# io.github.SK-DEV-AI/codesearch (pypi · skdev-codesearch-mcp)

Code, package, docs, paper and vulnerability search. 17 tools, keyless lanes.

- Trust score: 51/100 (low)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-23

## Components

- pypi · `skdev-codesearch-mcp`: 51/100 (this document), [markdown](https://verifymcp.io/servers/sk-dev-ai-codesearch/skdev-codesearch-mcp.md), [page](https://verifymcp.io/servers/sk-dev-ai-codesearch/skdev-codesearch-mcp)

## Channel facts

- Registry: `pypi`
- Package: `skdev-codesearch-mcp`
- Version: `1.0.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-23.

- **Supply Chain Security**: 50/100
  - Malware scan not yet available for this package.
  - No known CVEs affecting this package version or its production dependencies.
  - Runs setuptools.build_meta at install time, a recognised build step with no custom scripting around it.
  - 1 of 36 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 0 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 56/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 3757 tokens (~221/item across 17 items; 17 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 83/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 48% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 17 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 18 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the io.github.SK-DEV-AI/codesearch MCP server?

io.github.SK-DEV-AI/codesearch runs locally as a PyPI package, launched with uvx skdev-codesearch-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add sk-dev-ai-codesearch -- uvx skdev-codesearch-mcp
```

### Cursor

```json
{
  "mcpServers": {
    "sk-dev-ai-codesearch": {
      "command": "uvx",
      "args": [
        "skdev-codesearch-mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "sk-dev-ai-codesearch": {
      "command": "uvx",
      "args": [
        "skdev-codesearch-mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add sk-dev-ai-codesearch -- uvx skdev-codesearch-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "sk-dev-ai-codesearch": {
      "type": "local",
      "command": [
        "uvx",
        "skdev-codesearch-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add sk-dev-ai-codesearch --command uvx --arg skdev-codesearch-mcp
```

### Hermes

```yaml
mcp_servers:
  sk-dev-ai-codesearch:
    command: "uvx"
    args: ["skdev-codesearch-mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "sk-dev-ai-codesearch": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "skdev-codesearch-mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add sk-dev-ai-codesearch -t stdio -c uvx -a skdev-codesearch-mcp
```

### Other

```json
{
  "mcpServers": {
    "sk-dev-ai-codesearch": {
      "command": "uvx",
      "args": [
        "skdev-codesearch-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-23 (score 51)

First indexed and scored.

## MCP tools (17)

### `ping` (~38 tokens)

Lightweight connectivity check — verifies internet and key API endpoints are reachable. Use before expensive calls when connectivity is uncertain. No params needed. e.g. ping()

### `wiki` (~154 tokens)

Repo architecture and wiki via DeepWiki + CodeWiki. For single-repo queries use owner+repo; for multi-repo questions pass repos (array of owner/repo strings, max 10). e.g. wiki(owner='torvalds', repo='linux', question='How does the scheduler work?')

Input parameters:

- `action` (string, required)
- `limit` (integer)
- `offset` (integer)
- `owner` (string)
- `query` (string)
- `question` (string)
- `repo` (string)
- `repos` (array): Array of owner/repo strings for multi-repo queries (DeepWiki ask supports up to 10)
- `wiki_name` (string)

### `search_all` (~223 tokens)

Unified search across 14+ sources with embedding dedup and reranking. Use for broad multi-source discovery; for surgical single-source work call so_search/hn/papers/code_search directly. e.g. search_all(query='rust async runtime', language='rust')

Input parameters:

- `count` (integer): Results per source (max 50)
- `fields_of_study` (string): S2 papers domain filter (default: all fields)
- `fromdate` (string): Stack Exchange results older than ISO date
- `language` (string)
- `library` (string)
- `owner` (string)
- `query` (string, required)
- `repo` (string)
- `so_sort` (string): Stack Exchange sort: votes/activity/creation/relevance
- `synthesize` (boolean): Groq-synthesize top results into a concise answer with citations (no-op without GROQ_API_KEYS; server defaults to false when no keys are configured)
- `todate` (string): Stack Exchange results newer than ISO date
- `version` (string)

### `search_package` (~238 tokens)

Raw package registry queries (npm/PyPI/crates + deps.dev). Use for fast single-source lookups. For composite intelligence (Libraries.io + Sonatype vulns), use `pkg` instead. e.g. search_package(name='express', registry='npm')

Input parameters:

- `action` (string): list versions: npm_versions|pypi_versions|crates_versions; one version: npm_get_version|pypi_get_version|crates_get_version (version='latest' OK); npm_dist_tags; crates_get_readme|crates_summary; dep…
- `advisory_id` (string): OSV advisory ID for depsdev_advisory
- `hash_type` (string): Hash type for depsdev_query: SHA1, SHA256, etc
- `hash_value` (string): Base64-encoded hash value for depsdev_query
- `name` (string, required)
- `registry` (string)
- `version` (string): Package version (required for version-specific queries; 'latest' resolves to newest)

### `so_search` (~365 tokens)

Stack Overflow: Stack Exchange API (free, 300 req/day, resolved/accepted answers with score/tags) or SOFA (Stack Overflow for Agents, beta, agent-contributed content with trust scores, requires SOFA_KEY env). Use stackexchange for authoritative resolved answers, sofa for fresher agent-contributed content. e.g. so_search(query='python async', tags='python', accepted=true)

Input parameters:

- `accepted` (boolean)
- `action` (string): stackexchange=official API (free, 300 req/day, resolved answers, score/tags/views/activity). sofa=Stack Overflow for Agents (beta, agent-contributed, trust scores, needs SOFA_KEY). questions_by_ids/s…
- `answers` (integer): Minimum answer count
- `closed` (boolean)
- `content_type` (string): SOFA only: question|til|blueprint|playbook
- `count` (integer)
- `fromdate` (string): Unix timestamp or date string for earliest creation date
- `ids` (string): Comma-separated IDs for questions_by_ids / answers_by_ids / users_by_ids
- `page` (integer): Page number for pagination
- `post_id` (string): SOFA only: get post by ID instead of searching
- `query` (string)
- `question_id` (integer)
- `site` (string)
- `sort` (string)
- `steering` (string): SOFA only: curation steering parameter
- `tags` (string)
- `todate` (string): Unix timestamp or date string for latest creation date
- `type` (string)
- `views` (integer): Minimum view count

### `hn` (~155 tokens)

Hacker News: search, item detail, user profile, or story lists (top/new/best/ask/show). Use for tech-community discussion and sentiment; for resolved Q&A use so_search. e.g. hn(query='rust', tags='story', min_points=50)

Input parameters:

- `action` (string, required)
- `count` (integer)
- `firebase_type` (string)
- `item_id` (integer)
- `min_comments` (integer)
- `min_points` (integer)
- `query` (string)
- `sort_by_date` (boolean)
- `tags` (string): story|comment|poll|front_page|ask_hn|show_hn
- `username` (string)

### `search_libraries` (~177 tokens)

Libraries.io dependency metadata and source rank. Use to compare dependency candidates or find the repo behind a package; for registry versions/vulns use search_package/pkg/vulns. e.g. search_libraries(name='lodash', platform='npm')

Input parameters:

- `action` (string): versions|dependencies|dependents|github_repo|github_dependencies|platforms|licenses|keywords (omit for project search)
- `count` (integer)
- `keyword` (string): Keyword for keywords action
- `keywords` (string)
- `languages` (string)
- `licenses` (string)
- `name` (string)
- `owner` (string)
- `platform` (string)
- `query` (string)
- `repo` (string)
- `sort` (string)
- `version` (string)

### `vulns` (~166 tokens)

Sonatype Guide + OSV.dev fallback: scan packages, vulnerability details, latest version, or license analysis by PURL. scan needs platform+name+version (or coordinates) — on Sonatype 401/429/quota errors it falls back to keyless OSV.dev automatically. detail accepts Sonatype ids, GHSA-* (GitHub Advisory enrichment), or CVE-* ids. latest_version/license need purl. e.g. vulns(action='scan', name='lodash', version='4.17.20')

Input parameters:

- `action` (string)
- `coordinates` (string)
- `name` (string)
- `platform` (string)
- `purl` (string)
- `version` (string)
- `vuln_id` (string)

### `docs` (~173 tokens)

Documentation operations. Default action runs smart fallback (ReadTheDocs→DevDocs→llms.txt→Context7, quota-free sources first). After finding docs, use fetch(url) to read full pages or devdocs_fetch_content for structured content. e.g. docs(query='authentication', library='express')

Input parameters:

- `action` (string)
- `fast` (boolean)
- `library` (string)
- `library_id` (string): Context7 library ID (skip search)
- `path` (string)
- `project` (string)
- `provider` (string): Git provider for context7_add_repo (github, gitlab)
- `query` (string)
- `repo_url` (string): Repository URL for context7_add_repo
- `slug` (string)
- `version` (string)

### `papers` (~204 tokens)

Academic papers from Semantic Scholar, CORE API, and arXiv. Prefer action=search for topic queries (multi-source S2→arXiv→OpenAlex→CORE fallback); arxiv_search is single-source and rate-limited. e.g. papers(query='transformer attention', fields_of_study='Computer Science')

Input parameters:

- `action` (string, required)
- `author_id` (string)
- `count` (integer)
- `fields_of_study` (string)
- `negative_ids` (string): Comma-separated negative paper IDs for recommendations_negatives
- `offset` (integer): Result offset for pagination (search and core_search actions)
- `open_access` (boolean)
- `paper_id` (string)
- `paper_ids` (string): Comma-separated paper IDs for batch action
- `positive_ids` (string): Comma-separated positive paper IDs for recommendations_negatives
- `query` (string)
- `year` (string)

### `searchcode` (~342 tokens)

Per-repo code intelligence via SearchCode (free, no auth). Use analyze for instant repo overview (languages, complexity, tech stack, credentials), search for searching code within a repo, findings for code quality issues, file_tree to list files, or get_file to read a file. No rate limits. e.g. searchcode(action='analyze', repository='https://github.com/expressjs/express')

Input parameters:

- `action` (string, required): analyze=repo overview, search=search code, findings=quality issues, file_tree=list files, get_file=read file
- `case_sensitive` (boolean): Case-sensitive search (for search action)
- `category` (string): Filter findings by category (for findings action)
- `context_lines` (integer): Context lines around matches (for search action)
- `detail_level` (string): Response verbosity (for analyze action)
- `end_line` (integer): End line (for get_file without symbol_name)
- `language` (string): Language filter (for analyze action)
- `max_results` (integer): Max results (for search/findings)
- `path` (string): Subdirectory path filter (for analyze/findings/file_tree)
- `query` (string): Search query (for search action)
- `repository` (string): Git URL or owner/repo — REQUIRED for every searchcode action (e.g. https://github.com/expressjs/express)
- `severity` (string): Filter by severity (for findings action)
- `start_line` (integer): Start line (for get_file without symbol_name)
- `symbol_name` (string): Function/class name to extract (for get_file action)

### `code_search` (~222 tokens)

Search code, docs, and symbols across indexed dependencies and public repositories. Package scope (npm:express, pypi:requests) via PkgSeer; global public-code search via Sourcegraph (keyless). Supports qualifiers like kind:, category:, lang:. e.g. code_search(query='handleAuth', target='npm:express')

Input parameters:

- `lang` (string): Programming language filter
- `limit` (integer): Max results (1-100)
- `query` (string, required): Search query supporting implicit AND, OR, parens, -exclude, and qualifiers (kind:, lang:, path:)
- `source` (string): Restrict results to a specific source type
- `target` (string): Package scope: registry:name[@version] (npm:express, pypi:requests, crates:serde). PkgSeer indexes npm/pypi/crates only. Omit target for global public-repo search via Sourcegraph (keyless). For singl…

### `code_files` (~108 tokens)

List files in an indexed dependency by package-scoped path (e.g. npm:express/src/). PkgSeer + jsDelivr; indexes npm/pypi/crates ONLY (github: specs rejected). e.g. code_files(spec='npm:express')

Input parameters:

- `path_prefix` (string): Optional path prefix filter (e.g. src/)
- `spec` (string, required): Package spec: registry:name[@version] (e.g. npm:express, pypi:requests)

### `code_read` (~102 tokens)

Read a file from an indexed dependency by package-scoped path. PkgSeer + jsDelivr; indexes npm/pypi/crates ONLY (github: specs rejected). e.g. code_read(spec='npm:express', path='src/index.js')

Input parameters:

- `path` (string, required): File path within the package (e.g. src/index.js)
- `spec` (string, required): Package spec: registry:name[@version] (e.g. npm:express)

### `pkg` (~216 tokens)

Package intelligence: info (composite metadata — Libraries.io + Sonatype + PkgSeer), changelog (release notes), upgrade_review (vulns+changelog+deps diff between versions), files (list source files), read (read a source file). For raw single-source registry queries (npm versions, crates categories), use `search_package` instead. e.g. pkg(name='express', action='info')

Input parameters:

- `action` (string)
- `count` (integer): Max changelog entries
- `current_version` (string): Current version for upgrade_review
- `from_version` (string): Start of version range for changelog (optional)
- `name` (string, required)
- `path` (string): File path filter (files) or exact path (read)
- `registry` (string)
- `target_version` (string): Target version for upgrade_review
- `to_version` (string): End of version range for changelog (optional)
- `version` (string): Package version (default: latest)

### `enrich` (~135 tokens)

Fetch full content for a list of search results, deduplicate, and rerank by relevance. Give it results from any search tool plus the original query. e.g. enrich(query='rust async', results=[{'url':'...','title':'...'}])

Input parameters:

- `include_html` (boolean): Include raw HTML in content (default strips to text)
- `max_fetch_size` (integer): Max results to fetch content for
- `query` (string, required)
- `results` (array, required): List of result objects to enrich (url, title, text/snippet, source)
- `top_k` (integer): Max enriched results to return

### `analyze` (~105 tokens)

Deep repo analysis: parallel-fetch GitHub metadata + SearchCode code quality + DeepWiki architecture + CodeWiki sections in one call. Start here for unfamiliar repos before surgical wiki/searchcode calls. Accepts GitHub URLs or owner/repo strings. May take 10-15s (parallel API calls). e.g. analyze(repository='sst/opencode')

Input parameters:

- `repository` (string, required): GitHub repo: URL (https://github.com/owner/repo) or owner/repo string

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Dependencies. The full working is on the page: https://verifymcp.io/servers/sk-dev-ai-codesearch/skdev-codesearch-mcp#diagnostics

## Score history

- 2026-10-23: 51

## Common questions

### What is the io.github.SK-DEV-AI/codesearch MCP server?

io.github.SK-DEV-AI/codesearch is an MCP server listed in the public MCP registry as io.github.SK-DEV-AI/codesearch. Code, package, docs, paper and vulnerability search. 17 tools, keyless lanes. This page covers its PyPI package (skdev-codesearch-mcp).

### Is the io.github.SK-DEV-AI/codesearch MCP server safe to use?

io.github.SK-DEV-AI/codesearch scores 51 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 23 October 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the io.github.SK-DEV-AI/codesearch MCP server expose?

io.github.SK-DEV-AI/codesearch exposes 17 tools: ping, wiki, search_all, search_package, so_search, and 12 more. Their descriptions and schemas cost roughly 3,123 tokens of context every time the server is loaded.

### Is the io.github.SK-DEV-AI/codesearch MCP server still maintained?

io.github.SK-DEV-AI/codesearch is still listed as active in the MCP registry. We last reached this channel on 23 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the io.github.SK-DEV-AI/codesearch MCP server under?

io.github.SK-DEV-AI/codesearch declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- PyPI project: https://pypi.org/project/skdev-codesearch-mcp/
- Socket report: https://socket.dev/pypi/package/skdev-codesearch-mcp
- Repository: https://github.com/SK-DEV-AI/codesearch
- Changelog RSS feed: https://verifymcp.io/servers/sk-dev-ai-codesearch/skdev-codesearch-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/sk-dev-ai-codesearch/skdev-codesearch-mcp.json
- HTML version of this page: https://verifymcp.io/servers/sk-dev-ai-codesearch/skdev-codesearch-mcp