Mcp Codeaudit
Scan local code and diffs for leaked secrets and check dependencies against OSV before you ship from an AI-assisted workflow.
Overview
mcp-codeaudit is a MCP server for the Ship phase that lets AI agents scan code and diffs for leaked secrets and check dependencies via OSV.
What is this MCP server?
- Scan code and diffs for leaked secrets
- Dependency vulnerability checks using OSV
- Agent-invokable audit tools over MCP stdio
- npm package @infoinlet/mcp-codeaudit v0.1.1
- From infoinlet-marketplace/services/mcp-codeaudit
- Server version 0.1.1
- npm identifier @infoinlet/mcp-codeaudit
- Capabilities: secret scan on code/diffs plus OSV dependency checks
What problem does it solve?
AI-generated commits and rushed releases make it easy to commit API keys or pull in vulnerable packages without a quick audit in the agent loop.
Who is it for?
Indie developers who want Claude Code or Cursor to gate PRs and releases with secrets and dependency vulnerability passes.
Skip if: Organizations needing formal compliance attestations, DAST, or full commercial SAST coverage from this MCP alone.
What do I get? / Deliverables
After MCP setup, your agent can run secret scans and OSV-backed dependency checks and surface findings before you ship.
- Secret-leak findings on code and diffs via agent tools
- OSV-based dependency vulnerability reports
- Repeatable pre-ship security pass inside the agent session
Recommended MCP Servers
Journey fit
How it compares
Focused secrets-and-OSV MCP audit, not a complete DevSecOps platform or generic code-review skill.
Common Questions / FAQ
Who is mcp-codeaudit for?
Solo and small-team builders using MCP agents who want fast secret-leak and dependency vulnerability checks before shipping.
When should I use mcp-codeaudit?
Use it in Ship—before merging AI-assisted changes, tagging a release, or deploying when you need diff-aware secret scans and OSV dependency lookups.
How do I add mcp-codeaudit to my agent?
Install @infoinlet/mcp-codeaudit from npm, add the stdio MCP server to Claude Code, Cursor, or another MCP client, and invoke audit tools against your workspace per marketplace docs.