com.moltlinestudio/codereview

Est-ce que com.moltlinestudio/codereview est sûr ?

Au dernier audit MCP Hub, le serveur MCP « com.moltlinestudio/codereview » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 7 outils

• ai_code_smell_scan≈ 354 tokens

  Flag the tells of unreviewed AI-generated code in a source file. FREE. Detects comments that restate the next line, leaked assistant preambles, placeholder TODOs, shipped 'Example usage' blocks, over-broad try/except that swallows errors, and auto-named identifiers. Typical input {"code": "<file contents>"} returns {"reviewed_confidence": 0-100, "hits": [{"smell": "...", "evidence": "<quoted snippet>"}], "reading": "...", "note": "..."}. Use on a full source file suspected of unreviewed machine authorship. Not on a diff (review_diff), and the result is a signal to check, not proof of authorship. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Paramètres, retour & exemple (1)

  Paramètres

  • code · string · requis
    Full source text to scan, any language; paste the file contents as a single string.

  Exemple d'appel

  {"name": "ai_code_smell_scan", "arguments": {"code": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• complexity_report≈ 376 tokens

  Report structural complexity of a source file, function by function. FREE. Measures per-function length, max nesting depth, and a cyclomatic-style branch count (if/for/while/case/&&/||/except), flagging functions too long or too deeply nested to review confidently. Typical input {"code": "<file contents>"} returns {"functions": N, "detail": [{"name": ..., "start": N, "lines": N, "branches": N, "max_depth": N}], "flags": ["..."], "note": "..."}. Use when structure rather than correctness is the question. Not for vulnerabilities (security_deep_dive). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Paramètres, retour & exemple (2)

  Paramètres

  • code · string · requis
    Full source text to analyze, pasted as a single string.
  • language · string · optionnel
    Optional language hint, e.g. "python" or "javascript"; "auto" (default) detects from syntax.

  Exemple d'appel

  {"name": "complexity_report", "arguments": {"code": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_reviewer_persona≈ 282 tokens

  Load the Senior Reviewer persona for consistent, high-signal reviews. PREMIUM (license). The persona is a reviewing voice that is skeptical, specific, and kind — demands evidence over vibes and blocks only on real risk. Takes no arguments. Returns {"persona": ..., "identity": ..., "rules": ["...", ...], "opening_move": "..."} ready to adopt as a system prompt. Use to keep repeated reviews consistent in voice and rigor. Not for running a review - the scan tools do that. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "get_reviewer_persona", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• review_checklist≈ 322 tokens

  Produce a focused pull-request review checklist for a language or stack. FREE. Covers the things that actually break in production, with extra items per language. Typical input {"language": "python"} returns {"language": "python", "checklist": ["...", ...], "note": "..."}. Use before a review, to decide what to look for. Not for reviewing actual code - pass code to review_diff or security_deep_dive. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Paramètres, retour & exemple (1)

  Paramètres

  • language · string · optionnel
    Language or stack to tailor for: "python", "javascript", "typescript", "go", "sql", or "general" (default). Unknown values fall back to the general checklist.

  Exemple d'appel

  {"name": "review_checklist", "arguments": {"language": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• review_diff≈ 367 tokens

  Risk-scan a unified diff the way a senior reviewer triages a PR. FREE. Flags added lines matching known risk patterns — injection sinks, disabled TLS, bare excepts, debug prints, TODOs, N+1 hints, leaked secrets — with the new-file line number and a severity (1 low - 4 high). Typical input {"diff": "<git diff output>"} returns {"added_lines": N, "risk_score": 0-100, "verdict": "...", "secrets": [...], "findings": [{"line": N, "severity": 1-4, "issue": "...", "code": "..."}], "note": "..."}. Use on a unified diff, when only the change matters. Not for whole-file analysis (complexity_report, ai_code_smell_scan). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Paramètres, retour & exemple (1)

  Paramètres

  • diff · string · requis
    A unified diff exactly as produced by `git diff` — text with @@ hunk headers and +/- line prefixes. Only added (+) lines are scanned.

  Exemple d'appel

  {"name": "review_diff", "arguments": {"diff": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• secret_scan≈ 346 tokens

  Scan text for accidentally-committed machine credentials and private-key material. FREE. Reports each match's location and category so it can be rotated before it leaks. Detection is pattern-based over the common leaked-credential formats; it never echoes the matched value back. Typical input {"text": "<file, diff, or config contents>"} returns {"leaked": bool, "count": N, "findings": [{"line": N, "type": "<category>"}], "note": "..."}. Pattern matching only - a clean result is not proof, and every hit needs human confirmation before anyone acts on it. Not a general security review (security_deep_dive). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Paramètres, retour & exemple (1)

  Paramètres

  • text · string · requis
    The file, diff, or config contents to scan, pasted as a single string.

  Exemple d'appel

  {"name": "secret_scan", "arguments": {"text": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• security_deep_dive≈ 356 tokens

  Run an OWASP-oriented security pass over a source file. PREMIUM (license). Checks injection sinks, auth/session handling, crypto misuse, SSRF/deserialization, and unsafe file/path handling — each finding cites the line, the OWASP risk class, and a concrete fix direction. Typical input {"code": "<file contents>"} returns {"issues": N, "findings": [{"line": N, "class": "A03 Injection", "fix": "...", "code": "..."}], "owasp_note": "..."}. Use on one source file when vulnerabilities are the question. Not for style or structure (complexity_report), and never a substitute for a security professional on high-risk code. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Paramètres, retour & exemple (1)

  Paramètres

  • code · string · requis
    Full source text to audit, pasted as a single string; any common language.

  Exemple d'appel

  {"name": "security_deep_dive", "arguments": {"code": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://mcp.moltlinestudio.com/codereview