Mcp Code Sanitizer

mcp-code-sanitizer

Strict AI-powered code reviewer for Claude Desktop, Cursor, VS Code, and Claude Code CLI. Finds bugs, vulnerabilities, and security issues — powered by Groq (free API).

[Python] [PyPI] [FastMCP] [Groq] [License]

Claude / Cursor / VS Code  ──MCP──►  code-sanitizer  ──REST──►  Groq API                                        (server.py)              (llama-3.3-70b)

[demo]

Features

Example output

{  "summary": "Critical SQL injection and secret exposed in logs",  "score": 23,  "issues": [    {      "severity": "critical",      "line": 2,      "title": "SQL Injection",      "description": "f-string directly interpolates user_id into query",      "fix": "cursor.execute('SELECT * FROM users WHERE id = %s', (user_id,))"    }  ],  "warnings": [{"title": "No exception handling", "description": "..."}],  "suggestions": ["Consider using an ORM instead of raw SQL"]}

Installation

Prerequisite: Get a free Groq API key at console.groq.com/keys — no credit card required.

Claude Code CLI

claude mcp add code-sanitizer -e GROQ_API_KEY=gsk_your_key -- uvx mcp-code-sanitizer

Claude Desktop

{  "mcpServers": {    "code-sanitizer": {      "command": "uvx",      "args": ["mcp-code-sanitizer"],      "env": {        "GROQ_API_KEY": "gsk_your_key_here"      }    }  }}

Cursor

Create .cursor/mcp.json in your project (or ~/.cursor/mcp.json globally):

{  "mcpServers": {    "code-sanitizer": {      "command": "uvx",      "args": ["mcp-code-sanitizer"],      "env": {        "GROQ_API_KEY": "gsk_your_key_here"      }    }  }}

VS Code

Requires VS Code 1.99+ with GitHub Copilot. Create .vscode/mcp.json in your project:

{  "servers": {    "code-sanitizer": {      "command": "uvx",      "args": ["mcp-code-sanitizer"],      "env": {        "GROQ_API_KEY": "gsk_your_key_here"      }    }  }}

Or add globally via Ctrl+Shift+P → "MCP: Add Server".

Don't have uvx? Install it with pip install uv, then use the commands above.

Manual install (alternative)

If you prefer cloning the repo:

git clone https://github.com/notasandy/mcp-code-sanitizercd mcp-code-sanitizerpip install -r requirements.txtcp .env.example .env   # add your GROQ_API_KEYpython server.py

Then point the client config to:

{  "command": "python",  "args": ["/full/path/to/server.py"],  "env": { "GROQ_API_KEY": "gsk_your_key_here" }}

GitHub Action — automatic PR review

Add AI code review to any repository in 5 lines. The action posts a structured comment on every PR with score, issues, and fix suggestions.

# .github/workflows/ai-review.ymlname: AI Code Reviewon:  pull_request:    types: [opened, synchronize]
permissions:  contents: read  pull-requests: write
jobs:  review:    runs-on: ubuntu-latest    steps:      - uses: notasandy/mcp-code-sanitizer@v1        with:          groq_api_key: ${{ secrets.GROQ_API_KEY }}

Add GROQ_API_KEY to your repository secrets → Settings → Secrets → Actions.

The action automatically:

• Reviews only changed files (up to 10 per PR)
• Posts a score and structured issue list as a PR comment
• Fails the check if critical issues are found

Usage in chat

After connecting, just write naturally:

Review this code for vulnerabilities:
def get_user(user_id):    query = f"SELECT * FROM users WHERE id = {user_id}"    return db.execute(query)

Or call tools explicitly:

analyze_file /path/to/my_script.pygenerate_tests for this function: ...compare_code — before vs after refactor, did it get better?generate_report and save to /tmp/report.html

Architecture

mcp-code-sanitizer/├── server.py          # FastMCP entry point├── config.py          # Constants — keys, limits, extension map├── groq_client.py     # Async Groq client with auto-retry on 429├── cache.py           # In-memory LRU cache with TTL├── prompts.py         # System prompts for all tools└── tools/    ├── analyze.py     # analyze_code    ├── compare.py     # compare_code    ├── explain.py     # explain_code    ├── tests.py       # generate_tests    ├── file_tool.py   # analyze_file — chunking + parallel analysis    ├── cache_tool.py  # cache_info    └── report.py      # generate_report — HTML output

Configuration

All settings via .env or environment variables:

Available Groq models

Contributing

PRs and Issues are welcome. Most wanted:

• Support for other LLM providers (OpenAI, Anthropic)
• New tools: dependency audit, complexity score, docstring generator
• Prompt improvements and new language support

License

MIT — do whatever you want. A star would be appreciated.

Links

• PyPI
• Groq Console — free API key
• FastMCP docs
• MCP specification
• Smithery
• MCP Registry