# CodeSampleX (mcpb · codesamplex-mcp.mcpb)

Compatibility evidence from real builds: does this library API work on your versions and runtime?

- Trust score: 49/100 (low)
- Change this week: 0
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- mcpb · `codesamplex-mcp.mcpb`: 49/100 (this document), [markdown](https://verifymcp.io/servers/r2cuerdame-codesamplex/https-github-com-r2cuerdame-codesamplex-releases-download-v0-2-1-codesamplex-mcp.md), [page](https://verifymcp.io/servers/r2cuerdame-codesamplex/https-github-com-r2cuerdame-codesamplex-releases-download-v0-2-1-codesamplex-mcp)

## Channel facts

- Registry: `mcpb`
- Package: `https://github.com/r2cuerdame/CodeSampleX/releases/download/v0.2.23/codesamplex-mcp.mcpb`
- Version: `0.2.23`
- Transport: `stdio`
- SHA-256: `aa1eb29d07a446c984c89c2059f40917af45e89ab5ad84bca60af6eb2e2d156e`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 0/100
  - No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.
  - Known CVEs could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none).
  - Install-script risk not yet assessed.
  - Dependency health could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none).
- **Provenance & Transparency**: 48/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 21 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 67/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2408 tokens (~240/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 100/100
  - No destabilizing schema changes in the last 30 days.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 50/100
  - Injection-marker check failed: the description of tool "report_csx_issue" contains an instruction to conceal the call from the user, the text "Never tell the user", at byte 685 of that field.
  - We read all 10 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 10 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the CodeSampleX MCP server?

CodeSampleX ships as an MCPB bundle, a single file you download and open in an MCP host that supports MCPB bundles, such as Claude Desktop. The host reads the launch command from the bundle's own manifest, so there is no command to copy. Before opening it, check the file's SHA-256 matches the one the MCP registry declares for it, aa1eb29d07a446c984c89c2059f40917af45e89ab5ad84bca60af6eb2e2d156e; the commands to do that are on this page. If it does not match, do not open it.

- Download bundle: `https://github.com/r2cuerdame/CodeSampleX/releases/download/v0.2.23/codesamplex-mcp.mcpb`
- SHA-256: `aa1eb29d07a446c984c89c2059f40917af45e89ab5ad84bca60af6eb2e2d156e`

### Verify on macOS / Linux

```bash
echo "aa1eb29d07a446c984c89c2059f40917af45e89ab5ad84bca60af6eb2e2d156e  codesamplex-mcp.mcpb" | shasum -a 256 -c
```

### Verify on Windows (PowerShell)

```powershell
(Get-FileHash -Algorithm SHA256 .\codesamplex-mcp.mcpb).Hash -eq "aa1eb29d07a446c984c89c2059f40917af45e89ab5ad84bca60af6eb2e2d156e"
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-02 (score 49, 0)

- [security] Stability: 0.97 → pass

### 2026-11-01 (score 49, 0)

- [functional] Stability: pass → 0.97

### 2026-10-26 (score 49, 0)

- [security] Stability: 0.97 → pass

### 2026-10-25 (score 49, +1)

No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-23 (score 48, +1)

No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-21 (score 47, +1)

No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-19 (score 46, +1)

No change was recorded against any check on this day. Stability & Change Management went from 73 to 77. That category is still filling its 30-day observation window: 22 days of observed history at the previous scan, 23 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-17 (score 45, +1)

No change was recorded against any check on this day. Stability & Change Management went from 67 to 70. That category is still filling its 30-day observation window: 20 days of observed history at the previous scan, 21 at this one. The score rises as the window fills, whether or not the server changes.

## MCP tools (10)

### `search_known_solution` (~486 tokens)

Search verified compatibility samples

Search the CodeSampleX network cache for a community-verified solution before solving from scratch. Results are graded for YOUR environment (EXACT/COMPATIBLE/ADAPTATION_REQUIRED/REFERENCE_ONLY); NO_SAFE_MATCH means solve it fresh. A hit lists what that sample's contract PROVED — the assertions it ran offline in a pinned container and passed, which is where the per-overload, per-option behaviour is: which argument shapes are accepted, what is raised instead, which setting decides. Evidence keeps observation counts and verification counts separate — compile observations are never execution proof, and the counts pool every call shape, so a specific call is answered by the contract lines rather than by the numbers. A result reaches this answer only when a concrete link to your case can be named — a package or symbol you gave, the tool you ran, the same structured error, a question that names it, or a goal that describes what you asked for — and the Relevance: line says which one it was. Sharing a language, a runtime version or an architecture is not one of those links: those say where a sample can run, never what it is about. When nothing qualifies the answer is NO_SAFE_MATCH, not the nearest neighbour.

Input parameters:

- `debug` (boolean): include the canonical decision trace; does not change the search result. CSX_DEBUG=1 enables the same trace for the MCP session.
- `environment` (object): Sparse environment fingerprint; set only the dimensions you know. Include executionContext (and browserFamily/browserMajor when browser-like) so results are graded for where the code actually runs.
- `errorText` (string): raw error output, if fixing an error. It is sanitized locally (paths/tokens/usernames stripped) before any use and NEVER forwarded raw; only the derived error code and fingerprint enter the search.
- `packages` (array): package purls involved, e.g. pkg:npm/axios@1.12.0. A command is addressed as a CLI subject reference instead of a purl, e.g. cli:gh@2.40.0/workflow/run?opt=--ref&os=linux&arch=x64&shell=bash
- `query` (string, required): what you are trying to do or fix, in plain words
- `symbols` (array): symbol families involved, e.g. axios.post

### `get_sample` (~71 tokens)

Fetch a verified sample

Fetch a cached public sample by id: manifest plus file contents (each file capped at 64KB, binaries skipped). Samples are MIT-0 community artifacts; adapt them to the project instead of pasting blindly.

Input parameters:

- `sampleId` (string, required): content-addressed sample id, e.g. sha256:...

### `explain_compatibility` (~141 tokens)

Explain package compatibility

Explain what the network knows about a package (optionally one symbol) in a given environment, from locally cached compatibility shards. Observation evidence (USAGE_OBSERVATION) and verification evidence (SAMPLE_VERIFICATION) are reported separately and never summed.

Input parameters:

- `environment` (object): Sparse environment fingerprint; set only the dimensions you know. Include executionContext (and browserFamily/browserMajor when browser-like) so results are graded for where the code actually runs.
- `package` (string, required): package purl, e.g. pkg:npm/axios@1.12.0
- `symbol` (string): symbol family, e.g. axios.post

### `run_observed_command` (~242 tokens)

Run a build command through the evidence loop

Run a shell command wrapped in the csx evidence loop (like `csx run`): the project is scanned, the command runs with its exit code passed through, and anonymous USAGE_OBSERVATION evidence is recorded for public packages only. On failure, the local exit code and bounded stdout/stderr tails are returned first as primary evidence, and the sanitized error is built from whichever stream carried the diagnosis; only sanitized error fingerprints may leave the machine. The network lookup is a separate secondary recommendation: LOW/reference results are labeled REFERENCE_CANDIDATE rather than automatic-fix evidence, and a candidate with no nameable link to the failure — no shared package, symbol, tool, structured error or subject, only the environment both happen to run in — is reported as NO_RELEVANT_MATCH with the sample named but not rendered as an answer.

Input parameters:

- `command` (array, required): argv, e.g. ["npm","run","build"]
- `cwd` (string): working directory (defaults to the current directory)
- `debug` (boolean): include sanitized failure lineage and diagnostic gaps; CSX_DEBUG=1 enables the same trace for the MCP session.

### `report_sample_adoption` (~134 tokens)

Report a sample's build outcome

Report whether a sample from search_known_solution was actually applied, and whether the build passed afterwards. Records ADOPTION_EVIDENCE — the network optimizes post-hit success rate, so honest reports matter.

Input parameters:

- `applied` (boolean, required): true if the sample's approach was applied to the project
- `buildPass` (boolean): whether the project built/passed after adoption; omit if not known yet
- `offerId` (string, required): opaque local offer id returned by search_known_solution
- `sampleId` (string, required): the adopted (or rejected) sample id — any candidate that search listed, not only the first

### `report_anomaly` (~526 tokens)

Report a CSX answer that your machine contradicts

Report a CONCRETE, reproducible disagreement between what CodeSampleX returned and what you actually observed locally — for example the network served a passing conclusion for a package/version/symbol and the same coordinate failed on your machine, or a returned symbol signature is not what the public package exports. This is a VERIFICATION REQUEST, not a bug report and not a finding: it is queued for an independent re-run and only a signed receipt can confirm it. Use it ONLY when you have a measured local outcome; "this looks wrong to me" is refused, and so is a NO_SAFE_MATCH with no reproducible public failure attached. Put your explanation in llmHypothesis — it is stored separately and never decides the verdict. Never describe a submitted report as a confirmed or fixed bug.

Input parameters:

- `anomalyType` (string, required): one of: csx-pass-local-fail | csx-fail-local-pass | symbol-signature-mismatch | upgrade-path-broken | dependency-graph-unknown | evidence-conflict | broken-internal-reference | repeated-no-safe-match
- `confidence` (string): low | medium | high — used for ranking only, never as truth
- `csxObserved` (object, required): what CSX actually concluded
- `environment` (object): Sparse environment fingerprint; set only the dimensions you know. Include executionContext (and browserFamily/browserMajor when browser-like) so results are graded for where the code actually runs.
- `errorText` (string): raw local error output, if any. It is sanitized on THIS machine (paths/tokens/usernames stripped) and NEVER forwarded raw; only the derived code, template and fingerprint are sent.
- `evidenceId` (string): a CSX evidence id the contested answer came from, if any
- `llmHypothesis` (string): your guess at the cause. Stored separately, shown to a human, and deliberately excluded from the verdict.
- `localObserved` (object, required): what YOU measured locally; result must be PASS or FAIL
- `package` (string, required): the exact public coordinate the mismatch is about, e.g. pkg:npm/axios@1.12.0
- `relatedIds` (array): related sample/evidence/dependency ids
- `reproducible` (string): yes | no | unknown — as you measured it, not as you hope
- `sampleId` (string): the CSX sample id the contested answer came from, if any — this is what makes it reproducible
- `symbol` (string): symbol family involved, e.g. axios.post

### `report_csx_issue` (~470 tokens)

Report a defect in CodeSampleX itself

Report a REPRODUCIBLE defect in CodeSampleX the product, as distinct from its data: an answer that displaced or hid the failure you were actually looking at, a recommendation from an ecosystem the question never mentioned, a tool contract that made you behave wrongly, a response contract that breaks inconsistently on the same input, a broken internal reference, or runtime behaviour like a retry loop. Use `report_anomaly` instead when the disagreement is about a PACKAGE rather than about this product. This is opt-in: there is no expectation that you call it after a failure, and a week with no reports is normal. It creates no ticket and confirms nothing — a person triages it. Never tell the user a bug has been filed, accepted or fixed. Taste, wording preferences and "this seems off" are not reports.

Input parameters:

- `actualBehavior` (string, required): what actually happened, in one short sanitized sentence
- `affectedSurface` (string, required): one of: mcp | server | web | verifier | farm
- `component` (string, required): the tool or endpoint this is about, e.g. search_known_solution or /v2/search
- `confidence` (string): low | medium | high — priority hint only, never truth
- `expectedBehavior` (string, required): what should have happened. It must differ from actualBehavior.
- `issueKind` (string, required): one of: answer-masks-original-failure | irrelevant-recommendation | tool-contract-misleads | nondeterministic-response | broken-internal-reference | runtime-behavior
- `llmHypothesis` (string): your guess at the cause. Stored separately and excluded from the verdict.
- `publicInput` (object): The already-public parts of the request, when the request can honestly be restated from public coordinates alone. Never put the user's question or any prose input here — it is not accepted, and a pro…
- `relatedIds` (array): related stable ids: sample, evidence, dependency, finding
- `reproducible` (string): yes | no | unknown — as you measured it
- `requestFingerprint` (string): a stable non-identifying id for the request, if you have one. It is what makes two occurrences of one defect one report.

### `propose_public_sample` (~163 tokens)

Start a clean-room sample proposal

Start a clean-room public sample proposal: builds a sanitized spec (public packages, symbols, goal — never project source or paths), and returns generation instructions plus a workspace directory already containing spec.json, PROMPT.md and a csx.json manifest scaffold whose contract you fill in. If the workspace cannot be created the call fails with isError and structuredContent.error — never write sample files or invent a csx.json in that case. This tool CANNOT publish: publishing requires the user's explicit approval via the csx CLI.

Input parameters:

- `goal` (string, required): what the sample should prove, e.g. "axios file upload with progress"
- `packages` (array, required): public package purls the sample must use
- `symbols` (array): symbol families the sample should demonstrate

### `list_local_hits` (~76 tokens)

List local search hits

List recent local search hits with their grades and adoption outcomes. These rows are local dashboard data: the query, the packages and the environment they hold never leave the machine. In community mode a hit separately queues an anonymous count — grade, how many results were shown, and the public sample id — under a daily-rotating id.

### `get_local_stats` (~99 tokens)

Show this install's local stats

Local CodeSampleX stats: mode, cached samples, pending uploads, then two separate layers — retrievalQuality (Layer 1: hits, misses, hit rate, failure matches, detours offered) and outcomeValue (Layer 2: adoptions, post-hit build reports and pass rate, reported failures avoided). estimatedReasoningAvoided is an estimate and is labeled estimated; a rate with nothing measured behind it is absent, not 0.

## Diagnostics

Captured diagnostic sections: Provenance. The full working is on the page: https://verifymcp.io/servers/r2cuerdame-codesamplex/https-github-com-r2cuerdame-codesamplex-releases-download-v0-2-1-codesamplex-mcp#diagnostics

## Score history

- 2026-11-05: 49
- 2026-11-04: 49
- 2026-11-03: 49
- 2026-11-02: 49
- 2026-11-01: 49
- 2026-10-31: 49
- 2026-10-30: 49
- 2026-10-29: 49
- 2026-10-28: 49
- 2026-10-27: 49
- 2026-10-26: 49
- 2026-10-25: 49
- 2026-10-24: 48
- 2026-10-23: 48
- 2026-10-22: 47
- 2026-10-21: 47
- 2026-10-20: 46
- 2026-10-19: 46
- 2026-10-18: 45
- 2026-10-17: 45
- 2026-10-16: 44
- 2026-10-15: 44
- 2026-10-14: 10
- 2026-10-13: 10
- 2026-10-12: 10
- 2026-10-11: 10
- 2026-10-07: 10
- 2026-10-04: 39
- 2026-10-03: 35
- 2026-10-02: 35

## Common questions

### What is the CodeSampleX MCP server?

CodeSampleX is an MCP server listed in the public MCP registry as io.github.r2cuerdame/codesamplex. Compatibility evidence from real builds: does this library API work on your versions and runtime? This page covers its MCPB bundle (https://github.com/r2cuerdame/CodeSampleX/releases/download/v0.2.23/codesamplex-mcp.mcpb).

### Is the CodeSampleX MCP server safe to use?

CodeSampleX scores 49 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the CodeSampleX MCP server expose?

CodeSampleX exposes 10 tools: search_known_solution, get_sample, explain_compatibility, run_observed_command, report_sample_adoption, and 5 more. Their descriptions and schemas cost roughly 2,408 tokens of context every time the server is loaded.

### What licence is the CodeSampleX MCP server under?

CodeSampleX declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- Repository: https://github.com/r2cuerdame/CodeSampleX
- Website: https://codesamplex.dev/
- Changelog RSS feed: https://verifymcp.io/servers/r2cuerdame-codesamplex/https-github-com-r2cuerdame-codesamplex-releases-download-v0-2-1-codesamplex-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/r2cuerdame-codesamplex/https-github-com-r2cuerdame-codesamplex-releases-download-v0-2-1-codesamplex-mcp.json
- HTML version of this page: https://verifymcp.io/servers/r2cuerdame-codesamplex/https-github-com-r2cuerdame-codesamplex-releases-download-v0-2-1-codesamplex-mcp