English Français العربية

codemcp

Registre officiel Outils de développement

Code mode for MCP: search, describe and execute over all your servers, with a sandbox and approvals.

Code source Documentation

Installation

Ajoutez ceci à la configuration MCP de votre client (Claude Desktop : claude_desktop_config.json ; Cursor : .cursor/mcp.json ; VS Code et les autres utilisent la même forme « mcpServers »).

NPM package codemcp-cli
Claude Code 
claude mcp add codemcp -- npx -y codemcp-cli@0.4.0 serve --config '<path>'
Configuration JSON (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "codemcp": {
            "command": "npx",
            "args": [
                "-y",
                "codemcp-cli@0.4.0",
                "serve",
                "--config",
                "<path>"
            ]
        }
    }
}

Documentation

Tirée du README du projet sur GitHub, actualisée chaque semaine. Les liens ouvrent GitHub.

Sommaire
  1. codemcp
  2. Why
  3. Try it
  4. Several servers, several credentials
  5. Packages
  6. Sandbox tiers
  7. License

codemcp

One MCP server in front of all the MCP servers you already use. Your model sees three tools, search, describe and execute. It writes a short TypeScript program against typed stubs generated from your tools' schemas, and codemcp runs that program in a sandbox that can call tools and nothing else.

Pre-alpha. APIs will change. codemcp speaks MCP 2025-11-25 through SDK 1.x today; the move to SDK v2 and the 2026-07-28 revision is next. docs/STATUS.md lists what works and what does not yet.

Why

Tool definitions for a handful of MCP servers can eat 50K tokens before you have said a word. With codemcp the model starts with about 1K and looks the rest up when it needs it. docs/BENCHMARK.md measures the difference on real servers, with correctness checks, from a reproducible harness in examples/benchmark/.

Loops, filters and joins over tool results run inside the sandbox. Only the final answer comes back to the model, not every intermediate row.

Model-written code is attacker-controlled, because that is what prompt injection makes it. The default executor is QuickJS compiled to WebAssembly on a worker thread, with memory, stack and deadline limits enforced from outside. Your credentials never enter the sandbox; the only thing inside is a JSON bridge to stubs the proxy has already authorized.

Governance sits where it can be enforced: allow, deny or approve rules per tool and per principal, destructiveHint annotations that raise a tool to approve (annotations can tighten a decision, never loosen it), pinned tool definitions with drift detection, call and byte budgets, and an audit record of every bridged call. When a call needs a human, the sandbox parks mid-call and continues when you decide. A denial is catchable, so the script can fall back instead of losing its work.

It works in front of Claude Code, Cursor, VS Code, Codex CLI, Claude Desktop and any other MCP client, with any model.

Try it

npx codemcp-cli import --write   # find mcp.json files from Claude Code, Cursor, VS Code, Claude Desktop
npx codemcp-cli serve            # run the proxy over stdio; point your client here

examples/clients/README.md has the config snippet for each client.

To explore from a checkout:

pnpm install && pnpm build
pnpm --filter codemcp-examples basic   # scripted walkthrough, no model needed
pnpm --filter codemcp-examples ui      # chat with your own key at http://localhost:8765

examples/README.md explains each example. To point them at your own servers, see examples/real/README.md.

Several servers, several credentials

Every server in codemcp.config.json becomes a namespace: tools.github.*, tools.crm.*. One script can join across them. Secrets go in each server's env or headers as ${VAR} references, filled from the proxy's environment at startup, and the sandbox never sees them. docs/AUTH.md covers credentials, identity and approvals.

Packages

PackagePurpose
codemcp-cliThe codemcp command and MCP server
codemcp-coreRegistry, JSON Schema to TypeScript stubs, bridge protocol, policy, budgets, pinning, audit, code normalization, search
codemcp-executor-quickjsDefault sandbox: QuickJS-WASM on a worker thread
codemcp-conformanceHostile-script suite every executor must pass
spec/Language-neutral definition: error codes, schemas, policy cases, stub goldens, conformance cases. Ports in other languages test against it

Sandbox tiers

QuickJS-WASM in a worker is tier 0 and the only one built. Planned: Monty for Python, a Deno subprocess, Docker with gVisor, Firecracker through self-hosted E2B or microsandbox, and remote adapters. Node vm, isolated-vm, Pyodide, Bun and bare workerd are deliberately absent; their own maintainers say they are not a boundary. docs/THREAT_MODEL.md has the reasoning.

License

Apache-2.0. See LICENSE.

Questions fréquentes

Qu'est-ce que codemcp ?

Code mode for MCP: search, describe and execute over all your servers, with a sandbox and approvals.

Comment installer codemcp ?

Il s'exécute sur votre machine. Dans Claude Code : claude mcp add codemcp -- npx -y codemcp-cli@0.4.0 serve --config '<path>'. Pour les autres clients, collez la configuration JSON de cette page dans leurs réglages MCP.

Faut-il une clé API pour codemcp ?

Son entrée au registre n'indique aucune clé ni secret obligatoire. Certaines fonctions peuvent tout de même demander un compte auprès du service auquel il se connecte.

codemcp est-il open source ?

Oui. Son code est sur GitHub sous licence Apache-2.0.

Qui maintient codemcp ?

Il est publié par stackunseen. AI.tn le référence sans le maintenir ni le recommander.

Issu du registre MCP officiel. Être listé n'est pas une recommandation : vérifiez le code et les permissions d'un serveur avant de lui donner accès à vos données.