A
licenseNot graded
qualityB
maintenanceAn MCP server that provides code quality checks for AI coding assistants, including file size limits, ESLint, architecture compliance, anti-pattern scanning, and comment compliance.
6 npm
MIT
graneth-mcp
by zubovartemiy
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@graneth-mcpCheck my staged changes for nonexistent packages and hardcoded secrets"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
graneth-mcp
Source for @graneth/mcp-server — an account-free MCP
server that checks AI-written changes before they are committed: packages that do not
exist, dependency risk shapes, and hardcoded secrets.
npx @graneth/mcp-serverTool documentation, install snippets for Claude Code / Cursor / Windsurf, and the exact
verdicts it returns: packages/mcp-server/README.md.
What is in this repository
| the MCP server itself — stdio, hand-rolled JSON-RPC, no runtime dependencies |
| the detection core it bundles: registry existence across six ecosystems, manifest parsing, secret patterns + entropy, risk scoring |
Related MCP server: code-verify-mcp
What is not
The hosted scanning service is a separate, closed codebase: pull-request scanning, the second-pass LLM triage, policy enforcement, signed receipts and billing are not here and are not open source. This repository is the free tool and the checks it runs — which is the part you install on your machine, and therefore the part worth being able to read.
How it is maintained
Generated from the internal monorepo, which is the source of truth. Edits made directly here are overwritten on the next sync, so please open an issue rather than a patch — the fix lands upstream and comes back with the next release.
Three of core-checks' test files are held back: they assert that the secret rules fire,
so their fixtures are literal example credentials, and every scanner — GitHub's push
protection and this project's own — reads them as the real thing. The rules themselves
are here in full (packages/core-checks/src/secrets.ts), as are the package's other tests.
Licence
MIT. See LICENSE.
This server cannot be deployed
Maintenance
ActivityMaintained
ResponsivenessUnresponsive
Related MCP Connectors
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
MCP server for secureFlows: token-free URL builders and integration-linting tools for AI agents.
- ArcjetOAuthcom.arcjet
An MCP server for Arcjet - the runtime security platform that ships with your AI code.
The MCP server that vets MCP servers: identity, risk grade and per-tool risk before you install.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceAn MCP server for verifying AI-generated code quality, security, and performance, addressing trust gaps in AI coding assistants.MIT
- AlicenseNot gradedqualityCmaintenanceMCP server for automated code review using AI agents. It analyzes code diffs or file paths for bugs, security issues, and style violations.MIT
- AlicenseNot gradedqualityCmaintenanceAn MCP server that provides on-demand safety for AI coding workflows, enabling inspection, review, checkpointing, and rollback of risky actions.20 npm1MIT