Search / com.moltlinestudio/codereview
protogridR0· no sign-inRisk-scan a diff, flag AI-generated-code tells, find secrets. 5 of 7 tools need no account.
v1.2.0 · active · repository · website · descriptor JSON · versions
{
"mcpServers": {
"codereview": {
"type": "http",
"url": "https://mcp.moltlinestudio.com/codereview"
}
}
}claude mcp add --transport http codereview https://mcp.moltlinestudio.com/codereview[mcp_servers.codereview]
url = "https://mcp.moltlinestudio.com/codereview"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"codereview": {
"type": "remote",
"url": "https://mcp.moltlinestudio.com/codereview",
"enabled": true
}
}
}{
"mcpServers": {
"codereview": {
"type": "http",
"url": "https://mcp.moltlinestudio.com/codereview"
}
},
"deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=codereview&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vbWNwLm1vbHRsaW5lc3R1ZGlvLmNvbS9jb2RlcmV2aWV3In0%3D"
}{
"servers": {
"codereview": {
"type": "http",
"url": "https://mcp.moltlinestudio.com/codereview"
}
}
}{
"mcpServers": {
"codereview": {
"httpUrl": "https://mcp.moltlinestudio.com/codereview"
}
}
}extensions:
"codereview":
enabled: true
name: "codereview"
type: streamable_http
uri: "https://mcp.moltlinestudio.com/codereview"
timeout: 300
protocol.modernnewest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28protocol.statelessonly applies to 2026-07-28 serversprotocol.transportstreamable HTTPprotocol.list_ttlonly applies to 2026-07-28 serversauth.prm, auth.as_metadata, auth.cimdno remote uses OAuthauth.secret_in_urlno templated URLtools.descriptionsevery tool has a descriptiontools.description_lengthdescriptions are concisetools.schemasevery tool has an object input schematools.annotations7 of 7 tools declare readOnlyHint or destructiveHinttools.directory_hintsevery tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHinttools.token_costabout 2,025 tokens to load every tooltools.api_dumptools are not a one-to-one API dumpstability.changesno tool changes in 30 daysstability.rug_pullno tool changed its meaning under the same namedeps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI packageNo tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
+repository +dns-namespace +website +reachable +uptime-95% ~updated-42d-ago -duplicate-repo(22 names)
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
| remote | auth | reachable | uptime 30d | p50 | protocol | last ok |
|---|---|---|---|---|---|---|
https://mcp.moltlinestudio.com/codereview streamable-http | none | yes | 95% | 158 ms | 2025-11-25 | 2026-10-20 |
ai_code_smell_scanread-only | Flag the tells of unreviewed AI-generated code in a source file. FREE. Detects comments that restate the next line, leaked assistant preambles, placeholder TODOs, shipped 'Example usage' blocks, over-broad try/except that swallows errors, and auto-named identifiers. Typical input {"code": "<file contents>"} returns {"reviewed_confidence": 0-100, "hits": [{"smell": "...", "evidence": "<quoted snippet>"}], "reading": "...", "note": "..."}. Use on a full source file suspected of unreviewed machine authorship. Not on a diff (review_diff), and the result is a signal to check, not proof of authorship. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry. |
complexity_reportread-only | Report structural complexity of a source file, function by function. FREE. Measures per-function length, max nesting depth, and a cyclomatic-style branch count (if/for/while/case/&&/||/except), flagging functions too long or too deeply nested to review confidently. Typical input {"code": "<file contents>"} returns {"functions": N, "detail": [{"name": ..., "start": N, "lines": N, "branches": N, "max_depth": N}], "flags": ["..."], "note": "..."}. Use when structure rather than correctness is the question. Not for vulnerabilities (security_deep_dive). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry. |
get_reviewer_personaread-only | Load the Senior Reviewer persona for consistent, high-signal reviews. PREMIUM (license). The persona is a reviewing voice that is skeptical, specific, and kind — demands evidence over vibes and blocks only on real risk. Takes no arguments. Returns {"persona": ..., "identity": ..., "rules": ["...", ...], "opening_move": "..."} ready to adopt as a system prompt. Use to keep repeated reviews consistent in voice and rigor. Not for running a review - the scan tools do that. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry. |
review_checklistread-only | Produce a focused pull-request review checklist for a language or stack. FREE. Covers the things that actually break in production, with extra items per language. Typical input {"language": "python"} returns {"language": "python", "checklist": ["...", ...], "note": "..."}. Use before a review, to decide what to look for. Not for reviewing actual code - pass code to review_diff or security_deep_dive. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry. |
review_diffread-only | Risk-scan a unified diff the way a senior reviewer triages a PR. FREE. Flags added lines matching known risk patterns — injection sinks, disabled TLS, bare excepts, debug prints, TODOs, N+1 hints, leaked secrets — with the new-file line number and a severity (1 low - 4 high). Typical input {"diff": "<git diff output>"} returns {"added_lines": N, "risk_score": 0-100, "verdict": "...", "secrets": [...], "findings": [{"line": N, "severity": 1-4, "issue": "...", "code": "..."}], "note": "..."}. Use on a unified diff, when only the change matters. Not for whole-file analysis (complexity_report, ai_code_smell_scan). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry. |
secret_scanread-only | Scan text for accidentally-committed machine credentials and private-key material. FREE. Reports each match's location and category so it can be rotated before it leaks. Detection is pattern-based over the common leaked-credential formats; it never echoes the matched value back. Typical input {"text": "<file, diff, or config contents>"} returns {"leaked": bool, "count": N, "findings": [{"line": N, "type": "<category>"}], "note": "..."}. Pattern matching only - a clean result is not proof, and every hit needs human confirmation before anyone acts on it. Not a general security review (security_deep_dive). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry. |
security_deep_diveread-only | Run an OWASP-oriented security pass over a source file. PREMIUM (license). Checks injection sinks, auth/session handling, crypto misuse, SSRF/deserialization, and unsafe file/path handling — each finding cites the line, the OWASP risk class, and a concrete fix direction. Typical input {"code": "<file contents>"} returns {"issues": N, "findings": [{"line": N, "class": "A03 Injection", "fix": "...", "code": "..."}], "owasp_note": "..."}. Use on one source file when vulnerabilities are the question. Not for style or structure (complexity_report), and never a substitute for a security professional on high-risk code. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry. |
Schemas: list_tools.
21 other active names share this repository (showing 10): com.moltlinestudio/business, com.moltlinestudio/catalog, com.moltlinestudio/creator, com.moltlinestudio/data, com.moltlinestudio/dropship, com.moltlinestudio/educator, com.moltlinestudio/govern, com.moltlinestudio/humanizer, com.moltlinestudio/merchant, com.moltlinestudio/optimize
And 15 more from this publisher.
{
"name": "com.moltlinestudio/codereview",
"icons": [
{
"src": "https://moltlinestudio.com/icon-192.png",
"sizes": [
"192x192"
],
"mimeType": "image/png"
}
],
"title": "Moltline Code Review",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"remotes": [
{
"url": "https://mcp.moltlinestudio.com/codereview",
"type": "streamable-http"
}
],
"version": "1.2.0",
"repository": {
"url": "https://github.com/GarphenGate/moltline-mcp",
"source": "github"
},
"websiteUrl": "https://moltlinestudio.com/servers.html#codereview",
"description": "Risk-scan a diff, flag AI-generated-code tells, find secrets. 5 of 7 tools need no account."
}