# CodeInspectus (npm · codeinspectus)

Local-first MCP security scanner and CLI for AI-generated applications.

- Trust score: 67/100 (medium)
- Change this week: +61
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `codeinspectus`: 67/100 (this document), [markdown](https://verifymcp.io/servers/synvoya-codeinspectus/codeinspectus.md), [page](https://verifymcp.io/servers/synvoya-codeinspectus/codeinspectus)

## Channel facts

- Registry: `npm`
- Package: `codeinspectus`
- Version: `2.0.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (101 of 105), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (101 of 105), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 1 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 67/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1099 tokens (~183/item across 6 items; 6 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 95/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 83% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add synvoya-codeinspectus -- npx -y codeinspectus
```

### Codex

```bash
codex mcp add synvoya-codeinspectus -- npx -y codeinspectus
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "synvoya-codeinspectus": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "codeinspectus"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add synvoya-codeinspectus --command npx --arg -y --arg codeinspectus
```

### Hermes

```yaml
mcp_servers:
  synvoya-codeinspectus:
    command: "npx"
    args: ["-y", "codeinspectus"]
```

### Other

```json
{
  "mcpServers": {
    "synvoya-codeinspectus": {
      "command": "npx",
      "args": [
        "-y",
        "codeinspectus"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 67, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 66, +53)

- [security regression] Install scripts: pass → unverified
- [security regression] Provenance: fail → unverified
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [functional regression] Maintenance: pass → unverified
- [functional regression] License: pass → unverified
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional] Licence: MIT

### 2026-08-01 (score 13, −30)

- [security regression] Stability: 0.17 → unverified
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified

### 2026-07-31 (score 43, +37)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 6, 0)

- [functional regression] Security disclosure: unverified → fail
- [functional] Package version: 1.5.0 → 2.0.0

### 2026-07-29 (score 6, −53)

- [security regression] Known CVEs: partial → unverified
- [security regression] Provenance: fail → unverified
- [security regression] Install scripts: pass → unverified
- [functional regression] Security disclosure: fail → unverified
- [functional regression] License: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Dependency health: partial → unverified
- [functional regression] Maintenance: pass → unverified
- [functional] Licence: MIT
- [functional] Package version: 1.0.0 → 1.5.0

### 2026-07-28 (score 59, +53)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] License: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Tool coverage: 100
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: excellent
- [functional] First check of Tool coverage: 83
- [functional] First check of Schema quality: fail
- [functional] Licence: MIT

### 2026-07-27 (score 6)

First indexed and scored.

## MCP tools (6)

### `codeinspectus_scan` (~253 tokens)

Scan code for security issues

Run a full local security scan of a path: bundled engines (Opengrep SAST, Gitleaks secrets, Trivy SCA/IaC/license), CodeInspectus's offline native Pub SCA, plus AI-code-specific checks (client-side secret exposure, Supabase RLS/inverted-auth, prompt-injection sinks, API-boundary failures, and explicit runtime-control misconfiguration). Returns CWE-keyed findings with fix recommendations, detected repository technologies, explicit native-pack execution counts, compliance tags, and three-state repository evidence for supported runtime controls. Fully offline — zero network egress at scan time. Never writes to your code or repo.

Input parameters:

- `include_compliance` (boolean): Include the per-framework compliance overview in the result (default: true).
- `max_findings` (integer): Cap the number of findings returned to protect agent context (default: 200).
- `path` (string, required): Absolute path to the repository or directory to scan.
- `scanners` (array): Limit which scanner classes run: sast, secret, vuln, misconfig, license, ai. Default: all.
- `severity_threshold` (string): Only return findings at or above this severity (default: info — all).

Output parameters:

- `compliance_overview` (object)
- `component_signatures` (object)
- `dependency_coverage` (array)
- `detected_technologies` (array)
- `disclaimer` (string)
- `duration_ms` (integer)
- `engine_details` (array)
- `engine_setup` (object)
- `engines_run` (array)
- `findings` (array)
- `git_safety` (object)
- `git_scope` (object)
- `history_revision` (object)
- `offline` (boolean)
- `pack_coverage` (array)
- `repository_root` (string)
- `scan_config` (object)
- `scan_id` (string)
- `secret_coverage` (string)
- `secret_suppression` (object)
- `security_control_evidence` (array)
- `started_at` (string)
- `summary` (object)
- `target` (string)
- `total_findings_before_limit` (integer)
- `trivy_db_date` (string)
- `trivy_db_provenance` (object)
- `truncated` (boolean)
- `warnings` (array)

### `codeinspectus_rescan` (~144 tokens)

Re-scan and diff against a prior scan

Re-run a scan after fixes were applied and diff against a prior scan_id (or the most recent scan of the same path). Reports which findings are resolved, which remain, and which were newly introduced, plus fresh technology and native-pack execution coverage. Use this to verify fixes. Never writes to your code or repo.

Input parameters:

- `max_findings` (integer)
- `path` (string, required): Absolute path to the repository or directory to rescan.
- `prior_scan_id` (string): scan_id of a previous scan to diff against. Defaults to the most recent scan of this path.
- `scanners` (array)
- `severity_threshold` (string)

Output parameters:

- `dependency_coverage` (array)
- `detected_technologies` (array)
- `disclaimer` (string)
- `introduced` (array)
- `not_rechecked` (array)
- `not_rechecked_note` (string)
- `pack_coverage` (array)
- `partial` (boolean)
- `prior_scan_id` (string)
- `remaining` (array)
- `resolved` (array)
- `scan_id` (string)
- `summary` (object)
- `target` (string)

### `codeinspectus_compliance_report` (~141 tokens)

Code-level compliance coverage report

Produce a per-framework code-level control-coverage view for a prior scan (NIST CSF 2.0, ISO 27001:2022, SOC 2, CIS v8.1, Essential Eight, OWASP Web/LLM). Reports 'X of N code-visible controls have findings' with the code-visible subset as the explicit denominator. This is NOT a compliance audit, certification, or attestation — code-level evidence only.

Input parameters:

- `framework` (string): Restrict the report to one framework. Default: all frameworks.
- `scan_id` (string, required): scan_id returned by a prior codeinspectus_scan call.

Output parameters:

- `disclaimer` (string)
- `frameworks` (array)
- `posture_note` (string)
- `posture_score` (number)
- `scan_id` (string)

### `codeinspectus_explain_finding` (~85 tokens)

Explain a finding in depth

Return a deep explanation and full remediation plan for a single finding id from a prior scan: what the weakness is, why it matters, concrete fix steps, and references.

Input parameters:

- `finding_id` (string, required): The finding id (e.g. CI-0007) to explain in depth.
- `scan_id` (string, required): scan_id the finding belongs to.

Output parameters:

- `explanation` (string)
- `finding` (object)
- `references` (array)
- `remediation`
- `why_it_matters` (string)

### `codeinspectus_generate_sbom` (~133 tokens)

Generate a software bill of materials

Generate a CycloneDX or SPDX SBOM for the target project using Trivy plus the first-party offline Pub lockfile inventory, with native Pub fallback when Trivy is unavailable. Writes the SBOM file to the chosen output path and returns its location and component count. Offline.

Input parameters:

- `format` (string): SBOM format (default: cyclonedx).
- `output_path` (string): Where to write the SBOM file. Default: ~/.codeinspectus/sbom/<project>.<fmt>.json.
- `path` (string, required): Absolute path to the project to generate an SBOM for.

Output parameters:

- `component_count` (integer)
- `coverage_state` (string)
- `ecosystems` (array)
- `format` (string)
- `generated` (boolean)
- `limitations` (array)
- `lockfiles_analyzed` (integer)
- `note` (string)
- `offline` (boolean)
- `output_path` (string)
- `providers` (array)

### `codeinspectus_list_rules` (~79 tokens)

List active rules and detector versions

List the active detectors and engine versions, the CodeInspectus detection-database version and date, Trivy vulnerability-DB freshness, bundled Pub advisory-database provenance/freshness, and the custom CodeInspectus AI-code rules and native detector packs currently shipped.

Input parameters:

- `engine` (string): Filter to one engine's rules/detectors.

Output parameters:

- `advisory_databases` (array)
- `custom_rule_count` (integer)
- `custom_rules` (array)
- `detection_db_date` (string)
- `detection_db_version` (string)
- `engine_setup` (object)
- `engines` (array)
- `native_packs` (array)
- `note` (string)
- `trivy_db_date` (string)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/synvoya-codeinspectus/codeinspectus#diagnostics

## Score history

- 2026-08-03: 67
- 2026-08-02: 66
- 2026-08-01: 13
- 2026-07-31: 43
- 2026-07-30: 6
- 2026-07-29: 6
- 2026-07-28: 59
- 2026-07-27: 6

## Links

- npm package: https://www.npmjs.com/package/codeinspectus
- Socket report: https://socket.dev/npm/package/codeinspectus
- Repository: https://github.com/Synvoya/codeinspectus
- Website: https://codeinspectus.com/
- Changelog RSS feed: https://verifymcp.io/servers/synvoya-codeinspectus/codeinspectus/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/synvoya-codeinspectus/codeinspectus/changelog.json
- HTML version of this page: https://verifymcp.io/servers/synvoya-codeinspectus/codeinspectus