# Code Assistant (npm · @j0hanz/code-assistant)

Gemini-powered MCP server for code analysis.

- Trust score: 75/100 (medium)
- Change this week: +29
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- npm · `@j0hanz/code-assistant`: 75/100 (this document), [markdown](https://verifymcp.io/servers/j0hanz-code-assistant/j0hanz-code-assistant.md), [page](https://verifymcp.io/servers/j0hanz-code-assistant/j0hanz-code-assistant)

## Channel facts

- Registry: `npm`
- Package: `@j0hanz/code-assistant`
- Version: `2.0.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (135 of 139), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (135 of 139), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 71/100
  - Repository check failed: the declared repository URL redirects; it must resolve directly.
  - Cryptographically verified build provenance (signed, bound to j0hanz/code-assistant).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 151 days ago).
  - Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 77/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2703 tokens (~142/item across 19 items; 13 tools + 6 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 30/100
  - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add j0hanz-code-assistant -- npx -y @j0hanz/code-assistant
```

### Codex

```bash
codex mcp add j0hanz-code-assistant -- npx -y @j0hanz/code-assistant
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "j0hanz-code-assistant": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@j0hanz/code-assistant"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add j0hanz-code-assistant --command npx --arg -y --arg @j0hanz/code-assistant
```

### Hermes

```yaml
mcp_servers:
  j0hanz-code-assistant:
    command: "npx"
    args: ["-y", "@j0hanz/code-assistant"]
```

### Other

```json
{
  "mcpServers": {
    "j0hanz-code-assistant": {
      "command": "npx",
      "args": [
        "-y",
        "@j0hanz/code-assistant"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 75, 0)

- [functional regression] Security disclosure: fail → unverified

### 2026-08-03 (score 75, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 74, +74)

- [security improvement] Install scripts: unverified → pass
- [security improvement] Provenance: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] The attested source repository moved: j0hanz/code-assistant
- [functional regression] Security disclosure: fail → unverified
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] License: unverified → pass
- [functional improvement] Schema quality: unverified → 100
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] Schema quality: unverified → good
- [functional] Licence: MIT

### 2026-08-01 (score 0, −20)

- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified

### 2026-07-31 (score 20, −8)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 28, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (13)

### `generate_diff` (~93 tokens)

Generate Diff

Generate a diff of the current branch working changes and cache it for all review tools. You MUST call this tool before calling any other review tool. Use "unstaged" for working-tree changes not yet staged, or "staged" for changes already added with git add.

Input parameters:

- `mode` (string, required): "unstaged": working-tree changes not yet staged. "staged": changes added to the index with git add.

Output parameters:

- `error` (object): Error payload when ok is false.
- `ok` (boolean): Whether the tool completed successfully.
- `result` (object): Successful result payload.

### `analyze_pr_impact` (~74 tokens)

Analyze PR Impact

Assess impact and risk from cached diff. Prerequisite: generate_diff. Auto-infer repo/language.

Input parameters:

- `language` (string): Primary language (e.g. TypeScript). Auto-infer from files.
- `repository` (string, required): Repo ID (owner/repo). Auto-infer from git/dir.

Output parameters:

- `error` (object): Error payload when ok is false.
- `ok` (boolean): Whether the tool completed successfully.
- `result` (object): Successful result payload.

### `generate_review_summary` (~73 tokens)

Generate Review Summary

Summarize diff and risk level. Prerequisite: generate_diff. Auto-infer repo/language.

Input parameters:

- `language` (string): Primary language (e.g. TypeScript). Auto-infer from files.
- `repository` (string, required): Repo ID (owner/repo). Auto-infer from git/dir.

Output parameters:

- `error` (object): Error payload when ok is false.
- `ok` (boolean): Whether the tool completed successfully.
- `result` (object): Successful result payload.

### `generate_test_plan` (~111 tokens)

Generate Test Plan

Generate test cases. Prerequisite: generate_diff. Auto-infer repo/language/framework.

Input parameters:

- `language` (string): Primary language (e.g. TypeScript). Auto-infer from files.
- `maxTestCases` (integer): Max test cases (1-30). Default: 15.
- `repository` (string, required): Repo ID (owner/repo). Auto-infer from git/dir.
- `testFramework` (string): Test framework (jest, pytest, etc). Auto-infer.

Output parameters:

- `error` (object): Error payload when ok is false.
- `ok` (boolean): Whether the tool completed successfully.
- `result` (object): Successful result payload.

### `analyze_time_space_complexity` (~49 tokens)

Analyze Time & Space Complexity

Analyze Big-O complexity. Prerequisite: generate_diff. Auto-infer language.

Input parameters:

- `language` (string): Primary language (e.g. TypeScript). Auto-infer from files.

Output parameters:

- `error` (object): Error payload when ok is false.
- `ok` (boolean): Whether the tool completed successfully.
- `result` (object): Successful result payload.

### `detect_api_breaking_changes` (~49 tokens)

Detect API Breaking Changes

Detect breaking API changes. Prerequisite: generate_diff. Auto-infer language.

Input parameters:

- `language` (string): Primary language (e.g. TypeScript). Auto-infer from files.

Output parameters:

- `error` (object): Error payload when ok is false.
- `ok` (boolean): Whether the tool completed successfully.
- `result` (object): Successful result payload.

### `load_file` (~90 tokens)

Load File

Cache a single file for analysis tools (refactor_code, ask_about_code, verify_logic). Overwrites previous cache. Path is relative to server working directory (e.g. src/index.ts) or absolute (e.g. /home/user/project/src/index.ts).

Input parameters:

- `filePath` (string, required): File path relative to workspace root (e.g. src/index.ts) or absolute. Must be within workspace.

Output parameters:

- `error` (object): Error payload when ok is false.
- `ok` (boolean): Whether the tool completed successfully.
- `result` (object): Successful result payload.

### `refactor_code` (~81 tokens)

Refactor Code

Analyze cached file for complexity, duplication, naming, and grouping improvements. Prerequisite: load_file. Set maxSuggestions to cap output (default 10).

Input parameters:

- `language` (string): Primary language (e.g. TypeScript). Auto-infer from files.
- `maxSuggestions` (integer): Max suggestions (1-15). Default: 10.

Output parameters:

- `error` (object): Error payload when ok is false.
- `ok` (boolean): Whether the tool completed successfully.
- `result` (object): Successful result payload.

### `generate_documentation` (~55 tokens)

Generate Documentation

Generate documentation stubs for all public exports in a cached file. Prerequisite: load_file. Auto-infer language.

Input parameters:

- `language` (string): Primary language (e.g. TypeScript). Auto-infer from files.

Output parameters:

- `error` (object): Error payload when ok is false.
- `ok` (boolean): Whether the tool completed successfully.
- `result` (object): Successful result payload.

### `detect_code_smells` (~52 tokens)

Detect Code Smells

Detect structural code smells in a cached file. Prerequisite: load_file. Auto-infer language.

Input parameters:

- `language` (string): Primary language (e.g. TypeScript). Auto-infer from files.

Output parameters:

- `error` (object): Error payload when ok is false.
- `ok` (boolean): Whether the tool completed successfully.
- `result` (object): Successful result payload.

### `ask_about_code` (~61 tokens)

Ask About Code

Answer questions about a cached file. Prerequisite: load_file. Auto-infer language.

Input parameters:

- `language` (string): Primary language (e.g. TypeScript). Auto-infer from files.
- `question` (string, required): Question about the loaded file.

Output parameters:

- `error` (object): Error payload when ok is false.
- `ok` (boolean): Whether the tool completed successfully.
- `result` (object): Successful result payload.

### `verify_logic` (~78 tokens)

Verify Logic

Verify algorithms and logic in a cached file using Gemini code execution sandbox. Prerequisite: load_file. Auto-infer language.

Input parameters:

- `language` (string): Primary language (e.g. TypeScript). Auto-infer from files.
- `question` (string, required): What to verify in the loaded file (e.g. algorithm correctness, edge cases).

Output parameters:

- `error` (object): Error payload when ok is false.
- `ok` (boolean): Whether the tool completed successfully.
- `result` (object): Successful result payload.

### `web_search` (~91 tokens)

Web Search

Google Search with Grounding. Set topic to scope results; responseStyle controls output length.

Input parameters:

- `query` (string, required): Search query.
- `responseStyle` (string): concise: 2-4 sentences. detailed: full explanation. bullets: list. code_focused: code snippets.
- `topic` (string): Domain focus (e.g. "TypeScript", "Docker"). Set to avoid irrelevant results.

Output parameters:

- `error` (object): Error payload when ok is false.
- `ok` (boolean): Whether the tool completed successfully.
- `result` (object): Successful result payload.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/j0hanz-code-assistant/j0hanz-code-assistant#diagnostics

## Score history

- 2026-08-04: 75
- 2026-08-03: 75
- 2026-08-02: 74
- 2026-08-01: 0
- 2026-07-31: 20
- 2026-07-30: 28
- 2026-07-28: 46
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/@j0hanz/code-assistant
- Socket report: https://socket.dev/npm/package/@j0hanz/code-assistant
- Changelog RSS feed: https://verifymcp.io/servers/j0hanz-code-assistant/j0hanz-code-assistant/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/j0hanz-code-assistant/j0hanz-code-assistant/changelog.json
- HTML version of this page: https://verifymcp.io/servers/j0hanz-code-assistant/j0hanz-code-assistant