detect_projectLABSCO SUMMARY
A planning and evidence layer for coding agents, not a scanner.
There is no SAST engine and no vulnerability database behind it, and nothing here writes to your repository or opens anything on GitHub. What it gives an agent is a bounded read of the project and an ordered plan to argue with before it changes a line.
What it is
A read-only server that inspects a repository and returns findings and plans; it never edits. It detects the project — package manager, framework, language, tests, auth, database, deployment and CI — then returns a routing manifest that gives an agent workflow phases, a tool order, quality gates and disallowed actions to work to. It is listed in some places under its earlier name, RepoSentinel.
What you get
- Project detection: package manager, framework, language, tests, auth, database, deployment, CI and risk notes, with Python stacks covered alongside JavaScript ones
- A skill-routing manifest: workflow phases, recommended tool sequence, activation order, quality gates, required outputs and disallowed actions
- A classified repository tree — important, risk, docs, test and config files
- Maintainability checks for long files, weak schema boundaries, mixed responsibilities, thin error handling and missing tests
- Next.js security checks across routes, middleware, env, headers, validation, logging, redirects, SSRF, uploads, rate limits and auth
- A docs-claims audit mapping strong README claims to the evidence found or missing for each
- An audit of the agent skills installed locally, for supply-chain, prompt-injection, secret-leakage, dependency-install, webhook and destructive-shell risks
- Issue plans, PR plans with branch name and tests to run, and markdown reports handed back rather than written into the repository
- Findings that carry severity, category, evidence, recommendation and confidence, with secret-like values redacted
Requirements
For local use, the published npm package run through npx — no account and no key. A remote deployment is a different shape: it expects an API key on the connection, a list of allowed project roots so reads stay inside approved workspaces, and HTTPS in front of it. Reads never leave the project root you supply, and no tool executes shell commands.
Setup effort
One command — npx -y @priyanshuchawda/codeaudit
USE CASES
01
Sizing up a repository before touching it
Detects stack, package manager, tests, auth, database, deployment and CI, then classifies the tree into important, risk, docs, test and config files.
02
Giving a coding agent a plan to follow
Returns workflow phases, a recommended tool sequence, quality gates and disallowed actions, plus where to look up current official docs for the stack it found.
03
Finding the maintainability and security issues worth filing
Heuristic checks for long files, weak schema boundaries, mixed responsibilities and thin error handling, Next.js checks across routes, middleware, env, headers, validation, redirects, SSRF, uploads, rate limits and auth, and a read of where tests are missing.
04
Checking whether the docs match the code
Maps strong README and docs claims to the evidence found or missing for each, and says whether to add evidence or soften the claim.
05
Auditing the agent skills installed on your machine
Inspects local skill files for supply-chain, prompt-injection, secret-leakage, dependency-install, webhook and destructive-shell risks — reading them only, never running them.
06
Turning findings into work
Findings become an issue plan, a PR plan with branch name and tests to run, or a markdown report handed back in the conversation rather than written into the repository.
12 tools
Listed in project docs. Your client may show a different list.
route_skillsscan_repoaudit_code_qualityaudit_nextjs_securityaudit_docs_claimsaudit_testsaudit_installed_skillsofficial_docs_routergenerate_issue_plangenerate_pr_plangenerate_reportBEFORE YOU INSTALL
What to know first
Tools you get
12 tools named in the project's documentation. All twelve are read-only: the three generate_* tools return markdown plans instead of writing to your repository, and CODEAUDIT_ALLOWED_ROOTS limits which paths the tools can read.
Requires
- npx on PATH
- CODEAUDIT_API_KEY only if you deploy it over HTTP — the default local route needs no key
Where it runs
All 10 documented clients run the server on your machine.
INSTALLATION
Connect your client
Server setup
TERMINAL
npx -y @priyanshuchawda/codeauditMCP Clients
Codex
CODEX · TOML
[mcp_servers.codeaudit]
command = "npx"
args = ["-y", "@priyanshuchawda/codeaudit"]
startup_timeout_sec = 40Claude Code
CLAUDE CODE · TERMINAL
claude mcp add --scope user codeaudit -- npx -y @priyanshuchawda/codeauditCursor, Claude Desktop, Gemini CLI
JSON
{
"mcpServers": {
"codeaudit": {
"command": "npx",
"args": [
"-y",
"@priyanshuchawda/codeaudit"
]
}
}
}VS Code
VS CODE · JSON
{
"servers": {
"codeaudit": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@priyanshuchawda/codeaudit"
]
}
}
}Cline, Roo Code, Windsurf, Other MCP clients
JSON
{
"mcpServers": {
"codeaudit": {
"command": "npx",
"args": [
"-y",
"@priyanshuchawda/codeaudit"
],
"disabled": false
}
}
}
