
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Experimental Model Context Protocol (MCP) server for VS Code integration with development tools, secure command execution, and AI-powered coding assistance. Still in active development.
⚠️ Experimental Project - This is an experimental MCP server for VS Code integration. While it includes comprehensive testing, it's still in active development. Use with caution in production environments and expect potential breaking changes.
An experimental Model Context Protocol (MCP) server that aims to enable AI assistants like Claude to interact with VS Code workspaces. This project attempts to provide development tools for file operations, code execution, Git management, Docker integration, and project management, though it's still evolving and may have limitations.
Inspired by codemcp - This experimental project adapts security and configuration concepts from the codemcp project, exploring project-specific TOML configuration, restricted command execution, and session management features. We're learning and iterating on these concepts.
.vscode-mcp.toml configuration system for project-specific settingsNote: All features are experimental and may not work perfectly in all environments. We're actively working to improve reliability and coverage.
⚠️ Experimental Software: Please test thoroughly in development environments before using with important projects. This MCP server is under active development and may have unexpected behaviors.
Try the experimental package installation:
# Install globally (experimental)
npm install -g code-mcp
# Or use with npx (recommended for testing)
npx code-mcp --help
Experimental Claude Desktop integration:
# Generate configuration (may need adjustments)
npx code-mcp --config
# Follow the instructions to add the config to Claude Desktop
Manual Claude Desktop Configuration: Add this to your Claude Desktop config file:
{
"mcpServers": {
"code-mcp": {
"command": "npx",
"args": ["code-mcp"],
"env": { "NODE_ENV": "production" }
}
}
}
Clone and build:
git clone https://github.com/agentics-ai/code-mcp.git
cd code-mcp
pnpm install && pnpm run build
Auto-configure Claude Desktop:
# macOS/Linux
./scripts/generate-claude-config.sh
# Windows
scripts\generate-claude-config.bat
Manual configuration (if needed):
Add to your Claude Desktop config file:
{
"mcpServers": {
"code-mcp": {
"command": "node",
"args": ["/path/to/code-mcp/dist/src/index.js"],
"env": { "NODE_ENV": "production" }
}
}
}
Test installation:
pnpm test # Run 473 tests
Restart Claude Desktop and ask: "What development tools are available?"
This experimental feature allows creating a .vscode-mcp.toml file in your project root for project-specific settings. Please note that this configuration system is still being developed and may change:
[general]
projectName = "My Project"
autoCommit = true # Experimental feature
sessionTracking = true # Still in development
[security]
# Experimental allowlist-based security
allowedCommands = [
"npm install", "npm test", "npm run build",
"git status", "git add .", "git commit",
"python -m pytest", "docker build"
]
commandTimeout = 300
[project]
language = "typescript"
framework = "node"
testCommand = "npm test"
buildCommand = "npm run build"
[[customTools]]
name = "deploy-staging"
description = "Deploy to staging environment"
commands = ["npm run build", "npm run deploy:staging"]
Experimental Features:
Warning: The configuration system is experimental and may not provide complete security. Always review and test commands before relying on them.
# Quick Docker setup
docker-compose up -d
# Configure Claude for Docker
{
"mcpServers": {
"code-mcp": {
"command": "docker",
"args": ["exec", "-i", "code-mcp-server", "node", "/app/dist/src/index.js"]
}
}
}
This experimental server provides development tools organized by category. Please note that not all tools may work reliably in all environments:
Key Tools (All Experimental):
read_file / write_file - File operations with backup supportrun_python / run_javascript - Code execution with dependency managementgit_status / git_commit / enhanced_git_diff - Git operationsdocker_build / docker_run / docker_compose - Container managementcreate_project - Multi-framework project scaffoldingsecure_run_command - Allowlist-based command executionload_project_config - Project-specific configuration managementExplore available tools through the Claude interface, but please test functionality before relying on it for important work.
Project Setup:
👤 "Create a new React project called 'my-app'"
🤖 Attempts to use: create_project, npm_command, create_file
📝 Note: May require manual adjustments or additional setup
Code Analysis:
👤 "Analyze the codebase and run tests"
🤖 Tries to use: analyze_code, search_files, run_tests, git_status
📝 Note: Analysis quality may vary depending on project structure
Git Workflow:
👤 "Review changes and commit my work"
🤖 Uses: git_status, enhanced_git_diff, git_add, git_commit
📝 Note: Please review all changes before committing
Experimental Security Features:
👤 "Start a development session and run tests securely"
🤖 Attempts: start_coding_session, secure_run_command, auto_commit_changes
📝 Note: Security features are experimental - verify results manually
Setup:
pnpm install && pnpm run build
pnpm test # Run test suite (currently 473 tests across 15 suites)
pnpm run dev # Development with auto-rebuild
Docker (Experimental):
docker-compose up --build # Run with Docker (may need adjustments)
docker-compose run --rm app pnpm test # Test in container
Testing: We maintain a comprehensive test suite with 473 tests covering unit, integration, and e2e scenarios. However, as an experimental project, real-world usage may reveal edge cases not covered by tests.
Note: While we have extensive tests, this is still experimental software. Test thoroughly in your specific environment before relying on it.
We welcome contributions to this experimental project! Please keep in mind that we're still figuring out best practices and the architecture may evolve:
git checkout -b feature-namepnpm testSee CONTRIBUTING.md for detailed guidelines. As an experimental project, we're especially interested in:
MIT License - see LICENSE for details.
This is experimental software - please be patient as we work through issues and limitations.
Known Limitations:
Common Issues:
pnpm test to identify issues.vscode-mcp.toml allowlist (security feature is experimental)Getting Help:
Inspired by codemcp by Edward Z. Yang. We're experimenting with and learning from key security and configuration concepts while exploring VS Code integration and MCP tool coverage.
Experimental adaptations from codemcp:
.vscode-mcp.toml configuration (still refining the format)Built with ❤️ for the AI development community as an experimental contribution. We're learning as we build and welcome feedback on what works and what doesn't.
FAQs
Experimental Model Context Protocol (MCP) server for VS Code integration with development tools, secure command execution, and AI-powered coding assistance. Still in active development.
The npm package code-mcp receives a total of 15 weekly downloads. As such, code-mcp popularity was classified as not popular.
We found that code-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.