# BACH CodeCommander (npm · bach-codecommander-mcp)

17 tools for code analysis, JSON repair, encoding fix, format conversion, diff, and regex.

- Trust score: 59/100 (low)
- Change this week: +19
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- npm · `bach-codecommander-mcp`: 59/100 (this document), [markdown](https://verifymcp.io/servers/lukisch-bach-codecommander-mcp/bach-codecommander-mcp.md), [page](https://verifymcp.io/servers/lukisch-bach-codecommander-mcp/bach-codecommander-mcp)

## Channel facts

- Registry: `npm`
- Package: `bach-codecommander-mcp`
- Version: `1.3.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Supply Chain Security**: 83/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (106 of 110), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 19/100
  - Repository check failed: the declared repository URL redirects; it must resolve directly.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 152 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 54/100
  - AI-judged instruction clarity (fair).
  - Tool/resource definitions use about 1706 tokens (~94/item across 18 items; 18 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add lukisch-bach-codecommander-mcp -- npx -y bach-codecommander-mcp
```

### Codex

```bash
codex mcp add lukisch-bach-codecommander-mcp -- npx -y bach-codecommander-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "lukisch-bach-codecommander-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "bach-codecommander-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add lukisch-bach-codecommander-mcp --command npx --arg -y --arg bach-codecommander-mcp
```

### Hermes

```yaml
mcp_servers:
  lukisch-bach-codecommander-mcp:
    command: "npx"
    args: ["-y", "bach-codecommander-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "lukisch-bach-codecommander-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "bach-codecommander-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 59, +3)

- [security regression] CVE-2026-69207 affects this package: medium
- [security regression] Known CVEs: partial → fail
- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 56, +40)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional regression] Security disclosure: fail → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] License: unverified → pass
- [functional improvement] Schema quality: unverified → fair
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional] Licence: MIT

### 2026-08-01 (score 16, +16)

- [functional improvement] Tool coverage: unverified → 100

### 2026-07-31 (score 0, −40)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-28 (score 40, 0)

- [functional regression] Security disclosure: unverified → fail

### 2026-07-27 (score 40)

First indexed and scored.

## MCP tools (18)

### `cc_analyze_code` (~68 tokens)

Analyze Code

Analyzes a Python file: classes, functions, imports, metrics.

Args:
  \- path (string): Path to the Python file

Returns:
  \- Classes with methods, functions, import analysis, LOC, complexity

Input parameters:

- `path` (string, required): Path to the Python file

### `cc_analyze_methods` (~86 tokens)

Analyze Methods

Detailed method analysis of a Python file.

Args:
  \- path (string): Path to the Python file
  \- class_name (string, optional): Only methods of this class

Returns:
  \- Methods with parameters, decorators, complexity, data flow

Input parameters:

- `class_name` (string): Only analyze this class
- `path` (string, required): Path to the Python file

### `cc_extract_classes` (~82 tokens)

Extract Classes

Extracts Python classes and functions from a file as separate text blocks.

Args:
  \- path (string): Path to the Python file
  \- output_dir (string, optional): Output directory (otherwise display only)

Useful for code review and documentation.

Input parameters:

- `output_dir` (string): Output directory
- `path` (string, required): Path to the Python file

### `cc_organize_imports` (~99 tokens)

Organize Imports

Organizes Python imports per PEP 8: sorted, deduplicated, grouped.

Args:
  \- path (string): Path to the Python file
  \- dry_run (boolean): Preview only

Groups: 1) __future__ 2) stdlib 3) third-party 4) local

Input parameters:

- `dry_run` (boolean): Preview only
- `path` (string, required): Path to the Python file

### `cc_diagnose_imports` (~65 tokens)

Diagnose Imports

Diagnoses import issues: missing modules, circular imports, unused imports.

Args:
  \- path (string): Path to the Python file

Detects: Missing modules, suspected circular imports, import issues

Input parameters:

- `path` (string, required): Path to the Python file

### `cc_fix_json` (~99 tokens)

Fix JSON

Automatically repairs common JSON errors.

Args:
  \- path (string): Path to the JSON file
  \- dry_run (boolean): Only show issues
  \- create_backup (boolean): Create backup

Repairs: BOM, trailing commas, single quotes, comments, NUL bytes

Input parameters:

- `create_backup` (boolean): Create backup
- `dry_run` (boolean): Preview only
- `path` (string, required): Path to the JSON file

### `cc_validate_json` (~45 tokens)

Validate JSON

Validates JSON with detailed error information and position.

Args:
  \- path (string): Path to the JSON file

Input parameters:

- `path` (string, required): Path to the JSON file

### `cc_fix_encoding` (~103 tokens)

Fix Encoding

Repairs encoding errors (Mojibake, double UTF-8).

Args:
  \- path (string): Path to the file
  \- dry_run (boolean): Preview only
  \- create_backup (boolean): Create backup

Repairs 27+ Mojibake patterns (German, French, Spanish).

Input parameters:

- `create_backup` (boolean): Create backup
- `dry_run` (boolean): Preview only
- `path` (string, required): Path to the file

### `cc_cleanup_file` (~178 tokens)

Cleanup File

Cleans up source code files: BOM, NUL bytes, trailing whitespace, line endings.

Args:
  \- path (string): Path to the file
  \- remove_bom (boolean): Remove BOM
  \- remove_trailing_whitespace (boolean): Trailing whitespace
  \- normalize_line_endings (string): "lf" | "crlf"
  \- remove_nul_bytes (boolean): Remove NUL bytes
  \- dry_run (boolean): Preview only

Input parameters:

- `dry_run` (boolean): Preview only
- `normalize_line_endings` (string): Line endings
- `path` (string, required): Path to the file
- `remove_bom` (boolean): Remove BOM
- `remove_nul_bytes` (boolean): NUL bytes
- `remove_trailing_whitespace` (boolean): Trailing whitespace

### `cc_convert_format` (~182 tokens)

Convert Format

Converts between JSON, CSV, INI, YAML, TOML, XML, and TOON formats.

Args:
  \- input_path (string): Source file
  \- output_path (string): Target file
  \- input_format (string): "json" | "csv" | "ini" | "yaml" | "toml" | "xml" | "toon"
  \- output_format (string): "json" | "csv" | "ini" | "yaml" | "toml" | "xml" | "toon"
  \- json_indent (number): JSON indentation

Input parameters:

- `input_format` (string, required): Input format
- `input_path` (string, required): Source file
- `json_indent` (integer): JSON indentation
- `output_format` (string, required): Output format
- `output_path` (string, required): Target file

### `cc_fix_umlauts` (~100 tokens)

Fix Umlauts

Repairs broken German umlauts in source code files.

Args:
  \- path (string): Path to the file
  \- dry_run (boolean): Preview only
  \- create_backup (boolean): Create backup

Detects 70+ patterns of broken umlauts and replaces them correctly.

Input parameters:

- `create_backup` (boolean): Create backup
- `dry_run` (boolean): Preview only
- `path` (string, required): Path to the file

### `cc_scan_emoji` (~88 tokens)

Scan Emoji

Scans files for emojis and shows ASCII alternatives.

Args:
  \- path (string): Path to the file or directory
  \- recursive (boolean): Scan recursively
  \- extensions (string): Only certain extensions

Useful for systems that don't support Unicode/Emoji.

Input parameters:

- `extensions` (string): Extensions
- `path` (string, required): Path
- `recursive` (boolean): Recursive

### `cc_generate_licenses` (~104 tokens)

Generate Licenses

Generates a third-party license file for an npm or Python project.

Args:
  \- project_dir (string): Project directory
  \- output_path (string): Output file
  \- format (string): "text" | "json" | "csv"

Reads package.json (npm) or pip packages and collects license info.

Input parameters:

- `format` (string): Format
- `output_path` (string, required): Output file
- `project_dir` (string, required): Project directory

### `cc_md_to_html` (~102 tokens)

Markdown to HTML

Converts Markdown to formatted HTML (printable as PDF).

Args:
  \- input_path (string): Path to the Markdown file
  \- output_path (string): Path to the HTML output
  \- title (string, optional): Document title

Produces standalone HTML with CSS styling, printable as PDF via browser.

Input parameters:

- `input_path` (string, required): Markdown file
- `output_path` (string, required): HTML output
- `title` (string): Document title

### `cc_md_to_pdf` (~118 tokens)

Markdown to PDF

Converts Markdown to PDF using a headless browser (Edge/Chrome).

Args:
  \- input_path (string): Path to the Markdown file
  \- output_path (string): Path to the PDF output
  \- title (string, optional): Document title

Uses the same Markdown parser as cc_md_to_html. Requires Edge or Chrome.
Falls back to HTML if no browser is found.

Input parameters:

- `input_path` (string, required): Markdown file
- `output_path` (string, required): PDF output
- `title` (string): Document title

### `cc_diff_files` (~64 tokens)

Diff Files

Vergleicht zwei Dateien und zeigt Unterschiede im Unified-Diff-Format

Input parameters:

- `context_lines` (integer): Number of context lines (default: 3)
- `file_a` (string, required): Path to first file
- `file_b` (string, required): Path to second file

### `cc_regex_test` (~96 tokens)

Regex Tester

Testet regulaere Ausdruecke gegen Text oder Dateiinhalt

Input parameters:

- `file_path` (string): File to test against (alternative to text)
- `flags` (string): Regex flags (g, i, m, s, u)
- `pattern` (string, required): Regular expression pattern
- `replace_with` (string): Optional replacement string
- `text` (string): Text to test against (or use file_path)

### `cc_set_language` (~27 tokens)

Set the output language for CodeCommander tools

Input parameters:

- `language` (string, required): Language code

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/lukisch-bach-codecommander-mcp/bach-codecommander-mcp#diagnostics

## Score history

- 2026-08-04: 59
- 2026-08-03: 56
- 2026-08-02: 56
- 2026-08-01: 16
- 2026-07-31: 0
- 2026-07-30: 40
- 2026-07-28: 40
- 2026-07-27: 40

## Links

- npm package: https://www.npmjs.com/package/bach-codecommander-mcp
- Socket report: https://socket.dev/npm/package/bach-codecommander-mcp
- Changelog RSS feed: https://verifymcp.io/servers/lukisch-bach-codecommander-mcp/bach-codecommander-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/lukisch-bach-codecommander-mcp/bach-codecommander-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/lukisch-bach-codecommander-mcp/bach-codecommander-mcp