Code Sentinel

salrad22/code-sentinel

A pattern-based code analyzer that catches the subtle issues AI assistants tend to introduce: empty catch blocks that swallow errors, fake implementations that always return true, TODO placeholders left behind, and hardcoded secrets. Exposes five tools through MCP: analyze_code for full JSON output, generate_report for visual HTML summaries, and three focused checkers for security, deceptive patterns, and placeholders. Scans for 93 distinct patterns across TypeScript, Python, Go, Rust, Java, and JavaScript. Works locally via stdio or as a remote Cloudflare Workers endpoint. Unlike AST-based linters that validate syntax, this specifically hunts for semantically valid code that hides failures or creates false confidence. Useful when reviewing AI-generated code before it ships or when you want to audit error handling patterns across a codebase.

GitHub stars: 3
tools: 7
transport: STDIO
last updated: Jan 3, 2026

View on GitHub

Tools

7 tools

Public tool metadata for what this MCP can expose to an agent.

analyze_codeAnalyze code for security issues, errors, deceptive patterns, and placeholders. Returns a structured analysis with issues and strengths.2 params

Analyze code for security issues, errors, deceptive patterns, and placeholders. Returns a structured analysis with issues and strengths.

Parameters* required

codestring

The source code to analyze

filenamestring

The filename (used to detect language). Example: 'app.ts'

generate_reportAnalyze code and generate a detailed HTML report with visual indicators for issues and strengths.2 params

Analyze code and generate a detailed HTML report with visual indicators for issues and strengths.

Parameters* required

codestring

The source code to analyze

filenamestring

The filename (used to detect language). Example: 'app.ts'

check_securityCheck code for security vulnerabilities only (hardcoded secrets, SQL injection, XSS, etc.)2 params

Check code for security vulnerabilities only (hardcoded secrets, SQL injection, XSS, etc.)

Parameters* required

codestring

The source code to check

filenamestring

The filename

check_deceptive_patternsCheck for code patterns that hide errors or create false confidence (empty catches, silent failures, etc.)2 params

Check for code patterns that hide errors or create false confidence (empty catches, silent failures, etc.)

Parameters* required

codestring

The source code to check

filenamestring

The filename

check_placeholdersCheck for placeholder code, dummy data, TODO/FIXME comments, and incomplete implementations2 params

Check for placeholder code, dummy data, TODO/FIXME comments, and incomplete implementations

Parameters* required

codestring

The source code to check

filenamestring

The filename

analyze_patternsAnalyze code for architectural, design, and implementation patterns. Detects pattern usage, inconsistencies, and provides actionable suggestions for improvement.4 params

Analyze code for architectural, design, and implementation patterns. Detects pattern usage, inconsistencies, and provides actionable suggestions for improvement.

Parameters* required

codestring

The source code to analyze

filenamestring

The filename (used to detect language)

levelstring

Pattern level to analyze: 'architectural' (system structure), 'design' (GoF patterns), 'code' (implementation idioms), or 'all' (default)one of architectural · design · code · all

querystring

Optional natural language query to focus analysis (e.g., 'how is error handling done?')

analyze_design_patternsFocused analysis of Gang of Four (GoF) design patterns in code. Detects Singleton, Factory, Observer, Strategy, and other classic patterns with confidence levels and implementation details.2 params

Focused analysis of Gang of Four (GoF) design patterns in code. Detects Singleton, Factory, Observer, Strategy, and other classic patterns with confidence levels and implementation details.

Parameters* required

codestring

The source code to analyze

filenamestring

The filename (used to detect language)

Readme

CodeSentinel MCP Server

A comprehensive code quality analysis server for the Model Context Protocol (MCP). CodeSentinel integrates with Claude Code and other MCP-compatible clients to detect security vulnerabilities, deceptive patterns, incomplete code, and highlight good practices.

Why CodeSentinel?

AI coding assistants can inadvertently introduce subtle issues: hardcoded secrets, empty catch blocks, TODO placeholders left behind, or patterns that hide errors. CodeSentinel acts as a quality gate, analyzing code for 93 distinct patterns across 5 categories before issues reach production.

Key differentiators:

Verification-aware detection: Many patterns include verification steps to reduce false positives
LLM-optimized output: Structured JSON output designed for AI consumption and action
Balanced analysis: Detects both issues AND strengths for fair code assessment
Multi-language support: Works with TypeScript, JavaScript, Python, Go, Rust, Java, and more

Why Not Tree-sitter or AST-Based Tools?

CodeSentinel intentionally uses a pattern-based approach rather than AST parsing. Here's why:

View the full README on GitHub

Details

Repository: github.com/salrad22/code-sentinel
Category: Security & Pentesting
Package: code-sentinel-mcp
Transport: STDIO
Registry: MCP registry, active

Related Security & Pentesting MCP servers

View all

Guardianshieldsparkvibe-io/guardianshieldAI security layer: code scanning, PII detection, prompt injection, secrets, CVEs3stars

Symdexsymdex-100/symdexIndex and search codebases using structured schemas for deep code analysis. Audit specific domains or security-related functions to ensure code quality and safe3stars

Siteaudit Mcpvdalhambra/siteaudit-mcpSEO, performance, and security audits for any URL — no API keys required3stars

AIPayGen Site Inteldamien829/aipaygenWebsite and company intel for agents: DNS, WHOIS, SSL, tech stack, email security, profiles2stars

Inkoginkog-io/inkog-mcpSecurity co-pilot for AI agents. Scan for vulnerabilities, audit MCP servers, verify governance.2stars