io.github.SK-DEV-AI/codesearch
PYPI · SKDEV-CODESEARCH-MCP
Code, package, docs, paper and vulnerability search. 17 tools, keyless lanes.
Available components
Last scanned (11 hours ago)
Scores higher than 59% of PyPI servers
Category Code Search and Documentation
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security50
- Malware scan not yet available for this package.Unverified
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs setuptools.build_meta at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- 1 of 36 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability56
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 3757 tokens (~221/item across 17 items; 17 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage83
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 48% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 17 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 18 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 23 Oct 26 51
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 23 Oct 2026 · Analysed pypi/skdev-codesearch-mcp@1.0.1
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
| Reason | No attestation published |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | setuptools.build_meta |
Background: Why install scripts are a supply-chain risk →
Dependencies 36 packages
| Packages resolved | 36 |
|---|---|
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
analyze ~105
Deep repo analysis: parallel-fetch GitHub metadata + SearchCode code quality + DeepWiki architecture + CodeWiki sections in one call. Start here for unfamiliar repos before surgical wiki/searchcode calls. Accepts GitHub URLs or owner/repo strings. May take 10-15s (parallel API calls). e.g. analyze(repository='sst/opencode')
| Name | Type | Req | Description |
|---|---|---|---|
| repository | string | yes | GitHub repo: URL (https://github.com/owner/repo) or owner/repo string |
No output schema declared.
No examples provided.
code_files ~108
List files in an indexed dependency by package-scoped path (e.g. npm:express/src/). PkgSeer + jsDelivr; indexes npm/pypi/crates ONLY (github: specs rejected). e.g. code_files(spec='npm:express')
| Name | Type | Req | Description |
|---|---|---|---|
| path_prefix | string | – | Optional path prefix filter (e.g. src/) |
| spec | string | yes | Package spec: registry:name[@version] (e.g. npm:express, pypi:requests) |
No output schema declared.
No examples provided.
code_read ~102
Read a file from an indexed dependency by package-scoped path. PkgSeer + jsDelivr; indexes npm/pypi/crates ONLY (github: specs rejected). e.g. code_read(spec='npm:express', path='src/index.js')
| Name | Type | Req | Description |
|---|---|---|---|
| path | string | yes | File path within the package (e.g. src/index.js) |
| spec | string | yes | Package spec: registry:name[@version] (e.g. npm:express) |
No output schema declared.
No examples provided.
code_search ~222
Search code, docs, and symbols across indexed dependencies and public repositories. Package scope (npm:express, pypi:requests) via PkgSeer; global public-code search via Sourcegraph (keyless). Supports qualifiers like kind:, category:, lang:. e.g. code_search(query='handleAuth', target='npm:express')
| Name | Type | Req | Description |
|---|---|---|---|
| lang | string | – | Programming language filter |
| limit | integer | – | Max results (1-100) |
| query | string | yes | Search query supporting implicit AND, OR, parens, -exclude, and qualifiers (kind:, lang:, path:) |
| source | string | – | Restrict results to a specific source type |
| target | string | – | Package scope: registry:name[@version] (npm:express, pypi:requests, crates:serde). PkgSeer indexes npm/pypi/crates only. Omit target for global public-repo search via Sourcegraph (keyless). For singl… |
No output schema declared.
No examples provided.
docs ~173
Documentation operations. Default action runs smart fallback (ReadTheDocs→DevDocs→llms.txt→Context7, quota-free sources first). After finding docs, use fetch(url) to read full pages or devdocs_fetch_content for structured content. e.g. docs(query='authentication', library='express')
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | – |
| fast | boolean | – | – |
| library | string | – | – |
| library_id | string | – | Context7 library ID (skip search) |
| path | string | – | – |
| project | string | – | – |
| provider | string | – | Git provider for context7_add_repo (github, gitlab) |
| query | string | – | – |
| repo_url | string | – | Repository URL for context7_add_repo |
| slug | string | – | – |
| version | string | – | – |
No output schema declared.
No examples provided.
enrich ~135
Fetch full content for a list of search results, deduplicate, and rerank by relevance. Give it results from any search tool plus the original query. e.g. enrich(query='rust async', results=[{'url':'...','title':'...'}])
| Name | Type | Req | Description |
|---|---|---|---|
| include_html | boolean | – | Include raw HTML in content (default strips to text) |
| max_fetch_size | integer | – | Max results to fetch content for |
| query | string | yes | – |
| results | array | yes | List of result objects to enrich (url, title, text/snippet, source) |
| top_k | integer | – | Max enriched results to return |
No output schema declared.
No examples provided.
hn ~155
Hacker News: search, item detail, user profile, or story lists (top/new/best/ask/show). Use for tech-community discussion and sentiment; for resolved Q&A use so_search. e.g. hn(query='rust', tags='story', min_points=50)
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | – |
| count | integer | – | – |
| firebase_type | string | – | – |
| item_id | integer | – | – |
| min_comments | integer | – | – |
| min_points | integer | – | – |
| query | string | – | – |
| sort_by_date | boolean | – | – |
| tags | string | – | story|comment|poll|front_page|ask_hn|show_hn |
| username | string | – | – |
No output schema declared.
No examples provided.
papers ~204
Academic papers from Semantic Scholar, CORE API, and arXiv. Prefer action=search for topic queries (multi-source S2→arXiv→OpenAlex→CORE fallback); arxiv_search is single-source and rate-limited. e.g. papers(query='transformer attention', fields_of_study='Computer Science')
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | – |
| author_id | string | – | – |
| count | integer | – | – |
| fields_of_study | string | – | – |
| negative_ids | string | – | Comma-separated negative paper IDs for recommendations_negatives |
| offset | integer | – | Result offset for pagination (search and core_search actions) |
| open_access | boolean | – | – |
| paper_id | string | – | – |
| paper_ids | string | – | Comma-separated paper IDs for batch action |
| positive_ids | string | – | Comma-separated positive paper IDs for recommendations_negatives |
| query | string | – | – |
| year | string | – | – |
No output schema declared.
No examples provided.
ping ~38
Lightweight connectivity check — verifies internet and key API endpoints are reachable. Use before expensive calls when connectivity is uncertain. No params needed. e.g. ping()
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
pkg ~216
Package intelligence: info (composite metadata — Libraries.io + Sonatype + PkgSeer), changelog (release notes), upgrade_review (vulns+changelog+deps diff between versions), files (list source files), read (read a source file). For raw single-source registry queries (npm versions, crates categories), use `search_package` instead. e.g. pkg(name='express', action='info')
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | – |
| count | integer | – | Max changelog entries |
| current_version | string | – | Current version for upgrade_review |
| from_version | string | – | Start of version range for changelog (optional) |
| name | string | yes | – |
| path | string | – | File path filter (files) or exact path (read) |
| registry | string | – | – |
| target_version | string | – | Target version for upgrade_review |
| to_version | string | – | End of version range for changelog (optional) |
| version | string | – | Package version (default: latest) |
No output schema declared.
No examples provided.
search_all ~223
Unified search across 14+ sources with embedding dedup and reranking. Use for broad multi-source discovery; for surgical single-source work call so_search/hn/papers/code_search directly. e.g. search_all(query='rust async runtime', language='rust')
| Name | Type | Req | Description |
|---|---|---|---|
| count | integer | – | Results per source (max 50) |
| fields_of_study | string | – | S2 papers domain filter (default: all fields) |
| fromdate | string | – | Stack Exchange results older than ISO date |
| language | string | – | – |
| library | string | – | – |
| owner | string | – | – |
| query | string | yes | – |
| repo | string | – | – |
| so_sort | string | – | Stack Exchange sort: votes/activity/creation/relevance |
| synthesize | boolean | – | Groq-synthesize top results into a concise answer with citations (no-op without GROQ_API_KEYS; server defaults to false when no keys are configured) |
| todate | string | – | Stack Exchange results newer than ISO date |
| version | string | – | – |
No output schema declared.
No examples provided.
search_libraries ~177
Libraries.io dependency metadata and source rank. Use to compare dependency candidates or find the repo behind a package; for registry versions/vulns use search_package/pkg/vulns. e.g. search_libraries(name='lodash', platform='npm')
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | versions|dependencies|dependents|github_repo|github_dependencies|platforms|licenses|keywords (omit for project search) |
| count | integer | – | – |
| keyword | string | – | Keyword for keywords action |
| keywords | string | – | – |
| languages | string | – | – |
| licenses | string | – | – |
| name | string | – | – |
| owner | string | – | – |
| platform | string | – | – |
| query | string | – | – |
| repo | string | – | – |
| sort | string | – | – |
| version | string | – | – |
No output schema declared.
No examples provided.
search_package ~238
Raw package registry queries (npm/PyPI/crates + deps.dev). Use for fast single-source lookups. For composite intelligence (Libraries.io + Sonatype vulns), use `pkg` instead. e.g. search_package(name='express', registry='npm')
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | list versions: npm_versions|pypi_versions|crates_versions; one version: npm_get_version|pypi_get_version|crates_get_version (version='latest' OK); npm_dist_tags; crates_get_readme|crates_summary; dep… |
| advisory_id | string | – | OSV advisory ID for depsdev_advisory |
| hash_type | string | – | Hash type for depsdev_query: SHA1, SHA256, etc |
| hash_value | string | – | Base64-encoded hash value for depsdev_query |
| name | string | yes | – |
| registry | string | – | – |
| version | string | – | Package version (required for version-specific queries; 'latest' resolves to newest) |
No output schema declared.
No examples provided.
searchcode ~342
Per-repo code intelligence via SearchCode (free, no auth). Use analyze for instant repo overview (languages, complexity, tech stack, credentials), search for searching code within a repo, findings for code quality issues, file_tree to list files, or get_file to read a file. No rate limits. e.g. searchcode(action='analyze', repository='https://github.com/expressjs/express')
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | analyze=repo overview, search=search code, findings=quality issues, file_tree=list files, get_file=read file |
| case_sensitive | boolean | – | Case-sensitive search (for search action) |
| category | string | – | Filter findings by category (for findings action) |
| context_lines | integer | – | Context lines around matches (for search action) |
| detail_level | string | – | Response verbosity (for analyze action) |
| end_line | integer | – | End line (for get_file without symbol_name) |
| language | string | – | Language filter (for analyze action) |
| max_results | integer | – | Max results (for search/findings) |
| path | string | – | Subdirectory path filter (for analyze/findings/file_tree) |
| query | string | – | Search query (for search action) |
| repository | string | – | Git URL or owner/repo — REQUIRED for every searchcode action (e.g. https://github.com/expressjs/express) |
| severity | string | – | Filter by severity (for findings action) |
| start_line | integer | – | Start line (for get_file without symbol_name) |
| symbol_name | string | – | Function/class name to extract (for get_file action) |
No output schema declared.
No examples provided.
so_search ~365
Stack Overflow: Stack Exchange API (free, 300 req/day, resolved/accepted answers with score/tags) or SOFA (Stack Overflow for Agents, beta, agent-contributed content with trust scores, requires SOFA_KEY env). Use stackexchange for authoritative resolved answers, sofa for fresher agent-contributed content. e.g. so_search(query='python async', tags='python', accepted=true)
| Name | Type | Req | Description |
|---|---|---|---|
| accepted | boolean | – | – |
| action | string | – | stackexchange=official API (free, 300 req/day, resolved answers, score/tags/views/activity). sofa=Stack Overflow for Agents (beta, agent-contributed, trust scores, needs SOFA_KEY). questions_by_ids/s… |
| answers | integer | – | Minimum answer count |
| closed | boolean | – | – |
| content_type | string | – | SOFA only: question|til|blueprint|playbook |
| count | integer | – | – |
| fromdate | string | – | Unix timestamp or date string for earliest creation date |
| ids | string | – | Comma-separated IDs for questions_by_ids / answers_by_ids / users_by_ids |
| page | integer | – | Page number for pagination |
| post_id | string | – | SOFA only: get post by ID instead of searching |
| query | string | – | – |
| question_id | integer | – | – |
| site | string | – | – |
| sort | string | – | – |
| steering | string | – | SOFA only: curation steering parameter |
| tags | string | – | – |
| todate | string | – | Unix timestamp or date string for latest creation date |
| type | string | – | – |
| views | integer | – | Minimum view count |
No output schema declared.
No examples provided.
vulns ~166
Sonatype Guide + OSV.dev fallback: scan packages, vulnerability details, latest version, or license analysis by PURL. scan needs platform+name+version (or coordinates) — on Sonatype 401/429/quota errors it falls back to keyless OSV.dev automatically. detail accepts Sonatype ids, GHSA-* (GitHub Advisory enrichment), or CVE-* ids. latest_version/license need purl. e.g. vulns(action='scan', name='lodash', version='4.17.20')
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | – |
| coordinates | string | – | – |
| name | string | – | – |
| platform | string | – | – |
| purl | string | – | – |
| version | string | – | – |
| vuln_id | string | – | – |
No output schema declared.
No examples provided.
wiki ~154
Repo architecture and wiki via DeepWiki + CodeWiki. For single-repo queries use owner+repo; for multi-repo questions pass repos (array of owner/repo strings, max 10). e.g. wiki(owner='torvalds', repo='linux', question='How does the scheduler work?')
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | – |
| limit | integer | – | – |
| offset | integer | – | – |
| owner | string | – | – |
| query | string | – | – |
| question | string | – | – |
| repo | string | – | – |
| repos | array | – | Array of owner/repo strings for multi-repo queries (DeepWiki ask supports up to 10) |
| wiki_name | string | – | – |
No output schema declared.
No examples provided.
How do I install the io.github.SK-DEV-AI/codesearch MCP server?
io.github.SK-DEV-AI/codesearch runs locally as a PyPI package, launched with uvx skdev-codesearch-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · skdev-codesearch-mcp
claude mcp add sk-dev-ai-codesearch -- uvx skdev-codesearch-mcp
What is the io.github.SK-DEV-AI/codesearch MCP server?
io.github.SK-DEV-AI/codesearch is an MCP server listed in the public MCP registry as io.github.SK-DEV-AI/codesearch. Code, package, docs, paper and vulnerability search. 17 tools, keyless lanes. This page covers its PyPI package (skdev-codesearch-mcp).
Is the io.github.SK-DEV-AI/codesearch MCP server safe to use?
io.github.SK-DEV-AI/codesearch scores 51 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 23 October 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.SK-DEV-AI/codesearch MCP server expose?
io.github.SK-DEV-AI/codesearch exposes 17 tools: ping, wiki, search_all, search_package, so_search, and 12 more. Their descriptions and schemas cost roughly 3,123 tokens of context every time the server is loaded.
Is the io.github.SK-DEV-AI/codesearch MCP server still maintained?
io.github.SK-DEV-AI/codesearch is still listed as active in the MCP registry. We last reached this channel on 23 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.SK-DEV-AI/codesearch MCP server under?
io.github.SK-DEV-AI/codesearch declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.