Loading ToolBench
Read-only MCP server for AI coding agents: repo inspection, skill routing, heuristic audits, docs evidence checks, and issue/PR planning.
CodeAudit has 12 well-named, verb-prefixed tools with complete Zod schemas and descriptions. All tools are READ_ONLY and follow a consistent audit/analysis pattern. However, output schemas are not documented in the source, only input schemas are visible. Descriptions are adequate (100 - 200 chars) but lack dependency hints and recovery guidance. Parameters are typed and constrained (enums, defaults, ranges), but error handling and composition patterns are not evident from the code provided. No tool annotations (readOnlyHint, etc.) are visible. The server is read-only, which mitigates security risk, but lacks structured error guidance and output documentation.
Find maintainability risks including long files, mixed responsibilities, missing tests, weak schema boundaries, and error-handling smells.
Extract strong README/docs claims and map them to evidence or missing evidence.
Audit local agent skills for supply-chain, prompt-injection, secret-leakage, dependency-install, webhook, destructive-shell, manifest-quality, duplicate-name, auxiliary-doc, and resource-discovery risks.
Audit Next.js middleware, route handlers, input validation, auth, rate limits, headers, env safety, logging, SSRF, redirects, and upload risks.
Detect test frameworks, test files, weak tests, missing areas, and recommended tests.
Detect project state, stack, package manager, tests, auth, database, deployment, CI, and risk notes.
Output schemas not documented. LLMs cannot plan downstream tool calls or extract structured data without knowing what fields to expect from audit results, issue plans, and reports.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint) visible in source. Agents cannot distinguish read-only tools from destructive ones without explicit hints.
Inferred effective spec: 2025-06-18+.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 60 | 2025-06-18+ | v2 |
Group findings into prioritized GitHub issue candidates with labels and branch names.
Create a scoped PR workflow from selected findings or an issue candidate.
Generate report markdown strings for audit, security, code quality, docs evidence, issue, and PR plan outputs.
Route technology questions to preferred official docs sources and safe query guidance.
Return a skill-routing manifest with workflow phases, recommended tool sequence, skill activation order, quality gates, required outputs, instructions, and disallowed actions.
Summarize a repository tree and classify important, risk, docs, test, and config files.
Descriptions lack dependency hints and recovery guidance. E.g., 'route_skills' accepts optional 'detectedProject' but does not explain when to call detect_project first or what happens if omitted.
No error handling or recovery guidance visible. Audit tools may fail on malformed projects, missing files, or unsupported frameworks, but no error classification or actionable recovery steps are documented.
generate_report accepts 'projectMetadata' as a generic object with no schema. LLMs cannot infer what fields are valid or required.