How do I install the codesafer mcp server?

Use a recorded configuration for your client, replace example credential values and paths, and verify the documented runtime. Restart or reconnect the client, then inspect the available tools.

SSyncDev

Start a project

Codesafer MCP Server

Scans AI-generated code for invisible Unicode, Trojan Source, and supply-chain threats.

Local serverstdio

What is the Codesafer MCP Server?

Scans AI-generated code for invisible Unicode, Trojan Source, and supply-chain threats.

The short version

AI coding assistants generate code fast — but who's checking it for hidden threats?

Invisible Unicode characters — injected into identifiers (30+ variants)
BiDi / Trojan Source — attacks that reorder how code is displayed vs. executed (CVE-2021-42574)
Homoglyphs — — Cyrillic characters masquerading as Latin (CVE-2021-42694)
Glassworm-style Unicode steganography — hiding payloads in whitespace
Rules file backdoors — planted in .cursorrules, CLAUDE.md, and other AI config files
Typosquatted dependencies — in package.json

What it needs from you

Node.js 18 or later - An MCP-compatible client (Claude Code, Cursor, VS Code + Copilot, Cline)

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.

Recorded tools

Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.

Tool	What it does
scan_file	Scan a single file for hidden malicious code patterns
scan_directory	Recursively scan a directory across all source files
scan_rules_file	Scan an AI configuration/rules file for prompt injection and Rules File Backdoor attacks
check_dependencies	Check package.json for typosquatting, suspicious install scripts, and dependency risks
ai_analyze	Deep AI analysis using the trained CodeBERT model (classifies chunks as malicious/benign with confidence)
explain_finding	Get detailed explanation of a specific threat category, with attack scenarios and remediation

How to install the Codesafer MCP Server

claude mcp add codesafer -- npx -y npm

Configuration

Node.js 18 or later - An MCP-compatible client (Claude Code, Cursor, VS Code + Copilot, Cline)

Example prompts to try

“Use Codesafer to scan file.”
“Use Codesafer to scan directory.”
“Use Codesafer to scan rules file.”

Frequently asked questions

Scans AI-generated code for invisible Unicode, Trojan Source, and supply-chain threats. Confirm the tools offered by your installed version in the connected client. Tool availability and permissions depend on the server and account configuration.