Code Index MCP by johnhuang316

Findings (22)

• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  github.com/golang-jwt/jwt/v5@5.0.0: 1 known vulnerability

  GO-2025-3553

  test/sample-projects/go/user-management/go.mod
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  golang.org/x/net@0.10.0: 24 known vulnerabilities

  GO-2023-1988, GO-2023-2102, GO-2024-2687, GO-2024-3333, GO-2025-3503 +19 more

  test/sample-projects/go/user-management/go.mod
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  ch.qos.logback:logback-classic@1.4.7: 1 known vulnerability

  GHSA-vmq6-5m68-f53m

  test/sample-projects/java/user-management/pom.xml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  com.fasterxml.jackson.core:jackson-databind@2.15.2: 12 known vulnerabilities

  GHSA-3pjw-73gf-8qr5, GHSA-5gvw-p9qm-jgwh, GHSA-5jmj-h7xm-6q6v, GHSA-cxp5-3px4-pw24, GHSA-gx83-3vf8-gh7j +7 more

  test/sample-projects/java/user-management/pom.xml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  ch.qos.logback:logback-core@1.4.7: 7 known vulnerabilities

  GHSA-25qh-j22f-pwp8, GHSA-6v67-2wr5-gvf4, GHSA-jhq6-gfmj-v8fx, GHSA-p47f-322f-whfh, GHSA-pr98-23f8-jwxv +2 more

  test/sample-projects/java/user-management/pom.xml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  com.fasterxml.jackson.core:jackson-core@2.15.2: 3 known vulnerabilities

  GHSA-72hv-8253-57qq, GHSA-7hhh-6rmp-j9qf, GHSA-r7wm-3cxj-wff9

  test/sample-projects/java/user-management/pom.xml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  mcp@1.21.0: 7 known vulnerabilities

  PYSEC-2026-1617, PYSEC-2026-3482, PYSEC-2026-3483, GHSA-5h93-6whr-6q8j, GHSA-84m7-p3x7-pcfv +2 more

  uv.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  msgpack@1.1.1: 2 known vulnerabilities

  PYSEC-2026-3625, GHSA-j586-36cw-2gc2

  uv.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  python-multipart@0.0.20: 7 known vulnerabilities

  PYSEC-2026-1852, PYSEC-2026-3036, PYSEC-2026-3037, PYSEC-2026-3038, PYSEC-2026-3039 +2 more

  uv.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  starlette@0.46.1: 7 known vulnerabilities

  PYSEC-2026-161, PYSEC-2026-1941, PYSEC-2026-1942, PYSEC-2026-2280, PYSEC-2026-2281 +2 more

  uv.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  golang.org/x/sys@0.10.0: 1 known vulnerability

  GO-2026-5024

  test/sample-projects/go/user-management/go.mod
• lowLow. Minor, or common in normal tools. Shown for information.
  golang.org/x/text@0.11.0: 2 known vulnerabilities

  GO-2026-5970, GO-2026-6629

  test/sample-projects/go/user-management/go.mod
• lowLow. Minor, or common in normal tools. Shown for information.
  org.apache.commons:commons-lang3@3.12.0: 1 known vulnerability

  GHSA-j288-q9x7-2f5v

  test/sample-projects/java/user-management/pom.xml
• lowLow. Minor, or common in normal tools. Shown for information.
  idna@3.10: 1 known vulnerability

  PYSEC-2026-215

  uv.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  python-dotenv@1.0.1: 1 known vulnerability

  PYSEC-2026-2270

  uv.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  No manifest declaring network access and environment variables (agent.json)

Network activity

Tools exposed (14)

• set_project_path

  Set the base project path for indexing.

• search_code_advanced

  Search for code pattern with pagination. Auto-selects best search tool (ugrep/ripgrep/ag/grep). Supports glob file_pattern (e.g., "*.py"), explicit regex mode, and fuzzy matching (ugrep only). Regex matching requires passing regex=True and may require an external search tool.

• find_files

  Find files matching glob pattern using in-memory index. Supports path patterns (*.py, test_*.js) and filename-only matching (README.md).

• get_file_summary

  Get a summary of a specific file, including: - Line count - Function/class definitions (for supported languages) - Import statements - Basic complexity metrics

• get_symbol_body

  Get the source code body of a specific symbol (function, method, or class). This tool retrieves only the code for the specified symbol, enabling efficient context usage by avoiding loading entire files. Args: file_path: Path to the file containing the symbol symbol

• refresh_index

  Manually rebuild the project file index. Use after git operations or when index seems stale.

• build_deep_index

  Build the deep index (full symbol extraction) for the current project. This performs a complete re-index and loads it into memory. Uses parallel processing by default. For large codebases (3000+ files), tuning max_workers can significantly improve build times. Args: ma

• get_settings_info

  Get information about the project settings.

• create_temp_directory

  Create the temporary directory used for storing index data.

• check_temp_directory

  Check the temporary directory used for storing index data.

• clear_settings

  Clear all settings and cached data.

• refresh_search_tools

  Manually re-detect the available command-line search tools on the system. This is useful if you have installed a new tool (like ripgrep) after starting the server.

• get_file_watcher_status

  Get file watcher service status and statistics.

• configure_file_watcher

  Configure file watcher service settings. Args: enabled: Whether to enable file watcher debounce_seconds: Debounce time in seconds before triggering rebuild additional_exclude_patterns: Additional directory/file patterns to exclude observer_type: Observer backend