LLM Code Security Review MCP Server

This MCP server is a companion tool for the llm-code-security-review methodology. It helps an LLM follow the review plan one step at a time. The LLM performs the security review; the server tracks progress, makes sure the LLM actually reads all source code assigned to each subsystem, and does not accept the review as complete until every plan step is finished.

The Short Version

1. Load a review plan.

2. Codex receives one subsystem and one security area at a time.

3. The server checks that the assigned source was read before accepting the result.

4. Progress is saved automatically. You can restart Codex, pause the review, or continue later without starting over.

5. Findings must be reviewed separately. The server organizes the work; it does not decide whether a reported issue is real.

That is the whole job.

Related MCP server: DevFlow MCP Server

What You Need

• Codex on Linux, macOS, or another POSIX system;

• Python 3.11 or newer;

• a review plan created with the companion methodology.

The server has no third-party Python dependencies.

Install It

git clone https://github.com/drewrukin/llm-code-security-review-mcp.git
cd llm-code-security-review-mcp
python3 -m venv .venv
. .venv/bin/activate
python3 -m pip install .

Add the server to ~/.codex/config.toml. Replace the example path with the absolute path to your clone:

[mcp_servers.llm-code-security-review-mcp]
command = "/absolute/path/to/llm-code-security-review-mcp/.venv/bin/llm-code-security-review-mcp-server"

Start a new Codex session after changing the configuration.

Run a Review

First, use the companion methodology to create a plan for your project. Then start a new Codex session and say:

Use the llm-code-security-review-mcp server to load <path-to-plan.json> and execute the review.

The server will provide the first task and keep the review moving until the plan is complete.

Development

Run the test suite with:

python3 -m unittest discover -s tests

Released changes are in CHANGELOG.md. Please report security problems privately as described in SECURITY.md.

License

Copyright 2026 Andrew Rukin (drewrukin). Licensed under the Apache License 2.0.