
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
@j0hanz/code-lens
Advanced tools
Gemini-powered MCP server for automated code review, analysis, and documentation.
Code Lens is a Model Context Protocol server that uses Google Gemini to analyze diffs, review pull requests, detect code smells, generate documentation, and verify logic. It exposes 13 tools, 7 resources, and 5 prompts over stdio transport.
GEMINI_API_KEY or GOOGLE_API_KEY){
"mcpServers": {
"code-lens": {
"command": "npx",
"args": ["-y", "@j0hanz/code-lens@latest"],
"env": {
"GEMINI_API_KEY": "your-api-key"
}
}
}
}
docker run -i --rm -e GEMINI_API_KEY="your-api-key" ghcr.io/j0hanz/code-lens
Or with Docker Compose:
GEMINI_API_KEY=your-api-key docker compose up
Add to .vscode/mcp.json:
{
"servers": {
"code-lens": {
"command": "npx",
"args": ["-y", "@j0hanz/code-lens@latest"],
"env": {
"GEMINI_API_KEY": "your-api-key"
}
}
}
}
Or install via CLI:
code --add-mcp '{"name":"code-lens","command":"npx","args":["-y","@j0hanz/code-lens@latest"]}'
For more info, see VS Code MCP docs.
Add to .vscode/mcp.json:
{
"servers": {
"code-lens": {
"command": "npx",
"args": ["-y", "@j0hanz/code-lens@latest"],
"env": {
"GEMINI_API_KEY": "your-api-key"
}
}
}
}
Or install via CLI:
code-insiders --add-mcp '{"name":"code-lens","command":"npx","args":["-y","@j0hanz/code-lens@latest"]}'
For more info, see VS Code Insiders MCP docs.
Add to ~/.cursor/mcp.json:
{
"mcpServers": {
"code-lens": {
"command": "npx",
"args": ["-y", "@j0hanz/code-lens@latest"],
"env": {
"GEMINI_API_KEY": "your-api-key"
}
}
}
}
For more info, see Cursor MCP docs.
Add to mcp.json:
{
"mcpServers": {
"code-lens": {
"command": "npx",
"args": ["-y", "@j0hanz/code-lens@latest"],
"env": {
"GEMINI_API_KEY": "your-api-key"
}
}
}
}
For more info, see Visual Studio MCP docs.
{
"mcpServers": {
"code-lens": {
"command": "npx",
"args": ["-y", "@j0hanz/code-lens@latest"],
"env": {
"GEMINI_API_KEY": "your-api-key"
}
}
}
}
For more info, see Goose MCP docs.
{
"mcpServers": {
"code-lens": {
"command": "npx",
"args": ["-y", "@j0hanz/code-lens@latest"],
"env": {
"GEMINI_API_KEY": "your-api-key"
}
}
}
}
For more info, see LM Studio MCP docs.
Add to claude_desktop_config.json:
{
"mcpServers": {
"code-lens": {
"command": "npx",
"args": ["-y", "@j0hanz/code-lens@latest"],
"env": {
"GEMINI_API_KEY": "your-api-key"
}
}
}
}
For more info, see Claude Desktop MCP docs.
claude mcp add code-lens -- npx -y @j0hanz/code-lens@latest
Or add to config:
{
"mcpServers": {
"code-lens": {
"command": "npx",
"args": ["-y", "@j0hanz/code-lens@latest"],
"env": {
"GEMINI_API_KEY": "your-api-key"
}
}
}
}
For more info, see Claude Code MCP docs.
Add to ~/.codeium/windsurf/mcp_config.json:
{
"mcpServers": {
"code-lens": {
"command": "npx",
"args": ["-y", "@j0hanz/code-lens@latest"],
"env": {
"GEMINI_API_KEY": "your-api-key"
}
}
}
}
For more info, see Windsurf MCP docs.
amp mcp add code-lens -- npx -y @j0hanz/code-lens@latest
Or add to config:
{
"mcpServers": {
"code-lens": {
"command": "npx",
"args": ["-y", "@j0hanz/code-lens@latest"],
"env": {
"GEMINI_API_KEY": "your-api-key"
}
}
}
}
For more info, see Amp MCP docs.
Add to cline_mcp_settings.json:
{
"mcpServers": {
"code-lens": {
"command": "npx",
"args": ["-y", "@j0hanz/code-lens@latest"],
"env": {
"GEMINI_API_KEY": "your-api-key"
}
}
}
}
For more info, see Cline MCP docs.
Add to ~/.codex/config.yaml:
{
"mcpServers": {
"code-lens": {
"command": "npx",
"args": ["-y", "@j0hanz/code-lens@latest"],
"env": {
"GEMINI_API_KEY": "your-api-key"
}
}
}
}
For more info, see Codex CLI MCP docs.
Add to .vscode/mcp.json:
{
"servers": {
"code-lens": {
"command": "npx",
"args": ["-y", "@j0hanz/code-lens@latest"],
"env": {
"GEMINI_API_KEY": "your-api-key"
}
}
}
}
For more info, see GitHub Copilot MCP docs.
{
"mcpServers": {
"code-lens": {
"command": "npx",
"args": ["-y", "@j0hanz/code-lens@latest"],
"env": {
"GEMINI_API_KEY": "your-api-key"
}
}
}
}
For more info, see Warp MCP docs.
Add to .kiro/settings/mcp.json:
{
"mcpServers": {
"code-lens": {
"command": "npx",
"args": ["-y", "@j0hanz/code-lens@latest"],
"env": {
"GEMINI_API_KEY": "your-api-key"
}
}
}
}
For more info, see Kiro MCP docs.
Add to ~/.gemini/settings.json:
{
"mcpServers": {
"code-lens": {
"command": "npx",
"args": ["-y", "@j0hanz/code-lens@latest"],
"env": {
"GEMINI_API_KEY": "your-api-key"
}
}
}
}
For more info, see Gemini CLI MCP docs.
Add to ~/.config/zed/settings.json:
{
"context_servers": {
"code-lens": {
"settings": {
"command": "npx",
"args": ["-y", "@j0hanz/code-lens@latest"]
}
}
}
}
For more info, see Zed MCP docs.
Add to your VS Code settings.json under augment.advanced:
{
"augment.advanced": {
"mcpServers": [
{
"id": "code-lens",
"command": "npx",
"args": ["-y", "@j0hanz/code-lens@latest"],
"env": {
"GEMINI_API_KEY": "your-api-key"
}
}
]
}
}
For more info, see Augment MCP docs.
{
"mcpServers": {
"code-lens": {
"command": "npx",
"args": ["-y", "@j0hanz/code-lens@latest"],
"env": {
"GEMINI_API_KEY": "your-api-key"
}
}
}
}
For more info, see Roo Code MCP docs.
{
"mcpServers": {
"code-lens": {
"command": "npx",
"args": ["-y", "@j0hanz/code-lens@latest"],
"env": {
"GEMINI_API_KEY": "your-api-key"
}
}
}
}
For more info, see Kilo Code MCP docs.
generate_diff to capture unstaged or staged changesanalyze_pr_impact to assess severity and breaking changesgenerate_review_summary for a risk rating and merge recommendationdetect_api_breaking_changes to check for public API breakagegenerate_test_plan to produce prioritized test casesload_file to cache a source filerefactor_code for structural improvement suggestionsdetect_code_smells for Fowler-taxonomy anti-patternsgenerate_documentation to generate JSDoc/TSDoc stubsask_about_code for natural-language Q&A about the fileverify_logic to verify algorithms with code executiongenerate_diff on a performance-sensitive changeanalyze_time_space_complexity to detect Big-O degradationweb_search for up-to-date documentation or API references via Google Search with Grounding[MCP Client]
│
│ Transport: stdio
▼
[MCP Server: code-lens]
│ Entry: src/index.ts → src/server.ts
│
├── initialize / initialized (lifecycle handshake)
│
├── tools/call ──────────────────────────────────────────────
│ │
│ │ Diff-based tools (require generate_diff first):
│ ├── [generate_diff] Sync — capture git diff
│ ├── [analyze_pr_impact] Flash — severity & impact
│ ├── [generate_review_summary] Flash — risk & merge rec
│ ├── [generate_test_plan] Flash — test cases
│ ├── [analyze_time_space_complexity] Flash — Big-O analysis
│ ├── [detect_api_breaking_changes] Flash — API breakage
│ │
│ │ File-based tools (require load_file first):
│ ├── [load_file] Sync — cache source file
│ ├── [refactor_code] Flash — refactoring
│ ├── [detect_code_smells] Flash — smell detection
│ ├── [generate_documentation] Flash — doc stubs
│ ├── [ask_about_code] Flash — Q&A
│ ├── [verify_logic] Flash — code execution
│ │
│ │ Standalone:
│ └── [web_search] Flash — Google Search
│
├── resources/read ──────────────────────────────────────────
│ ├── [internal://instructions] Server usage guide
│ ├── [internal://tool-catalog] Tool reference
│ ├── [internal://workflows] Workflow sequences
│ ├── [internal://server-config] Runtime config
│ ├── [internal://tool-info/{name}] Per-tool details
│ ├── [internal://diff/current] Cached diff (text/x-patch)
│ └── [internal://file/current] Cached source file
│
├── prompts/get ─────────────────────────────────────────────
│ ├── [get-help] Full server instructions
│ ├── [review-guide] Tool + focus area workflow
│ ├── [select-workflow] Pipeline by change type
│ ├── [analyze-file] File analysis pipeline
│ └── [tool-chain] Tool prerequisite chain
│
└── Capabilities: structured output, tool annotations, notifications
[Client] -- initialize {protocolVersion, capabilities} --> [Server]
[Server] -- {protocolVersion, capabilities, serverInfo} --> [Client]
[Client] -- notifications/initialized --> [Server]
[Client] -- tools/call {name, arguments} --> [Server]
[Server] -- notifications/progress {token, progress, total} --> [Client]
[Server] -- {content, structuredContent, isError?} --> [Client]
| Tool | Description | Prerequisite | Model |
|---|---|---|---|
generate_diff | Capture git diff (unstaged/staged) and cache server-side | — | Sync |
analyze_pr_impact | Assess severity, categories, breaking changes, rollback complexity | generate_diff | Flash |
generate_review_summary | PR summary, risk rating, merge recommendation | generate_diff | Flash |
generate_test_plan | Prioritized test cases and coverage guidance | generate_diff | Flash |
analyze_time_space_complexity | Big-O complexity analysis and degradation detection | generate_diff | Flash |
detect_api_breaking_changes | Detect breaking API/interface changes | generate_diff | Flash |
load_file | Cache a source file for analysis tools | — | Sync |
refactor_code | Complexity, duplication, naming, grouping suggestions | load_file | Flash |
detect_code_smells | Structural code smells (Fowler taxonomy) | load_file | Flash |
generate_documentation | JSDoc/TSDoc/docstring stubs for public exports | load_file | Flash |
ask_about_code | Natural-language Q&A about a cached file | load_file | Flash |
verify_logic | Verify algorithms via Gemini code execution sandbox | load_file | Flash |
web_search | Google Search with Grounding | — | Flash |
| URI | Description | MIME |
|---|---|---|
internal://instructions | Complete server usage instructions | text/markdown |
internal://tool-catalog | Tool reference: models, params, outputs, data flow | text/markdown |
internal://workflows | Recommended workflows and tool sequences | text/markdown |
internal://server-config | Runtime configuration and limits | text/markdown |
internal://tool-info/{toolName} | Per-tool details (parameterized) | text/markdown |
internal://diff/current | Most recently generated diff | text/x-patch |
internal://file/current | Most recently loaded source file | text/plain |
| Prompt | Description |
|---|---|
get-help | Full server instructions: capabilities, tools, resources, constraints |
review-guide | Workflow guide for a specific tool and focus area |
select-workflow | Recommended tool pipeline based on change type |
analyze-file | Goal-based tool pipeline for single-file analysis |
tool-chain | Full prerequisite chain for a given tool |
All tools expose MCP tool annotations:
| Annotation | Used |
|---|---|
readOnlyHint | Yes |
destructiveHint | Yes |
idempotentHint | Yes |
openWorldHint | Yes |
All Gemini-powered tools return validated structuredContent alongside text content, using Zod v4 output schemas.
| Variable | Default | Description |
|---|---|---|
GEMINI_API_KEY | — | Required. Gemini API key. Falls back to GOOGLE_API_KEY. |
GEMINI_MODEL | gemini-3-flash-preview | Override the default Gemini model for all tools. |
MAX_DIFF_CHARS | 120000 | Maximum diff size in characters. |
MAX_CONCURRENT_CALLS | 10 | Maximum concurrent Gemini API calls. |
MAX_CONCURRENT_BATCH_CALLS | 2 | Maximum concurrent batch Gemini calls. |
MAX_CONCURRENT_CALLS_WAIT_MS | 2000 | Wait timeout for concurrency semaphore. |
GEMINI_BATCH_MODE | off | Enable Gemini batch mode. |
GEMINI_HARM_BLOCK_THRESHOLD | BLOCK_NONE | Safety filter threshold (BLOCK_NONE, BLOCK_ONLY_HIGH, BLOCK_MEDIUM_AND_ABOVE, BLOCK_LOW_AND_ABOVE). |
GEMINI_DIFF_CACHE_ENABLED | false | Enable Gemini context caching for large diffs. |
GEMINI_DIFF_CACHE_TTL_S | 3600 | Cache TTL in seconds (when caching is enabled). |
npx @j0hanz/code-lens@latest --model gemini-2.5-flash --max-diff-chars 200000
| Flag | Env Equivalent |
|---|---|
--model, -m | GEMINI_MODEL |
--max-diff-chars | MAX_DIFF_CHARS |
| Control | Status |
|---|---|
| Input validation | Zod v4 schema validation on all tool inputs |
| Path safety | load_file restricts paths to workspace root |
| Stdout safety | Logs to stderr; stdout reserved for MCP protocol |
| Non-root container | Docker runs as dedicated mcp user |
npm install # Install dependencies
npm run build # Compile TypeScript
npm run dev # Watch mode
npm run dev:run # Run with --watch and .env
npm run start # Run compiled server
npm run type-check # Type-check src + tests
npm run lint # ESLint
npm run test # Run test suite
npm run format # Prettier
npm run inspector # MCP Inspector
npm run knip # Dead code detection
.github/workflows/release.ymlDockerfile) with node:24-alpinedocker-compose.yml@j0hanz/code-lensGEMINI_API_KEY or GOOGLE_API_KEY in your environment or client config env block.generate_diff before running any diff-based review tool.load_file before running any file analysis tool.MAX_DIFF_CHARS (default: 120,000 characters).@google/genai)@modelcontextprotocol/sdk)zod v4)MIT License. See LICENSE for details.
Contributions welcome via pull requests.
FAQs
Gemini-powered MCP server for code analysis.
We found that @j0hanz/code-lens demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.