源代码安全分析工具

npm install -g codeslick

{
  "mcpServers": {
    "codeslick": {
      "command": "npx",
      "args": ["-y", "codeslick-mcp-server@latest"],
      "env": {}
    }
  }
}

{
  "mcpServers": {
    "codeslick": {
      "command": "npx",
      "args": ["-y", "codeslick-mcp-server@latest"]
    }
  }
}

claude mcp add codeslick -- npx -y codeslick-mcp-server@latest

{
  "mcpServers": {
    "codeslick": {
      "command": "npx",
      "args": ["-y", "codeslick-mcp-server@latest"]
    }
  }
}

Analyze this JavaScript code for security issues:

function login(username, password) {
  const query = "SELECT * FROM users WHERE username='" + username + "'";
  // ... SQL injection vulnerability
}

Scan this package.json for vulnerable dependencies:

{
  "dependencies": {
    "express": "4.16.0",
    "lodash": "4.17.0"
  }
}

Generate SBOM for this package.json in SPDX format:

{
  "name": "my-app",
  "version": "1.0.0",
  "dependencies": {
    "react": "^18.0.0"
  }
}

Check this code for hardcoded secrets:

const config = {
  awsAccessKey: "AKIAIOSFODNN7EXAMPLE",
  dbPassword: "super_secret_password_123"
};

What AI providers does this code use?

import OpenAI from 'openai';
import { ChatOpenAI } from '@langchain/openai';

const client = new OpenAI({ apiKey: process.env.OPENAI_API_KEY });
const response = await client.chat.completions.create({
  model: 'gpt-4o',
  messages: [{ role: 'user', content: 'Hello' }],
});

Generate an AI BOM for these files:
- app/api/chat/route.ts: [content]
- lib/agents/researcher.ts: [content]
- .env.example: [content]

User: Analyze this Python code for security issues:

import pickle
import os

def load_data(filename):
    with open(filename, 'rb') as f:
        data = pickle.load(f)  # Unsafe deserialization
    return data

def execute_command(user_input):
    os.system("ls " + user_input)  # Command injection

# CodeSlick Security Analysis Report

**Language:** python
**Security Score:** 42/100
**Total Vulnerabilities:** 2

## Vulnerability Summary

[CRITICAL]: 2

---

## Top Vulnerabilities

### 1. Unsafe Pickle Deserialization

**Severity:** CRITICAL
**CVSS Score:** 9.8/10
**OWASP:** A08:2021
**CWE:** CWE-502

**Recommendation:** Use safe alternatives like JSON or XML. Never unpickle data from untrusted sources.

**Fix:**
```python
// Before:
data = pickle.load(f)

// After:
import json
data = json.load(f)

// Before:
os.system("ls " + user_input)

// After:
subprocess.run(["ls", user_input], shell=False, check=True)

### Example 2: Scan Dependencies

**Claude Code Response:**

## Performance

- **Analysis Speed**: <3s for typical files (WebTool requirement)
- **Memory Usage**: Low (optimized AST traversal)
- **False Positive Rate**: <10% (context-aware filtering)

## Privacy Policy

CodeSlick MCP Server prioritizes your privacy and security:

### Data Processing
- **Local Processing Only**: All code analysis is performed locally on your machine
- **No Data Collection**: We do not collect, store, or transmit your source code
- **No Telemetry**: No usage statistics, analytics, or tracking of any kind
- **No Account Required**: The MCP server works completely offline without authentication

### Network Activity
- **Fully Offline**: Security analysis runs without internet connectivity
- **Optional External Calls**: Only for dependency scanning (OSV.dev vulnerability database) if enabled
- **No Third-Party Services**: No data sent to CodeSlick servers or any third parties

### API Key Usage
- **Your Keys, Your Control**: If using advanced AI features, your OpenRouter API key is used directly
- **No Key Storage**: API keys are not stored or logged by the MCP server
- **No Access**: CodeSlick does not see or have access to your API keys

### Open Source & Auditable
- **MIT License**: Fully open source and auditable
- **Transparent Code**: All source code available for security review
- **No Hidden Functionality**: What you see is what you get

### CodeSlick Web Service (Separate)
This MCP server is separate from the CodeSlick web service. For the web service privacy policy, see: https://codeslick.dev/privacy

### Contact
For privacy-related questions: privacy@codeslick.dev

## Support

- **Documentation**: https://codeslick.dev/docs
- **Issues**: https://github.com/VitorLourenco/codeslick2/issues
- **Email**: support@codeslick.dev

## License

MIT License - Copyright (c) 2026 CodeSlick

## Contributing

Contributions welcome! See [CONTRIBUTING.md](../../CONTRIBUTING.md) for guidelines.

## Roadmap

- [ ] C/C++ language support
- [ ] Rust language support
- [ ] CloudFormation support
- [ ] Custom rule configuration
- [ ] CI/CD integration templates
- [ ] VS Code extension

## Credits

Built with:
- [@modelcontextprotocol/sdk](https://github.com/anthropics/mcp) - MCP SDK by Anthropic
- [TypeScript](https://www.typescriptlang.org/) - Type-safe JavaScript
- [CodeSlick](https://codeslick.dev) - Security analysis engine

---

**Made by the CodeSlick team**