
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
mcp-code-context
Advanced tools
Powerful MCP server with Tree-sitter WASM parsers for 100% AST accuracy. Zero native dependencies. Production-ready with streaming, telemetry, audit logging, rate limiting, file locking, and ReDoS protection. Supports TypeScript, JavaScript, PHP, Dart, an
MCP server with Tree-sitter WASM parsers for 100% AST accuracy. Zero native dependencies.
npm install -g mcp-code-contextclaude_desktop_config.json:{
"mcpServers": {
"code-context": {
"command": "npx",
"args": ["-y", "mcp-code-context"]
}
}
}
@code-context to map repos or edit code surgically.No build tools required - Works on Windows/Mac/Linux without Visual Studio, Python, or node-gyp.
Works with Claude Desktop, Cursor, Windsurf, GitHub Copilot, Amazon Q, and any Model Context Protocol compatible client.
LLMs working with code face two bottlenecks:
mcp-code-context provides 11 tools — 5 for reading, 1 for cleanup, and 5 for writing — that operate at the symbol level (functions, classes, methods). Furthermore, tools support a className scope which correctly isolates identical symbol names in the same file (e.g. Flutter build() methods) to avoid reading or changing the wrong logic. Read tools extract structural skeletons. Write tools splice changes into the exact AST location.
| File | Original | Compressed | Reduction |
|---|---|---|---|
| PHP class (426 lines) | 426 | 60 | 85.9% |
| Dart repository (230 lines) | 230 | 30 | 87.0% |
| PHP config (68 lines) | 68 | 15 | 77.9% |
Built to be robust and precise. Both read and write engines are tested against real-world, complex codebases (including nested generic types in Dart, complex interfaces in PHP, and multi-file rename operations) with a 100% test pass rate across all languages and operations.
className to scope disambiguation (e.g., getting multiple build() methods in Dart).require(), Python imports, PHP use/require_once/include, and Dart imports..gitignore and .repomixignore rules. Automatically excludes node_modules, dist, vendor, .git, etc.className parameter.confirmationToken by default. Changes are only applied after explicit confirmation..mcp-backups/ directory.rollback_file tool._ and __ prefixed symbols in Dart and Python.| Language | Read (Compress + Extract) | Write (Replace + Insert + Rename + Remove) | Import Analysis |
|---|---|---|---|
| TypeScript / JavaScript | ✅ AST (Tree-sitter WASM) | ✅ AST (Tree-sitter WASM) | ✅ |
| PHP | ✅ AST (Tree-sitter WASM) | ✅ AST + line-splice | ✅ |
| Dart | ✅ AST (Tree-sitter WASM) | ✅ AST + line-splice | ✅ |
| Python | ✅ AST (Tree-sitter WASM) | ✅ Indentation-aware | ✅ |
| Others (JSON, YAML, CSS, etc.) | Passthrough / truncation | — | — |
rename_symbol ToolDart and Python: Cross-file rename is NOT supported for .dart, .py, and .pyi files.
write_file_surgical to rename within a single fileTypeScript, JavaScript, PHP: Fully supported with AST-aware renaming ✅
get_semantic_repo_map Tool@folder syntax to target specific directoriesrollback_file if something goes wrong.# Clone the repository
git clone https://github.com/YOUR_USERNAME/mcp-code-context.git
cd mcp-code-context
# Install dependencies (no build tools required!)
npm install
# Build
npm run build
Note: Unlike v2.x, this version uses web-tree-sitter (WASM) instead of native bindings. No Visual Studio, Python, or node-gyp required!
Add to your claude_desktop_config.json:
{
"mcpServers": {
"mcp-code-context": {
"command": "node",
"args": ["/absolute/path/to/mcp-code-context/dist/index.js"]
}
}
}
Add to your Cursor MCP settings (.cursor/mcp.json):
{
"mcpServers": {
"mcp-code-context": {
"command": "node",
"args": ["/absolute/path/to/mcp-code-context/dist/index.js"]
}
}
}
Add to your Windsurf MCP config:
{
"mcpServers": {
"mcp-code-context": {
"command": "node",
"args": ["/absolute/path/to/mcp-code-context/dist/index.js"]
}
}
}
Any MCP-compatible client can use this server. The transport is stdio (JSON-RPC over stdin/stdout). Point your client to node dist/index.js.
get_semantic_repo_mapGenerate a compressed architectural overview of an entire repository.
directoryPath (required) — Path to the repo rootformat (optional) — "xml" (default) or "markdown"read_file_surgicalRead a file, or extract only a specific named symbol. Returns structured suggestions if the symbol is missing.
filePath (required) — Path to the source filesymbolName (optional) — Name of a function, class, method, or typeclassName (optional) — Scope the symbol to a specific class (to avoid duplicates)analyze_impactFind all files that depend on a given file.
filePath (required) — Path to the file being modifiedrootDir (optional) — Repository root (auto-detected)read_file_linesRead specific line ranges from a file without loading the entire content. More efficient than read_file_surgical for small fragments.
filePath (required) — Path to the source filestartLine (optional) — Starting line number (1-indexed)endLine (optional) — Ending line number (1-indexed)aroundPattern (optional) — Search pattern to find and return surrounding linescontextLines (optional) — Number of lines before/after pattern (default: 5)search_code_patternSearch for code patterns across multiple files with context. Respects .gitignore rules.
rootDir (required) — Repository root directorypattern (required) — Regular expression pattern to searchfileExtensions (optional) — Array of extensions to search (e.g., [".ts", ".dart"])excludeDirs (optional) — Directories to exclude (default: ["node_modules", "dist", "build"])showContext (optional) — Include surrounding lines (default: true)contextLines (optional) — Number of context lines (default: 3)maxResults (optional) — Maximum matches to return (default: 50)rollback_fileSurgically restore a file to a previous state from the automated backup system.
filePath (required) — Path to the file to restoresteps (optional) — Number of versions to go back (1-5, default: 1)clean_backupsRemove all backup files for a project to keep the working directory clean.
projectRoot (required) — Absolute path to the project rootNote: Backups are stored centrally at [project-root]/.mcp-backups/ to keep your project organized.
All write tools follow a Two-Phase Workflow:
diff and a confirmationToken.confirm: true and provide the token to apply the changes.write_file_surgicalReplace the full source code of a named symbol in a file.
filePath (required) — Path to the filesymbolName (required) — Symbol to replacenewContent (required) — Replacement code (signature + body)confirmationToken (optional) — Token from Phase 1 to apply changesconfirm (optional) — Set to true to applyclassName (optional) — Scope the symbol to a specific classinsert_symbolInsert new code at a precise location relative to an existing symbol.
filePath (required) — Path to the filecode (required) — Code to insertanchorSymbol (optional) — Symbol to position relative toposition (optional) — "before", "after", "inside_start", "inside_end"className (optional) — Scope the anchor to a specific classconfirmationToken, confirm (optional)rename_symbolRename a symbol across the entire repository (definition + all usages).
filePath (required) — File where the symbol is definedoldName (required) — Current namenewName (required) — New namerootDir (optional) — Repository rootconfirmationToken, confirm (optional)remove_symbolSafely remove a symbol from a file with dependency checking.
filePath (required) — Path to the filesymbolName (required) — Symbol to removeclassName (optional) — Scope the symbol to a specific classforce (optional) — Skip dependency checkconfirmationToken, confirm (optional)get_semantic_repo_map to see the architectureread_file_surgical with symbol name for specific implementationsanalyze_impact before modifying shared filesdiff and confirmationTokenconfirm: true to applyrollback_file if something goes wrong after confirmation# Build
npm run build
# Run read tests (compression + extraction)
npm run build && node dist/tests/test-dart.js && node dist/tests/test-php.js
# Run write tests (replace, insert, rename, remove)
npm run build && node dist/tests/writers/test-write-smoke.js
# Run all tests
npm run build && node dist/tests/test-dart.js && node dist/tests/test-php.js && node dist/tests/writers/test-write-smoke.js
# Development (build + start)
npm run dev
ignore npm package (full .gitignore spec support)FAQs
Powerful MCP server with Tree-sitter WASM parsers for 100% AST accuracy. Zero native dependencies. Production-ready with persistent caching, structured logging, file watching, fuzzy search, rate limiting, file locking, and ReDoS protection. Supports TypeS
The npm package mcp-code-context receives a total of 33 weekly downloads. As such, mcp-code-context popularity was classified as not popular.
We found that mcp-code-context demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.