Code MCP Server

If you already use Code, the code mcp server is the piece that lets your assistant work with it directly. Structural similarity-based code filter. Stops malicious code pattern reaching execution tools.

What the server does

A structural similarity-based code security filter for MCP (Model Context Protocol). Blocks dangerous code patterns before they reach execution tools by comparing code structure against a blacklist of known-bad patterns.

Installation

code-firewall-mcp on PyPI is all you need. Most clients run it directly, so configuration is a few lines and a restart.

Available tools

The toolset is worth reading before you wire it up, because it tells you what the integration is really for:

• firewall_system_check — Check system requirements — verify macOS, Apple Silicon, RAM
• firewall_setup_ollama — Install via Homebrew — managed service, auto-updates
• firewall_setup_ollama_direct — Install via direct download — no sudo, fully headless
• firewall_ollama_status — Check Ollama availability — verify embeddings are ready
• firewall_check — Check if a code file is safe to execute
• firewall_check_code — Check code string directly (no file required)
• firewall_blacklist — Add a dangerous pattern to the blacklist
• firewall_record_delta — Record near-miss variants for classifier sharpening
• firewall_list_patterns — List patterns in blacklist or delta collection
• firewall_remove_pattern — Remove a pattern from blacklist or deltas
• firewall_status — Get firewall status and statistics

Credentials and setup notes

Configuration is passed through the environment: FIREWALL_DATA_DIR, OLLAMA_URL. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.

• Python 3.10+ (< 3.14 due to onnxruntime compatibility) - Ollama (for embeddings) - ChromaDB (for vector storage) - tree-sitter (optional, for better parsing)

Worth knowing first

• It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
• With 11 tools registered it takes up a noticeable share of the context window; turn it off in projects that never touch Code.
• Missing credentials fail quietly in some clients — if no tools show up, check the environment block first.
• Keep per-call confirmation enabled while you learn its behaviour; it is the cheapest safeguard you have.

Where it fits

Plenty of developer tooling servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. Code's toolset — firewall_system_check, firewall_setup_ollama, firewall_setup_ollama_direct and 8 more — is a fair guide to whether it matches your workflow. It is maintained by egoughnour; worth a glance at recent repository activity before you build anything load-bearing on it.

We check each listing at SyncDev against the project's documentation before it goes live — if something here drifts out of date, it is a bug worth reporting.