Back to Browse

Code Factory MCP Server

by Zrk222
Developer ToolsUse Caution4.2MCP RegistryLocal
Free

Server data from the Official MCP Registry

Local proof facts for AI coding clients: intent, tests, Graph Ops, and review evidence.

About

Local proof facts for AI coding clients: intent, tests, Graph Ops, and review evidence.

Security Report

4.2
Use Caution4.2High Risk

Code Factory is a legitimate developer tool MCP server with reasonable security posture. The codebase is well-structured with appropriate permission scopes for its purpose (local proof generation, testing, and CI/CD integration). Permissions align with category baselines for developer tools. Minor code quality observations exist around broad exception handling and subprocess invocation patterns, but no critical security vulnerabilities, credential leakage, or malicious patterns were detected. Supply chain analysis found 5 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

4 files analyzed · 10 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

File System Write

Writes or modifies files on your machine. Check that this is expected for the tool.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

process_spawn

Check that this permission is expected for this type of plugin.

Shell Command Execution

Runs commands on your machine. Be cautious — only use if you trust this plugin.

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-zrk222-code-factory": {
      "args": [
        "factoryline-code-factory"
      ],
      "command": "uvx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

Code Factory

CI PyPI Python Hugging Face Space GitHub stars Latest release

Catch AI-generated tests that could never fail — before review.

Free, local proof for code built with AI. Start from a plain-language outcome, a fuzzy PRD, or a risky diff. Code Factory binds the declared intent, challenges whether a test can actually reject the failure it claims to cover, and shows the current proof gap plus the next human decision. Tests that only look green are not proof: a starter is never called production-ready before the relevant proof exists.

factory mvp "Build an approval tracker" --root .

See actual Factory Studio or open the live Hugging Face Space.

Actual Factory Studio: the outcome-first local MVP path

What it does

  • Start a real project. Turn one outcome into a contained web, mobile, API, CLI, worker, MCP, or agent-UI starting state.
  • Review what AI produced. Turn requirements, diffs, proofs, and blockers into receipts, Graph Ops, and one fact-derived next action.
  • Refresh the evidence that matters. Watch a local Assembly while it runs, refresh the next-proof brief, and see privacy-bounded observed Git contribution context without pretending it is a verified directory or billing roster.
  • Keep "done" honest. Challenge declared validators for hollow tests; a green-looking scaffold is never called production-ready by default.
  • Stop vague work before it starts. Use Intake Grill to record framework, exact intent, observable acceptance evidence, and the external-effects boundary before a Product Mission begins.
  • Make a behavior survive its declared failure cases. Use the supervised Gauntlet to turn human-written E2E sabotage cases into an offline-verifiable Survival Card. A hollow negative check stays visible; a card is never a production-readiness certificate.
  • Let autonomy be earned, not assumed. Use factory license to derive an expiry-bound local tier from independently verified governed runs. A severe hollow-test, hollow-validator, or scope-escape result demotes the declared agent automatically; it never authenticates identity or grants execution.
  • Compare agents with receipts, not vibes. Use factory combine to rank completed, sealed, independently verified runs on the same task. It never starts an agent or turns a local scoreboard into a vendor-quality claim.

What the latest upgrade resolves

Common AI-assisted delivery painFactoryLine responseWhat stays under human control
A test is green but could never catch the behavior it claims to coverReality Check and Gauntlet bind declared positive and negative cases, then keep hollow or blocked checks visible in a Survival CardWhich behaviors and commands to admit; whether evidence is sufficient
A vague PRD becomes the wrong scaffold or frameworkIntake Grill records a named, byte-bound intent, framework decision, observable acceptance evidence, and external-effects posture before a mission beginsThe answers, architecture choice, and decision to start work
An agent retries the same failed approach and burns review timeProof-Delta requires a changed candidate plus fresh, hash-bound evidence for a retry; no-gain attempts haltAny repair, retry admission, and final apply
Teams gradually trust an agent because it has been successful recentlyEarned Autonomy derives an expiring local tier from governed evidence and demotes severe hollow-test or scope-escape resultsIdentity, permissions, execution, approval, and release authority
A reviewer has suggestions but no shared evidence pictureGraph Ops, local receipts, and read-only MCP facts show current scope, proof debt, and the next fact-derived actionMerge, release, deployment, and provider access
A large/remote workspace feels opaque or sluggishWorkspace Advisor measures bounded local project shape and path-only WSL/remote signals without changing indexes, heap, caches, inspections, or remote settingsEvery IDE performance change and environment setting

These are local evidence and supervision tools, not guarantees of performance, security, productivity, production readiness, or an automatic repair service.

For teams: use the Teams and Enterprise Operations Manual to run the same proof-first loop with named reviewers, approved AI-change scope, and explicit Proof Debt—without giving Code Factory merge, release, or provider authority. The commercial packaging guide keeps the free core separate from proposed Team and Enterprise services that are not purchasable yet. For a human-selected, customer-managed reference pilot, the local Team Pilot readiness gate hash-binds the operating evidence for owner review; it does not accept a customer or activate a paid service.

Design is part of the review. For UI-scoped work, add the optional Prestige Design Review: a purpose-led design brief plus review artifacts for hierarchy, responsive behavior, affordances, consistency, and declared design tokens. It makes design quality visible; it does not claim a conversion result, WCAG certification, or production readiness.

Reuse a proven decision without reusing stale context. Factory Continuity keeps a local, purpose-bound record of the evidence behind prior work. Graph Ops can replay only redacted, current, independently promoted metadata; it does not store private source, prompts, embeddings, or transcripts, and it cannot execute a repair.

Install

# No account, model key, or cloud connection is required for this local run.
pip install factoryline-code-factory
factory mvp "Build an approval tracker" --root .
factory studio --root .\my-mvp

If Code Factory helps you find a proof gap or makes an AI-assisted change easier to review, star Code Factory so other developers can find it. This optional link only opens the repository.

Choose the job in front of you

If you need to…UseYou get
Build a first slicefactory mvpA contained, app-shaped local starting state
Pin down intent before work beginsfactory intake grillA source-bound framework, intent, acceptance-evidence, and safety decision worksheet
Clarify a fuzzy PRDfactory prd grillSource-bound questions instead of invented requirements
Review an AI-assisted difffactory change reviewA local risk, proof-gap, and next-action packet
Turn a diff into the next safe prooffactory memory briefRefreshable actions, redacted continuity facts, and observed local Git contribution context
Keep an agent diff inside approved scopefactory plan verifyExact plan alignment and explicit Proof Debt—not another AI opinion
Prove an E2E check can say nofactory e2e verifyA native positive/negative command-pair receipt that catches hollow E2E checks
Ask whether a behavior survives declared sabotagesfactory gauntletA named, one-run admission, optional redacted verified-context binding, and offline-verifiable Survival Card—never generated commands or automatic repair
Keep agent autonomy evidence-boundfactory licenseA local, expiring tier derived from governed evidence, automatic severe-failure demotion, and no silent authority grant
Compare completed agent evidence fairlyfactory combineA sealed-task, offline-verifiable scoreboard—never an agent launcher or vendor leaderboard
Prepare a bounded Team pilotfactory team-pilot readinessHash-bound, customer-managed readiness evidence for owner review—not a checkout or service activation
Add evidence to a GitHub PRfactory github proof-reviewOne neutral Check and stable proof walkthrough, tied to the head commit
Prove a LangGraph resume pathfactory langgraph replay-verifyHash-only parity, duplicate-effect and parallel-write safeguards, plus a shareable incident capsule
Detect policy drift before a human mergefactory github assurance-dossierDeterministic supplied-policy comparison, named expiring exceptions, and a merge-evidence packet
Inspect delivery statefactory studioGraph Ops, receipts, and the next supported action
Debug why two graph runs divergedfactory graph forensicsHash-sealed state lineage, concurrency findings, and a read-only recovery preview
Choose among competing repairsfactory proofsearchHash-bound candidate rejection, mutation-tested evidence, a deterministic winner, and locked apply authority
Decide what evidence to collect nextEvidence FrontierA deterministic next-test hypothesis that separates repair candidates, with execution locked
Admit a repair retry only with new evidenceProof-Delta LoopA changed candidate and fresh hash-bound evidence, or a deliberate no-gain halt
Reconsider verified prior work safelyFactory ContinuityPurpose-bound, expiring Decision Replay metadata with independent promotion and no private content
Prove one user-visible behaviorFactory Reality CheckDeep intent assertions, a deliberate failure case, and an optional named one-time re-run authorization
Verify supplied workVerifier PlaneIndependent, hash-bound evidence checks

For the short product map, read the overview. For a two-minute first run, follow Start Here. For full command and contract reference, browse the documentation directory.

Use Code Factory with CodeRabbit or another AI reviewer

They solve different parts of the review problem. CodeRabbit can supply AI findings and suggestions; Code Factory makes declared local proof gaps, coverage, and the next review action explicit. Enable the opt-in GitHub Proof Review workflow to put one neutral, commit-bound FactoryLine Check and walkthrough beside existing CodeRabbit comments. It uses no CodeRabbit account, API, credential, or output as proof.

For agent-created pull requests, add a small human-approved factory.agent_plan.v1 envelope. Plan-to-Proof compares that plan with the exact diff and exposes Proof Debt: unresolved scope, declared-test, human-routing, and existing proof obligations that must be settled before a team makes its own merge decision.

That makes Code Factory a standalone proof layer for teams that do not use an AI reviewer, and a complementary evidence layer for teams that do. For agent-created pull requests, Code Factory does not replace human review, auto-approve a pull request, or merge code.

Use Code Factory with LangGraph

LangGraph teams can keep their own graph and checkpoint runtime, then use the LangGraph Assurance Bridge to compare recorded reference and resumed transitions. The free local adapter produces hash-only parity evidence and a reviewable incident capsule when a run diverges; it does not import LangGraph, invoke a graph, or claim production resilience. The optional GitHub Action puts the same Proof Card in a pull-request job summary.

For Codex, Claude Code, and Deep Agents, install the Code Factory LangGraph plugin to add the proof workflow and read-only local MCP facts to the coding-agent surface.

Use Code Factory with DeepSeek Harness

The optional DeepSeek Harness adapter starts the same local read-only MCP proof surface through Harness's official generic MCP client. It lets a Harness agent inspect Graph Ops, current proof gaps, and Earned Autonomy / Combine facts without sending source to a hosted endpoint or gaining permission to execute, repair, approve, release, deploy, sign, or use credentials.

Use it where you work

Code Factory keeps the same local, receipt-bound workflow across the command line, VS Code, and the JetBrains plugin. It also provides local stdio Cursor or OpenCode MCP without handing an AI client permission to publish, deploy, approve, sign, or access credentials.

The same local proof surface is discoverable in the Official MCP Registry as io.github.zrk222/code-factory; registry setup starts the public PyPI package over local stdio and never creates a hosted service or write authority.

FactoryLine's core local proof workflow remains free. The owner-approved future JetBrains Freemium plan starts January 1, 2027, subject to Marketplace and activation gates: $5.95 USD per named seat/month or $60 USD per named seat/year for optional Memory and Enterprise Assurance entitlements. It is not active today; no checkout, entitlement, or license enforcement exists. See the Marketplace control-room guide for the exact feature boundary and approval gates.

The matching GitHub Assurance Seat is also planned for January 1, 2027 at the same future price. It is for maintained, customer-managed proof operations (commit-bound review, Proof Debt, policy drift, governed exceptions, and evidence packets)—not source access or opaque AI-token resale. The source license and free core are unchanged. See the GitHub per-seat plan.

The proof boundary

Code Factory creates and inspects local artifacts. It does not silently call a model, discover credentials, publish, deploy, sign, approve, message, or grant a connector. The Gauntlet executes only caller-declared E2E pairs after a named, expiry-bound, one-run admission; all other Gauntlet paths are read-only. Its deterministic proof receipts bind supplied byte bindings, declared identities, and evidence; an external runner must separately prove runtime isolation and network policy. Token, cost, and productivity claims remain unknown until a bound measurement exists.

flowchart LR
  intent["Plain-language outcome"] --> mvp["Local MVP"]
  mvp --> evidence["Receipts and declared checks"]
  evidence --> review["Graph Ops / review packet"]
  review --> decision["One evidence-backed next action"]

Use Intake Grill to pin down intent before a mission, PRD Grill before code exists, the deterministic contradiction gate when requirements collide, Proof Review when a diff arrives, and the Verifier Plane when a worker claims it is finished. Use the supervised Gauntlet when a specific behavior needs to survive explicitly reviewed failure cases. The local MCP contract and generated Mermaid output map make the same proof context reusable by a client you choose.

Go deeper when you need it

License

MIT OR Apache-2.0.

Reviews

No reviews yet

Be the first to review this server!