Name: Codesearch
Author: SK-DEV-AI

Codesearch MCP

Code, package, docs, paper and vulnerability search. 17 tools, keyless lanes.

Grade A Local · stdio No auth needed 17 tools v1.0.1 MIT

No reviews yet by SK-DEV-AIPyPI 906 Runs on your machine, nothing hosted

93/100

trust score

downloads a day

local

runs on your machine

downloads in 30d

What it does

Code, package, docs, paper and vulnerability search. 17 tools, keyless lanes.

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user sk-dev-ai-codesearch-mcp '--' uvx --from skdev-codesearch-mcp codesearch-mcp

# 2 — ask your agent for something these tools do
#   ping, wiki, search_all and 14 more

Codesearch costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publishernot claimed

SK-DEV-AI2 servers

2 categories

All 2 servers

Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.

Installation

Where are you running it?

Every route below installs the same thing and ends at the same approval screen. This one runs on your machine: your client starts Codesearch as a process under your own user, with your files and your network, so the tool surface below is what it can do to your computer rather than to a server somewhere else. Its scan result is on the Security tab — read the surface before you approve it.

Claude Codedeclared by this listing

This is a public server: you run it yourself and this marketplace is not in the path. You need uv (docs.astral.sh/uv): uvx comes with it. Claude Code registers it in one command; --scope user makes it available in every project. The '--' is in quotes so that PowerShell passes it on.

claude mcp add --scope user sk-dev-ai-codesearch-mcp '--' uvx --from skdev-codesearch-mcp codesearch-mcp

Reconnect, or start a new session, and the tools appear in the model’s tool list.

Free on mcprush, and it runs from its publisher’s own package: this marketplace is not in the path, so there is no key of ours to hold and no card to add.

What it asks of you

Nothing is required, but it can take GROQ_API_KEYS (Optional. Groq keys for synthesis and query rewriting.), TAVILY_KEYS (Optional. Tavily search lane.), NV_KEY (Optional. NVIDIA embeddings for ranking.), SE_KEY (Optional. Stack Exchange key (10k/day instead of 300).), S2_KEY (Optional. Semantic Scholar key (1 RPS).) if you want to set them.

What it writes

One config entry your client uses to start the process locally. A local server runs with your file system and your network, which is why it is priced without metering.

What you approve

17 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

Read from its source code. A server that builds its tool list when it starts can list more tools than this.

Lightweight connectivity check — verifies internet and key API endpoints are reachable. Use before expensive calls when connectivity is uncertain. No params needed. e.g. ping()

No parameter schema on file.

Repo architecture and wiki via DeepWiki + CodeWiki. For single-repo queries use owner+repo; for multi-repo questions pass repos (array of owner/repo strings, max 10). e.g. wiki(owner='torvalds', repo='linux', question='How does the scheduler work?')

Parameter	Type	Required	Notes
action	string	yes	—
owner	string	no	—
repo	string	no	—
repos	array	no	Array of owner/repo strings for multi-repo queries (DeepWiki ask supports up to 10)
question	string	no	—
wiki_name	string	no	—
query	string	no	—
limit	integer	no	—
offset	integer	no	—

Unified search across 14+ sources with embedding dedup and reranking. Use for broad multi-source discovery; for surgical single-source work call so_search/hn/papers/code_search directly. e.g. search_all(query='rust async runtime', language='rust')

Parameter	Type	Required	Notes
query	string	yes	—
library	string	no	—
version	string	no	—
owner	string	no	—
repo	string	no	—
language	string	no	—
count	integer	no	Results per source (max 50)
fields_of_study	string	no	S2 papers domain filter (default: all fields)
so_sort	string	no	Stack Exchange sort: votes/activity/creation/relevance
fromdate	string	no	Stack Exchange results older than ISO date
todate	string	no	Stack Exchange results newer than ISO date
synthesize	boolean	no	Groq-synthesize top results into a concise answer with citations (no-op without GROQ_API_KEYS; server defaults to false when no keys are configured)

Raw package registry queries (npm/PyPI/crates + deps.dev). Use for fast single-source lookups. For composite intelligence (Libraries.io + Sonatype vulns), use pkg instead. e.g. search_package(name='express', registry='npm')

Parameter	Type	Required	Notes
name	string	yes	—
registry	string	no	—
action	string	no	list versions: npm_versions\|pypi_versions\|crates_versions; one version: npm_get_version\|pypi_get_version\|crates_get_version (version='latest' OK); npm_dist_tags; crates_get_readme\|crates_summary; deps
version	string	no	Package version (required for version-specific queries; 'latest' resolves to newest)
advisory_id	string	no	OSV advisory ID for depsdev_advisory
hash_type	string	no	Hash type for depsdev_query: SHA1, SHA256, etc
hash_value	string	no	Base64-encoded hash value for depsdev_query

Stack Overflow: Stack Exchange API (free, 300 req/day, resolved/accepted answers with score/tags) or SOFA (Stack Overflow for Agents, beta, agent-contributed content with trust scores, requires SOFA_KEY env). Use stackexchange for authoritative resolved answers, sofa for fresher agent-contributed…

Parameter	Type	Required	Notes
action	string	no	stackexchange=official API (free, 300 req/day, resolved answers, score/tags/views/activity). sofa=Stack Overflow for Agents (beta, agent-contributed, trust scores, needs SOFA_KEY). questions_by_ids/se
query	string	no	—
count	integer	no	—
tags	string	no	—
accepted	boolean	no	—
closed	boolean	no	—
sort	string	no	—
type	string	no	—
site	string	no	—
question_id	integer	no	—
ids	string	no	Comma-separated IDs for questions_by_ids / answers_by_ids / users_by_ids
page	integer	no	Page number for pagination
fromdate	string	no	Unix timestamp or date string for earliest creation date
todate	string	no	Unix timestamp or date string for latest creation date
views	integer	no	Minimum view count
answers	integer	no	Minimum answer count
content_type	string	no	SOFA only: question\|til\|blueprint\|playbook
post_id	string	no	SOFA only: get post by ID instead of searching
steering	string	no	SOFA only: curation steering parameter

Hacker News: search, item detail, user profile, or story lists (top/new/best/ask/show). Use for tech-community discussion and sentiment; for resolved Q&A use so_search. e.g. hn(query='rust', tags='story', min_points=50)

Parameter	Type	Required	Notes
action	string	yes	—
query	string	no	—
count	integer	no	—
sort_by_date	boolean	no	—
tags	string	no	story\|comment\|poll\|front_page\|ask_hn\|show_hn
min_points	integer	no	—
min_comments	integer	no	—
item_id	integer	no	—
firebase_type	string	no	—
username	string	no	—

Libraries.io dependency metadata and source rank. Use to compare dependency candidates or find the repo behind a package; for registry versions/vulns use search_package/pkg/vulns. e.g. search_libraries(name='lodash', platform='npm')

Parameter	Type	Required	Notes
name	string	no	—
platform	string	no	—
query	string	no	—
sort	string	no	—
languages	string	no	—
licenses	string	no	—
keywords	string	no	—
action	string	no	versions\|dependencies\|dependents\|github_repo\|github_dependencies\|platforms\|licenses\|keywords (omit for project search)
version	string	no	—
owner	string	no	—
repo	string	no	—
keyword	string	no	Keyword for keywords action
count	integer	no	—

Sonatype Guide + OSV.dev fallback: scan packages, vulnerability details, latest version, or license analysis by PURL. scan needs platform+name+version (or coordinates) — on Sonatype 401/429/quota errors it falls back to keyless OSV.dev automatically. detail accepts Sonatype ids, GHSA-* (GitHub…

Parameter	Type	Required	Notes
action	string	no	—
platform	string	no	—
name	string	no	—
version	string	no	—
coordinates	string	no	—
vuln_id	string	no	—
purl	string	no	—

Documentation operations. Default action runs smart fallback (ReadTheDocs→DevDocs→llms.txt→Context7, quota-free sources first). After finding docs, use fetch(url) to read full pages or devdocs_fetch_content for structured content. e.g. docs(query='authentication', library='express')

Parameter	Type	Required	Notes
action	string	no	—
query	string	no	—
library	string	no	—
library_id	string	no	Context7 library ID (skip search)
version	string	no	—
fast	boolean	no	—
slug	string	no	—
path	string	no	—
project	string	no	—
provider	string	no	Git provider for context7_add_repo (github, gitlab)
repo_url	string	no	Repository URL for context7_add_repo

Academic papers from Semantic Scholar, CORE API, and arXiv. Prefer action=search for topic queries (multi-source S2→arXiv→OpenAlex→CORE fallback); arxiv_search is single-source and rate-limited. e.g. papers(query='transformer attention', fields_of_study='Computer Science')

Parameter	Type	Required	Notes
action	string	yes	—
query	string	no	—
paper_id	string	no	—
paper_ids	string	no	Comma-separated paper IDs for batch action
author_id	string	no	—
count	integer	no	—
offset	integer	no	Result offset for pagination (search and core_search actions)
year	string	no	—
fields_of_study	string	no	—
open_access	boolean	no	—
positive_ids	string	no	Comma-separated positive paper IDs for recommendations_negatives
negative_ids	string	no	Comma-separated negative paper IDs for recommendations_negatives

Per-repo code intelligence via SearchCode (free, no auth). Use analyze for instant repo overview (languages, complexity, tech stack, credentials), search for searching code within a repo, findings for code quality issues, file_tree to list files, or get_file to read a file. No rate limits. e.g.…

Parameter	Type	Required	Notes
action	string	yes	analyze=repo overview, search=search code, findings=quality issues, file_tree=list files, get_file=read file
repository	string	no	Git URL or owner/repo — REQUIRED for every searchcode action (e.g. https://github.com/expressjs/express)
query	string	no	Search query (for search action)
path	string	no	Subdirectory path filter (for analyze/findings/file_tree)
language	string	no	Language filter (for analyze action)
detail_level	string	no	Response verbosity (for analyze action)
symbol_name	string	no	Function/class name to extract (for get_file action)
case_sensitive	boolean	no	Case-sensitive search (for search action)
context_lines	integer	no	Context lines around matches (for search action)
max_results	integer	no	Max results (for search/findings)
severity	string	no	Filter by severity (for findings action)
category	string	no	Filter findings by category (for findings action)
start_line	integer	no	Start line (for get_file without symbol_name)
end_line	integer	no	End line (for get_file without symbol_name)

Search code, docs, and symbols across indexed dependencies and public repositories. Package scope (npm:express, pypi:requests) via PkgSeer; global public-code search via Sourcegraph (keyless). Supports qualifiers like kind:, category:, lang:. e.g. code_search(query='handleAuth',…

Parameter	Type	Required	Notes
query	string	yes	Search query supporting implicit AND, OR, parens, -exclude, and qualifiers (kind:, lang:, path:)
target	string	no	Package scope: registry:name[@version] (npm:express, pypi:requests, crates:serde). PkgSeer indexes npm/pypi/crates only. Omit target for global public-repo search via Sourcegraph (keyless). For single
source	string	no	Restrict results to a specific source type
lang	string	no	Programming language filter
limit	integer	no	Max results (1-100)

List files in an indexed dependency by package-scoped path (e.g. npm:express/src/). PkgSeer + jsDelivr; indexes npm/pypi/crates ONLY (github: specs rejected). e.g. code_files(spec='npm:express')

Parameter	Type	Required	Notes
spec	string	yes	Package spec: registry:name[@version] (e.g. npm:express, pypi:requests)
path_prefix	string	no	Optional path prefix filter (e.g. src/)

Read a file from an indexed dependency by package-scoped path. PkgSeer + jsDelivr; indexes npm/pypi/crates ONLY (github: specs rejected). e.g. code_read(spec='npm:express', path='src/index.js')

Parameter	Type	Required	Notes
spec	string	yes	Package spec: registry:name[@version] (e.g. npm:express)
path	string	yes	File path within the package (e.g. src/index.js)

Package intelligence: info (composite metadata — Libraries.io + Sonatype + PkgSeer), changelog (release notes), upgrade_review (vulns+changelog+deps diff between versions), files (list source files), read (read a source file). For raw single-source registry queries (npm versions, crates…

Parameter	Type	Required	Notes
action	string	no	—
name	string	yes	—
registry	string	no	—
version	string	no	Package version (default: latest)
current_version	string	no	Current version for upgrade_review
target_version	string	no	Target version for upgrade_review
from_version	string	no	Start of version range for changelog (optional)
to_version	string	no	End of version range for changelog (optional)
path	string	no	File path filter (files) or exact path (read)
count	integer	no	Max changelog entries

Fetch full content for a list of search results, deduplicate, and rerank by relevance. Give it results from any search tool plus the original query. e.g. enrich(query='rust async', results=[{'url':'...','title':'...'}])

Parameter	Type	Required	Notes
query	string	yes	—
results	array	yes	List of result objects to enrich (url, title, text/snippet, source)
top_k	integer	no	Max enriched results to return
max_fetch_size	integer	no	Max results to fetch content for
include_html	boolean	no	Include raw HTML in content (default strips to text)

Deep repo analysis: parallel-fetch GitHub metadata + SearchCode code quality + DeepWiki architecture + CodeWiki sections in one call. Start here for unfamiliar repos before surgical wiki/searchcode calls. Accepts GitHub URLs or owner/repo strings. May take 10-15s (parallel API calls). e.g.…

Parameter	Type	Required	Notes
repository	string	yes	GitHub repo: URL (https://github.com/owner/repo) or owner/repo string

Free

$0 forever

Every tool, no call limit
No card, and mcprush charges nothing for it
Source published under MIT
Runs on your machine — nothing of it reaches our gateway
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install Codesearch or to call it, at any volume.

ATrust score 93 / 100

Release 1.0.1 · scanned 28 Oct 2026

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score100

Client score93

Findings1 threat · 0 capability

Capabilityhigh

Coveragesource

Verificationrepo

Surface digest0c5f61a3a717386dbb55203c538bdcf8fc4ad1741f7ecb39702853ebf18887e7

Score vectorthreat 100 → client 93

Term	Level	What it prices	Points
capability-exposure	high	capability blast radius (high) — client exposure if the model is manipulated	−6
verification-discount	repo	publisher verification (public source) — no provenance, but the source is public and inspectable	−1
coverage-honesty	source	inspection depth (source) — how much of the target the scan could see	−0

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

Tool surfaceread

Implementation sourceread

Package metadataread

Live transportnot available

Tools were statically extracted from the published source (17 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. high is the level these add up to.

Tool	Capability tags	Why the tag was assigned
ping	no tags
wiki	no tags
search_all	no tags
search_package	no tags
so_search	no tags
hn	no tags
search_libraries	no tags
vulns	no tags
docs	untrusted-input	untrusted-input: keyword "fetch"
papers	no tags
searchcode	sensitive-source	sensitive-source: keyword "list_files"
code_search	no tags
code_files	sensitive-source	sensitive-source: keyword "list_files"
code_read	no tags
pkg	no tags
enrich	untrusted-input	untrusted-input: keyword "fetch"
analyze	untrusted-input	untrusted-input: keyword "fetch"

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

The public result for this release does not print the flow graph, so there is nothing to show here. That is not the same as "no paths were found": what the scan did read is above, under coverage.

Supply chain and provenance

Integrityfirst-seen

Surface digest0c5f61a3a717386d

Scanned2026-10-28

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.