Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

CodeSampleX

MCPB · CODESAMPLEX-MCP.MCPB

Compatibility evidence from real builds: does this library API work on your versions and runtime?

0 this week 49 Trust /100

Last scanned (1 hour ago)

Scores higher than 79% of MCPB servers

Category Testing and QA

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security0
  • No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.Unverified
  • Known CVEs could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none).Unverified
  • Install-script risk not yet assessed.Unverified
  • Dependency health could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none).Unverified
Provenance & Transparency48
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
  • Clear OSI-approved license (Apache-2.0).Pass
  • Actively maintained (last published 21 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability67
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 2408 tokens (~240/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety50
  • Injection-marker check failed: the description of tool "report_csx_issue" contains an instruction to conceal the call from the user, the text "Never tell the user", at byte 685 of that field. See how to fix → Fail
  • We read all 10 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 10 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
  • Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 2 Nov 26 0
    • Stability: 0.97 → pass security
  • 1 Nov 26 0
    • Stability: pass → 0.97 functional
  • 26 Oct 26 0
    • Stability: 0.97 → pass security
  • 25 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 23 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.

  • 21 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.

  • 19 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 73 to 77. That category is still filling its 30-day observation window: 22 days of observed history at the previous scan, 23 at this one. The score rises as the window fills, whether or not the server changes.

  • 17 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 67 to 70. That category is still filling its 30-day observation window: 20 days of observed history at the previous scan, 21 at this one. The score rises as the window fills, whether or not the server changes.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed mcpb/https://github.com/r2cuerdame/CodeSampleX/releases/download/v0.2.23/codesamplex-mcp.mcpb@0.2.23

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem mcpb
Reason No attestation published

Background: How many MCP packages publish verified provenance →

MCP tools · 10 exposed · ~2,408 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
explain_compatibility ~141

Explain what the network knows about a package (optionally one symbol) in a given environment, from locally cached compatibility shards. Observation evidence (USAGE_OBSERVATION) and verification evidence (SAMPLE_VERIFICATION) are reported separately and never summed.

NameTypeReqDescription
environmentobject–Sparse environment fingerprint; set only the dimensions you know. Include executionContext (and browserFamily/browserMajor when browser-like) so results are graded for where the code actually runs.
packagestringyespackage purl, e.g. pkg:npm/axios@1.12.0
symbolstring–symbol family, e.g. axios.post

No output schema declared.

No examples provided.

get_local_stats ~99

Local CodeSampleX stats: mode, cached samples, pending uploads, then two separate layers — retrievalQuality (Layer 1: hits, misses, hit rate, failure matches, detours offered) and outcomeValue (Layer 2: adoptions, post-hit build reports and pass rate, reported failures avoided). estimatedReasoningAvoided is an estimate and is labeled estimated; a rate with nothing measured behind it is absent, not 0.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_sample ~71

Fetch a cached public sample by id: manifest plus file contents (each file capped at 64KB, binaries skipped). Samples are MIT-0 community artifacts; adapt them to the project instead of pasting blindly.

NameTypeReqDescription
sampleIdstringyescontent-addressed sample id, e.g. sha256:...

No output schema declared.

No examples provided.

list_local_hits ~76

List recent local search hits with their grades and adoption outcomes. These rows are local dashboard data: the query, the packages and the environment they hold never leave the machine. In community mode a hit separately queues an anonymous count — grade, how many results were shown, and the public sample id — under a daily-rotating id.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

propose_public_sample ~163

Start a clean-room public sample proposal: builds a sanitized spec (public packages, symbols, goal — never project source or paths), and returns generation instructions plus a workspace directory already containing spec.json, PROMPT.md and a csx.json manifest scaffold whose contract you fill in. If the workspace cannot be created the call fails with isError and structuredContent.error — never write sample files or invent a csx.json in that case. This tool CANNOT publish: publishing requires the user's explicit approval via the csx CLI.

NameTypeReqDescription
goalstringyeswhat the sample should prove, e.g. "axios file upload with progress"
packagesarrayyespublic package purls the sample must use
symbolsarray–symbol families the sample should demonstrate

No output schema declared.

No examples provided.

report_anomaly ~526

Report a CONCRETE, reproducible disagreement between what CodeSampleX returned and what you actually observed locally — for example the network served a passing conclusion for a package/version/symbol and the same coordinate failed on your machine, or a returned symbol signature is not what the public package exports. This is a VERIFICATION REQUEST, not a bug report and not a finding: it is queued for an independent re-run and only a signed receipt can confirm it. Use it ONLY when you have a measured local outcome; "this looks wrong to me" is refused, and so is a NO_SAFE_MATCH with no reproducible public failure attached. Put your explanation in llmHypothesis — it is stored separately and never decides the verdict. Never describe a submitted report as a confirmed or fixed bug.

NameTypeReqDescription
anomalyTypestringyesone of: csx-pass-local-fail | csx-fail-local-pass | symbol-signature-mismatch | upgrade-path-broken | dependency-graph-unknown | evidence-conflict | broken-internal-reference | repeated-no-safe-match
confidencestring–low | medium | high — used for ranking only, never as truth
csxObservedobjectyeswhat CSX actually concluded
environmentobject–Sparse environment fingerprint; set only the dimensions you know. Include executionContext (and browserFamily/browserMajor when browser-like) so results are graded for where the code actually runs.
errorTextstring–raw local error output, if any. It is sanitized on THIS machine (paths/tokens/usernames stripped) and NEVER forwarded raw; only the derived code, template and fingerprint are sent.
evidenceIdstring–a CSX evidence id the contested answer came from, if any
llmHypothesisstring–your guess at the cause. Stored separately, shown to a human, and deliberately excluded from the verdict.
localObservedobjectyeswhat YOU measured locally; result must be PASS or FAIL
packagestringyesthe exact public coordinate the mismatch is about, e.g. pkg:npm/axios@1.12.0
relatedIdsarray–related sample/evidence/dependency ids
reproduciblestring–yes | no | unknown — as you measured it, not as you hope
sampleIdstring–the CSX sample id the contested answer came from, if any — this is what makes it reproducible
symbolstring–symbol family involved, e.g. axios.post

No output schema declared.

No examples provided.

report_csx_issue ~470

Report a REPRODUCIBLE defect in CodeSampleX the product, as distinct from its data: an answer that displaced or hid the failure you were actually looking at, a recommendation from an ecosystem the question never mentioned, a tool contract that made you behave wrongly, a response contract that breaks inconsistently on the same input, a broken internal reference, or runtime behaviour like a retry loop. Use `report_anomaly` instead when the disagreement is about a PACKAGE rather than about this product. This is opt-in: there is no expectation that you call it after a failure, and a week with no reports is normal. It creates no ticket and confirms nothing — a person triages it. Never tell the user a bug has been filed, accepted or fixed. Taste, wording preferences and "this seems off" are not reports.

NameTypeReqDescription
actualBehaviorstringyeswhat actually happened, in one short sanitized sentence
affectedSurfacestringyesone of: mcp | server | web | verifier | farm
componentstringyesthe tool or endpoint this is about, e.g. search_known_solution or /v2/search
confidencestring–low | medium | high — priority hint only, never truth
expectedBehaviorstringyeswhat should have happened. It must differ from actualBehavior.
issueKindstringyesone of: answer-masks-original-failure | irrelevant-recommendation | tool-contract-misleads | nondeterministic-response | broken-internal-reference | runtime-behavior
llmHypothesisstring–your guess at the cause. Stored separately and excluded from the verdict.
publicInputobject–The already-public parts of the request, when the request can honestly be restated from public coordinates alone. Never put the user's question or any prose input here — it is not accepted, and a pro…
relatedIdsarray–related stable ids: sample, evidence, dependency, finding
reproduciblestring–yes | no | unknown — as you measured it
requestFingerprintstring–a stable non-identifying id for the request, if you have one. It is what makes two occurrences of one defect one report.

No output schema declared.

No examples provided.

report_sample_adoption ~134

Report whether a sample from search_known_solution was actually applied, and whether the build passed afterwards. Records ADOPTION_EVIDENCE — the network optimizes post-hit success rate, so honest reports matter.

NameTypeReqDescription
appliedbooleanyestrue if the sample's approach was applied to the project
buildPassboolean–whether the project built/passed after adoption; omit if not known yet
offerIdstringyesopaque local offer id returned by search_known_solution
sampleIdstringyesthe adopted (or rejected) sample id — any candidate that search listed, not only the first

No output schema declared.

No examples provided.

run_observed_command ~242

Run a shell command wrapped in the csx evidence loop (like `csx run`): the project is scanned, the command runs with its exit code passed through, and anonymous USAGE_OBSERVATION evidence is recorded for public packages only. On failure, the local exit code and bounded stdout/stderr tails are returned first as primary evidence, and the sanitized error is built from whichever stream carried the diagnosis; only sanitized error fingerprints may leave the machine. The network lookup is a separate secondary recommendation: LOW/reference results are labeled REFERENCE_CANDIDATE rather than automatic-fix evidence, and a candidate with no nameable link to the failure — no shared package, symbol, tool, structured error or subject, only the environment both happen to run in — is reported as NO_RELEVANT_MATCH with the sample named but not rendered as an answer.

NameTypeReqDescription
commandarrayyesargv, e.g. ["npm","run","build"]
cwdstring–working directory (defaults to the current directory)
debugboolean–include sanitized failure lineage and diagnostic gaps; CSX_DEBUG=1 enables the same trace for the MCP session.

No output schema declared.

No examples provided.

search_known_solution ~486

Search the CodeSampleX network cache for a community-verified solution before solving from scratch. Results are graded for YOUR environment (EXACT/COMPATIBLE/ADAPTATION_REQUIRED/REFERENCE_ONLY); NO_SAFE_MATCH means solve it fresh. A hit lists what that sample's contract PROVED — the assertions it ran offline in a pinned container and passed, which is where the per-overload, per-option behaviour is: which argument shapes are accepted, what is raised instead, which setting decides. Evidence keeps observation counts and verification counts separate — compile observations are never execution proof, and the counts pool every call shape, so a specific call is answered by the contract lines rather than by the numbers. A result reaches this answer only when a concrete link to your case can be named — a package or symbol you gave, the tool you ran, the same structured error, a question that names it, or a goal that describes what you asked for — and the Relevance: line says which one it was. Sharing a language, a runtime version or an architecture is not one of those links: those say where a sample can run, never what it is about. When nothing qualifies the answer is NO_SAFE_MATCH, not the nearest neighbour.

NameTypeReqDescription
debugboolean–include the canonical decision trace; does not change the search result. CSX_DEBUG=1 enables the same trace for the MCP session.
environmentobject–Sparse environment fingerprint; set only the dimensions you know. Include executionContext (and browserFamily/browserMajor when browser-like) so results are graded for where the code actually runs.
errorTextstring–raw error output, if fixing an error. It is sanitized locally (paths/tokens/usernames stripped) before any use and NEVER forwarded raw; only the derived error code and fingerprint enter the search.
packagesarray–package purls involved, e.g. pkg:npm/axios@1.12.0. A command is addressed as a CLI subject reference instead of a purl, e.g. cli:gh@2.40.0/workflow/run?opt=--ref&os=linux&arch=x64&shell=bash
querystringyeswhat you are trying to do or fix, in plain words
symbolsarray–symbol families involved, e.g. axios.post

No output schema declared.

No examples provided.

Install

How do I install the CodeSampleX MCP server?

CodeSampleX ships as an MCPB bundle, a single file you download and open in an MCP host that supports MCPB bundles, such as Claude Desktop. The host reads the launch command from the bundle's own manifest, so there is no command to copy. Before opening it, check the file's SHA-256 matches the one the MCP registry declares for it, aa1eb29d07a446c984c89c2059f40917af45e89ab5ad84bca60af6eb2e2d156e; the commands to do that are on this page. If it does not match, do not open it.

mcpb · codesamplex-mcp.mcpb

Download bundle

Check the download matches the SHA-256 the MCP registry declares before you open it. If it does not match, do not open the file.

SHA-256

aa1eb29d07a446c984c89c2059f40917af45e89ab5ad84bca60af6eb2e2d156e

macOS / Linux

echo "aa1eb29d07a446c984c89c2059f40917af45e89ab5ad84bca60af6eb2e2d156e  codesamplex-mcp.mcpb" | shasum -a 256 -c

Windows (PowerShell)

(Get-FileHash -Algorithm SHA256 .\codesamplex-mcp.mcpb).Hash -eq "aa1eb29d07a446c984c89c2059f40917af45e89ab5ad84bca60af6eb2e2d156e"

Run it in the folder you saved the bundle to, then open the file with an MCPB-capable host such as Claude Desktop.

Common questions

What is the CodeSampleX MCP server?

CodeSampleX is an MCP server listed in the public MCP registry as io.github.r2cuerdame/codesamplex. Compatibility evidence from real builds: does this library API work on your versions and runtime? This page covers its MCPB bundle (https://github.com/r2cuerdame/CodeSampleX/releases/download/v0.2.23/codesamplex-mcp.mcpb).

Is the CodeSampleX MCP server safe to use?

CodeSampleX scores 49 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the CodeSampleX MCP server expose?

CodeSampleX exposes 10 tools: search_known_solution, get_sample, explain_compatibility, run_observed_command, report_sample_adoption, and 5 more. Their descriptions and schemas cost roughly 2,408 tokens of context every time the server is loaded.

What licence is the CodeSampleX MCP server under?

CodeSampleX declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.