversation ID.
| Name | Type | Req | Description |
|---|---|---|---|
| conversation_id | string | yes | Conversation thread UUID |
No output schema declared.
No examples provided.
code-fundi-disable-api-key ~74
Disable a Code-Fundi API key by UUID (`DELETE /v2/keys/{key_id}`). Use `code-fundi-list-api-keys` to find key IDs. Does not rotate the active key unless you disable the one in use.
| Name | Type | Req | Description |
|---|---|---|---|
| key_id | string | yes | API key UUID to disable |
No output schema declared.
No examples provided.
code-fundi-file-docs ~83
Get AI-generated documentation for a specific file in an indexed repository. Returns detailed documentation including summaries, functions, dependencies, and code analysis.
| Name | Type | Req | Description |
|---|---|---|---|
| fields | string | – | Field preset (default: full). |
| file_id | string | yes | File UUID (from code-fundi-list-files results) |
| repo_key | string | yes | Repository UUID or clone URL |
No output schema declared.
No examples provided.
code-fundi-history-item ~43
Get the full details of a single history entry by its ID, including the complete response and knowledge sources.
| Name | Type | Req | Description |
|---|---|---|---|
| history_id | string | yes | History entry UUID |
No output schema declared.
No examples provided.
code-fundi-index-repo ~98
Index a new GitHub repository in Code-Fundi, or update an existing one. After indexing, the repository's files will be searchable via code-fundi-search.
| Name | Type | Req | Description |
|---|---|---|---|
| branch | string | – | Branch to index (default: main/master) |
| update | boolean | – | If true, re-index an already indexed repo |
| url | string | yes | Git clone URL (e.g. https://github.com/owner/repo) |
No output schema declared.
No examples provided.
code-fundi-language-stats ~22
Get programming language usage statistics across all indexed repositories.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
code-fundi-list-api-keys ~28
List all Code-Fundi API keys (masked) for the authenticated account.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
code-fundi-list-files ~119
List files in an indexed Code-Fundi repository. Supports search by file name/path and pagination. Use the returned file IDs with code-fundi-file-docs to get documentation.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Max results per page |
| offset | number | – | Pagination offset |
| order | string | – | Sort direction |
| order_by | string | – | Sort field (default: file_path) |
| repo_key | string | yes | Repository UUID or clone URL |
| search | string | – | Case-insensitive substring filter on file name/path |
No output schema declared.
No examples provided.
code-fundi-list-history ~172
List your Code-Fundi query history with optional filters for date range, category, endpoint, and repository.
| Name | Type | Req | Description |
|---|---|---|---|
| categories | array | – | Filter by categories |
| conversation_id | string | – | Filter by conversation thread |
| endpoint | string | – | Exact endpoint match (e.g. 'v2.search') |
| from | string | – | Start date (ISO 8601) |
| limit | number | – | Max results per page |
| offset | number | – | Pagination offset |
| query_type | string | – | Exact query_type match (e.g. 'search:semantic') |
| query_type_prefix | string | – | Prefix match on query_type (e.g. 'search:') |
| repo_id | string | – | Filter by repository UUID |
| to | string | – | End date (ISO 8601) |
No output schema declared.
No examples provided.
code-fundi-list-models ~38
List the curated Code-Fundi chat model catalog (GET /v2/models) with providers, required tier, and context length.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
code-fundi-list-public-repos ~143
Browse the global catalog of indexed public repositories (across all Code-Fundi users). Supports pagination, an `updated_since` cursor, and optional embedding of each repo's largest files. This endpoint does not require an API key.
| Name | Type | Req | Description |
|---|---|---|---|
| file_count | integer | – | When > 0, embed this many largest files per repo (default 0) |
| internal_secret | string | – | Internal sitemap secret for unlimited server-side enumeration (optional) |
| limit | integer | – | Max results per page (default 100) |
| offset | integer | – | Pagination offset |
| since | string | – | Return repos updated strictly after this ISO 8601 timestamp |
No output schema declared.
No examples provided.
code-fundi-list-repos ~107
List all indexed repositories in your Code-Fundi account. Supports pagination, scope filtering (private/public), and name search.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Max results per page (default 25) |
| offset | number | – | Pagination offset |
| order | string | – | Sort direction |
| order_by | string | – | Field to sort by |
| scope | string | – | Filter by repository visibility |
| search | string | – | Case-insensitive substring filter on repo name |
No output schema declared.
No examples provided.
code-fundi-model-limits ~63
Get the AI model limits and tier configuration for your account (GET /v2/models/limits): subscription tokens, the active model's context/knowledge limits, and account limits such as max repositories, files per repo, history retention, and organization access.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
code-fundi-regenerate-api-key ~42
Regenerate the Code-Fundi API key. The full key is shown only once. The new key is automatically configured for all subsequent tool calls.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
code-fundi-repo-blueprint ~112
Get the canonical repository intelligence overview: README documentation, top dependencies, top functions/variables, and aggregated coding conventions (PRO+ only). This is the successor to `code-fundi-repo-readme`. Consumes credits.
| Name | Type | Req | Description |
|---|---|---|---|
| conventions_path_prefix | string | – | Optional path prefix filter for conventions aggregation (PRO+) |
| demo | boolean | – | Run in demo mode (pre-signup, public data, IP-based credits) |
| repo_key | string | yes | Repository UUID or clone URL |
No output schema declared.
No examples provided.
code-fundi-repo-map ~173
Build a cross-repository dependency map showing where a dependency appears across the source repo, optional compared repos, and (optionally) the public index. Returns structured JSON. Consumes credits.
| Name | Type | Req | Description |
|---|---|---|---|
| compare_repos | array | – | Repository UUIDs to compare against (max 10) |
| demo | boolean | – | Run in demo mode (pre-signup, public data, IP-based credits) |
| dependency | string | – | Dependency name to map |
| files_per_repo | integer | – | Max files per repo (default 25) |
| include_public_index | boolean | – | Include matches from the public index (default false) |
| limit | integer | – | Max dependencies (default 25) |
| repo_key | string | yes | Repository UUID or clone URL |
| type | string | – | Dependency type filter |
No output schema declared.
No examples provided.
code-fundi-repo-radius ~177
Run blast-radius / file impact analysis for one or more files or dependencies. Returns projected data flows, entry points, and call edges. Requires PRO, ENTERPRISE, or ADMIN tier (STARTUP is not eligible) and consumes credits.
| Name | Type | Req | Description |
|---|---|---|---|
| demo | boolean | – | Run in demo mode (pre-signup, public data, IP-based credits) |
| dependencies | array | – | Multiple dependency names to analyze |
| dependency | string | – | Single dependency name to analyze |
| file | string | – | Single file path to analyze |
| files | array | – | Multiple file paths to analyze |
| include | array | – | Projection kinds to include (e.g. data_flows, entry_points, call_edges) |
| limit | integer | – | Max targets to return |
| repo_key | string | yes | Repository UUID or clone URL |
No output schema declared.
No examples provided.
code-fundi-repo-readme ~68
Get the parsed README documentation for a repository. Provide either a repository UUID or a clone URL. Deprecated in favor of code-fundi-repo-blueprint, which returns the same README plus dependency and convention intelligence.
| Name | Type | Req | Description |
|---|---|---|---|
| repo_key | string | yes | Repository UUID or clone URL |
No output schema declared.
No examples provided.
code-fundi-repo-status ~38
Check the indexing status of a repository by its clone URL.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | Git clone URL to check status for |
No output schema declared.
No examples provided.
code-fundi-research ~222
Search Code-Fundi repositories AND get an AI-synthesized analysis of the results. This performs a search, then streams an AI response that analyzes the matching code files. Use this when you need both code context and an intelligent summary/explanation.
| Name | Type | Req | Description |
|---|---|---|---|
| dependencies | array | – | Filter by dependencies in code summaries |
| fields | string | – | Documentation detail level |
| file_paths | array | – | – |
| file_types | array | – | – |
| function_names | array | – | Filter by function names |
| has_functions | boolean | – | Only files with functions |
| max_lines | integer | – | – |
| min_lines | integer | – | – |
| model | string | – | AI model to use for analysis |
| query | string | yes | The research query |
| repo_ids | array | – | Filter by repository UUIDs |
| repo_urls | array | – | Filter by repository clone URLs |
| scan_mode | string | – | Search mode |
| scope | string | – | Search scope |
| similarity_threshold | number | – | – |
| visibility | string | – | – |
No output schema declared.
No examples provided.
code-fundi-search ~276
Search across indexed Code-Fundi repositories using semantic search, grep over docs, or grep over code. Returns matching files with similarity scores, paths, and optional documentation. Use scan_mode to choose between semantic (vector), grep_docs (substring on documentation), or grep_code (substring on source code).
| Name | Type | Req | Description |
|---|---|---|---|
| dependencies | array | – | Filter by declared dependencies in code summaries |
| fields | string | – | Documentation detail level per result (default: full). |
| file_paths | array | – | Filter by file path patterns |
| file_types | array | – | Filter by file extensions (e.g. ['.ts', '.py']) |
| function_names | array | – | Filter by function names in code summaries |
| has_functions | boolean | – | Only return files that define functions |
| max_lines | integer | – | Maximum file line count |
| min_lines | integer | – | Minimum file line count |
| query | string | yes | The search query string |
| repo_ids | array | – | Filter by repository UUIDs |
| repo_urls | array | – | Filter by repository clone URLs |
| scan_mode | string | – | Search mode (default: semantic) |
| scope | string | – | Search scope (default: all) |
| similarity_threshold | number | – | Minimum similarity score (0-1) |
| visibility | string | – | Repository visibility filter |
No output schema declared.
No examples provided.
code-fundi-usage-stats ~57
Get query-type usage statistics for a given date range. Shows breakdown by query type with counts, credit costs, and average durations.
| Name | Type | Req | Description |
|---|---|---|---|
| range | string | – | Time range per OpenAPI (default: 7d) |
No output schema declared.
No examples provided.
What is the io.github.FelixWaweru/code-fundi-mcp server?
io.github.FelixWaweru/code-fundi-mcp is listed in the public MCP registry as io.github.FelixWaweru/code-fundi-mcp. CodeFundi MCP server for codebase mapping and blast-radius analysis. This page covers its npm package (@codefundi/code-fundi-mcp).
Is the io.github.FelixWaweru/code-fundi-mcp server safe to use?
io.github.FelixWaweru/code-fundi-mcp scores 81 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.FelixWaweru/code-fundi-mcp server expose?
io.github.FelixWaweru/code-fundi-mcp exposes 27 tools: code-fundi-search, code-fundi-research, code-fundi-list-repos, code-fundi-index-repo, code-fundi-repo-status, and 22 more. Their descriptions and schemas cost roughly 2,865 tokens of context every time the server is loaded.
Is the io.github.FelixWaweru/code-fundi-mcp server still maintained?
io.github.FelixWaweru/code-fundi-mcp is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.FelixWaweru/code-fundi-mcp server under?
io.github.FelixWaweru/code-fundi-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.