Code Context Engine MCP Server

Code Context Engine is a well-intentioned developer tool with generally solid security practices, but contains several areas requiring attention. The server properly handles file path validation, avoids hardcoded credentials, and implements secret detection. However, there are code quality gaps in error handling, overly broad exception catching, some unvalidated subprocess operations, and potential information disclosure through verbose error messages. Permissions align with its indexing purpose, but the subprocess and network access should be more tightly scoped. Supply chain analysis found 8 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

3 files analyzed · 17 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.