Code Guardian

Stop shipping code that isn't ready for production. Code Guardian audits your project against industry standards, generates production-ready patterns, and enforces quality gates — across every AI coding agent.

What is this?

You're building an app. You ask an AI agent to write code. It delivers something that works — but doesn't have tests, error handling, CI/CD, security headers, or proper logging. You ship it, and three days later production burns down.

Code Guardian exists to fix that.

It's an MCP plugin that gives every AI coding agent (Claude Code, Cursor, Windsurf, Devin, Codex, Gemini, Antigravity) built-in knowledge of what production-ready code actually looks like. Before any feature is implemented, it audits the project. After any change, it checks whether it meets industry standards. And when you need to start fresh, it generates complete project scaffolds with zero guesswork.

Think of it as a senior engineer who reviews every line of code the AI writes — but automated, instant, and consistent.

Related MCP server: repo-guardian

Supported Agents

Works with every major AI coding agent out of the box:

Quick Start

Claude Code — Two ways to install

Option 1: npm link (Recommended)

# Clone the repo
git clone https://github.com/justin-coders/code-guardian.git
cd code-guardian

# Build (no dependencies, but validate the entry point)
node --check src/stdio-server.js

# Install as a global CLI so Claude Code can find it
npm link

# In Claude Code, enable the plugin:
#   /plugin marketplace add justin-coders/code-guardian
#   /plugin install

Option 2: Manual MCP config

Add this to your ~/.claude/settings.json under mcpServers:

{
  "code-guardian": {
    "type": "stdio",
    "command": "node",
    "args": ["/absolute/path/to/code-guardian/src/stdio-server.js"]
  }
}

Then restart Claude Code.

After Installation

The plugin loads automatically. Just ask:

"Audit this project for production readiness"
"Generate a production REST API with NestJS and Zod validation"
"Show me the industry standard for JWT authentication"
"Create a GitHub Actions CI/CD pipeline for my Express app"

Cursor — Quick add

Add one entry to your ~/.cursor/mcp.json:

{
  "mcpServers": {
    "code-guardian": {
      "command": "node",
      "args": ["/absolute/path/to/code-guardian/src/stdio-server.js"]
    }
  }
}

Restart Cursor. The tools are now available in your prompts.

Windsurf — Same as Cursor

Add the same MCP config to ~/.windsurf/mcp.json.

Other agents (Devin, Codex, Gemini, Antigravity)

These agents don't support MCP plugins directly. Use Code Guardian as a standalone tool — clone the repo and run it, then paste the output into your agent's context, or follow the agent-specific guidance in INSTALLATION.md.

Updating an existing install

cd /path/to/code-guardian
git pull origin dev    # or your branch

# If using npm link:
npm unlink && npm link

# If using manual MCP config: no action needed — path still points to repo

# Restart your agent
# Claude Code: close and reopen
# Cursor/Windsurf: restart the editor

What It Does

1. Audit Everything

Run a full production-readiness audit on any project in seconds:

> "Audit this project"

Covers 10 dimensions and gives you an A–F grade with specific remediation steps for every failure:

2. Generate Production-Ready Code

Stop copying Stack Overflow snippets. Get templates that follow industry conventions:

> "Generate a production REST API with NestJS"
> "Create a JWT auth module for Express"
> "Generate a Dockerfile for my NestJS app"

Available templates:

3. Enforce Standards

Every tool includes remediation guidance — not just "you failed X", but "here's exactly how to fix it":

❌ Missing ESLint
→ Add eslint.config.js with: strict mode, no-unused-vars, prefer-const, no-console in prod

❌ No TypeScript strict mode
→ Enable: strict: true, noUncheckedIndexedAccess: true, exactOptionalPropertyTypes: true

❌ No CI pipeline
→ Add .github/workflows/ci.yml with: lint → test → type-check on PR, deploy on main merge

4. Know Your Agent

Auto-detects which AI agent you're using and surfaces the right best practices:

> "What's the best way to use Code Guardian with Cursor?"
> "Detect which agent I'm using"

Each agent gets tailored guidance on plugin structure, configuration files, and workflows.

10 Industry Pattern Categories

Built-in knowledge of production standards across every major concern:

1. REST API — Correct HTTP status codes, schema validation, pagination, OpenAPI/Swagger docs

2. Authentication — JWT with short expiry, RBAC, MFA, token rotation, CSRF protection, brute-force mitigation

3. Database — Versioned migrations, connection pooling, N+1 query prevention, soft deletes, read replicas

4. Testing — 80%+ coverage targets, test pyramid (unit/integration/E2E), Arrange-Act-Assert, mock strategies

5. Error Handling — Centralized global handlers, custom error classes, consistent response shape, Sentry integration

6. Logging — Structured JSON logs, correlation/request IDs, log levels per environment, centralized aggregation

7. Security — OWASP Top 10 compliance, helmet.js, CORS whitelists, rate limiting, parameterized queries only

8. CI/CD — Parallel jobs, node_modules caching, blue-green deployment, rollback scripts, failure notifications

9. Docker — Multi-stage builds, Alpine/Distroless bases, non-root user, healthchecks, resource limits

10. Branch Strategy — Git Flow / trunk-based conventions, PR requirements, semantic versioning, squash vs merge rules

File Structure

code-guardian/
├── src/
│   ├── tools.js              # 15 tools + 10 industry patterns + code templates
│   ├── stdio-server.js       # stdio MCP server (Claude Code, Cursor, Windsurf)
│   └── http-server.js        # HTTP/SSE server (port 8765)
├── tests/
│   ├── tools.test.js         # 57 unit tests
│   └── integration.test.js   # 26 integration tests
├── .claude-plugin/
│   └── plugin.json           # Plugin manifest
├── .mcp.json                 # Dual transport config (stdio + HTTP)
├── package.json              # Zero dependencies
├── LICENSE                   # MIT
├── README.md
├── INSTALLATION.md
├── CONTRIBUTING.md
├── UPCOMING_FEATURES.md
└── CHANGELOG.md

Zero dependencies. Pure ESM Node.js. No npm install required.

Complete Tool Reference

Production Readiness Grading

Development

# Run all tests
node --test tests/**/*.test.js

# Run with coverage report
node --test --experimental-test-coverage tests/**/*.test.js

# Syntax check
node --check src/tools.js
node --check src/stdio-server.js
node --check src/http-server.js

83 tests passing. 57 unit tests + 26 integration tests covering all 15 tools.

Adding a New Tool

1. Implement in src/tools.js with defensive args (args = {})

2. Add to TOOLS array in both src/stdio-server.js and src/http-server.js

3. Add switch case in handleRequest() / dispatchTool()

4. Write unit tests in tests/tools.test.js and integration tests in tests/integration.test.js

5. Document in README.md tools table

See CONTRIBUTING.md for the full guide.

License

MIT — use it freely in personal and commercial projects.

Built With

• Model Context Protocol — open standard for AI tool integration

• Node.js — runtime (ESM, zero dependencies)

• GitHub Actions — CI reference templates

Made with care by justin-coders. Questions? Open an issue.

Copyright (c) 2026 justin-coders