Codesentinel

What is Codesentinel?

Codesentinel is a Model Context Protocol (MCP) server that analyzes source code for security vulnerabilities, deceptive patterns, placeholder code, code smells, and good practices. It integrates with Claude Code and other MCP-compatible clients to serve as a quality gate before issues reach production.

How to use Codesentinel?

Install globally via npm (npm install -g code-sentinel-mcp) and add to Claude Code using claude mcp add code-sentinel -- npx code-sentinel-mcp, or manually configure the MCP server in ~/.claude/claude_desktop_config.json. Use the provided tools by asking Claude Code to analyze code snippets or files.

Key features of Codesentinel

• Detects 93 distinct patterns across 5 categories
• Security analysis: hardcoded secrets, SQL injection, XSS, command injection
• Deceptive pattern detection: empty catch blocks, silent failures, linter suppression
• Placeholder detection: TODOs, lorem ipsum, incomplete implementations
• Error and code smell detection: type coercion, null references, async anti‑patterns
• Strength recognition: highlights proper typing, error handling, testing patterns

Use cases of Codesentinel

• Audit AI‑generated code for hardcoded secrets, empty catch blocks, and placeholders before merging
• Review pull requests for security vulnerabilities and error‑hiding patterns
• Scan existing codebases for missing error handling and risky patterns during refactoring
• Generate visual HTML reports for team review of code quality

FAQ from Codesentinel

Which languages does Codesentinel support?

Codesentinel supports TypeScript, JavaScript, Python, Go, Rust, Java, Kotlin, Swift, C#, C/C++, PHP, Vue, and Svelte, with language detection based on file extension.

How is the quality score calculated?

The score (0–100) is 100 - (critical × 25) - (high × 15) - (medium × 5) - (low × 1) + (strengths × 2). Critical issues deduct 25 points, strengths add 2 points each.

What tools does Codesentinel provide?

Tools include analyze_code, generate_report, check_security, check_deceptive_patterns, check_placeholders, analyze_patterns, and analyze_design_patterns. Each accepts code and filename parameters and returns structured JSON or HTML reports.

Can I add custom detection patterns?

Yes. Edit files in src/analyzers/ (security.ts, deceptive.ts, placeholders.ts, errors.ts, strengths.ts) following the existing pattern structure with regex, severity, and optional verification logic.

How does the verification feature work?

Many patterns include a verification object with assumption, confirmIf, and falsePositiveIf fields to reduce false positives by confirming only when the pattern matches certain contextual conditions.