MCP Server
Moltline Code Review
com.moltlinestudio/codereview
What this MCP does
Reviews code and diffs for security risks, leaked secrets, complexity, AI-generated-code patterns, and OWASP-related issues.
Capabilities
Tools
7
tools
ai_code_smell_scan
Ai Code Smell Scan
Flag the tells of unreviewed AI-generated code in a source file. FREE.
Detects comments that restate the next line, leaked assistant preambles,
placeholder TODOs, shipped 'Example usage' blocks, over-broad try/except
that swallows errors, and auto-named identifiers. Typical input
{"code": "<file contents>"} returns {"reviewed_confidence": 0-100,
"hits": [{"smell": "...", "evidence": "<quoted snippet>"}], "reading":
"...", "note": "..."}.
Use on a full source file suspected of unreviewed machine authorship. Not
on a diff (review_diff), and the result is a signal to check, not proof of
authorship. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
Read only
Idempotent
Input schema
{'type': 'object', 'required': ['code'], 'properties': {'code': {'type': 'string', 'description': 'Full source text to scan, any language; paste the file\ncontents as a single string.'}}, 'additionalProperties': False}
Output schema
{'type': 'object', 'additionalProperties': True}
complexity_report
Complexity Report
Report structural complexity of a source file, function by function. FREE.
Measures per-function length, max nesting depth, and a cyclomatic-style
branch count (if/for/while/case/&&/||/except), flagging functions too
long or too deeply nested to review confidently. Typical input
{"code": "<file contents>"} returns {"functions": N, "detail":
[{"name": ..., "start": N, "lines": N, "branches": N, "max_depth": N}],
"flags": ["..."], "note": "..."}.
Use when structure rather than correctness is the question. Not for
vulnerabilities (security_deep_dive). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
Read only
Idempotent
Input schema
{'type': 'object', 'required': ['code'], 'properties': {'code': {'type': 'string', 'description': 'Full source text to analyze, pasted as a single string.'}, 'language': {'type': 'string', 'default': 'auto', 'description': 'Optional language hint, e.g. "python" or "javascript";\n"auto" (default) detects from syntax.'}}, 'additionalProperties': False}
Output schema
{'type': 'object', 'additionalProperties': True}
get_reviewer_persona
Get Reviewer Persona
Load the Senior Reviewer persona for consistent, high-signal reviews. PREMIUM (license).
The persona is a reviewing voice that is skeptical, specific, and kind —
demands evidence over vibes and blocks only on real risk. Takes no
arguments. Returns {"persona": ..., "identity": ..., "rules": ["...",
...], "opening_move": "..."} ready to adopt as a system prompt.
Use to keep repeated reviews consistent in voice and rigor. Not for
running a review - the scan tools do that. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
Read only
Idempotent
Input schema
{'type': 'object', 'properties': {}, 'additionalProperties': False}
Output schema
{'type': 'object', 'additionalProperties': True}
review_checklist
Review Checklist
Produce a focused pull-request review checklist for a language or stack. FREE.
Covers the things that actually break in production, with extra items per
language. Typical input {"language": "python"} returns {"language":
"python", "checklist": ["...", ...], "note": "..."}.
Use before a review, to decide what to look for. Not for reviewing actual
code - pass code to review_diff or security_deep_dive. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
Read only
Idempotent
Input schema
{'type': 'object', 'properties': {'language': {'type': 'string', 'default': 'general', 'description': 'Language or stack to tailor for: "python", "javascript",\n"typescript", "go", "sql", or "general" (default). Unknown values\nfall back to the general checklist.'}}, 'additionalProperties': False}
Output schema
{'type': 'object', 'additionalProperties': True}
review_diff
Review Diff
Risk-scan a unified diff the way a senior reviewer triages a PR. FREE.
Flags added lines matching known risk patterns — injection sinks, disabled
TLS, bare excepts, debug prints, TODOs, N+1 hints, leaked secrets — with
the new-file line number and a severity (1 low - 4 high). Typical input
{"diff": "<git diff output>"} returns {"added_lines": N, "risk_score":
0-100, "verdict": "...", "secrets": [...], "findings": [{"line": N,
"severity": 1-4, "issue": "...", "code": "..."}], "note": "..."}.
Use on a unified diff, when only the change matters. Not for whole-file
analysis (complexity_report, ai_code_smell_scan). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
Read only
Idempotent
Input schema
{'type': 'object', 'required': ['diff'], 'properties': {'diff': {'type': 'string', 'description': 'A unified diff exactly as produced by `git diff` — text with\n@@ hunk headers and +/- line prefixes. Only added (+) lines are\nscanned.'}}, 'additionalProperties': False}
Output schema
{'type': 'object', 'additionalProperties': True}
secret_scan
Secret Scan
Scan text for accidentally-committed machine credentials and private-key material. FREE.
Reports each match's location and category so it can be rotated before it
leaks. Detection is pattern-based over the common leaked-credential
formats; it never echoes the matched value back. Typical input
{"text": "<file, diff, or config contents>"} returns {"leaked": bool,
"count": N, "findings": [{"line": N, "type": "<category>"}], "note": "..."}.
Pattern matching only - a clean result is not proof, and every hit needs
human confirmation before anyone acts on it. Not a general security review
(security_deep_dive). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
Read only
Idempotent
Input schema
{'type': 'object', 'required': ['text'], 'properties': {'text': {'type': 'string', 'description': 'The file, diff, or config contents to scan, pasted as a\nsingle string.'}}, 'additionalProperties': False}
Output schema
{'type': 'object', 'additionalProperties': True}
security_deep_dive
Security Deep Dive
Run an OWASP-oriented security pass over a source file. PREMIUM (license).
Checks injection sinks, auth/session handling, crypto misuse,
SSRF/deserialization, and unsafe file/path handling — each finding cites
the line, the OWASP risk class, and a concrete fix direction. Typical
input {"code": "<file contents>"} returns {"issues": N, "findings":
[{"line": N, "class": "A03 Injection", "fix": "...", "code": "..."}],
"owasp_note": "..."}.
Use on one source file when vulnerabilities are the question. Not for
style or structure (complexity_report), and never a substitute for a
security professional on high-risk code. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
Read only
Idempotent
Input schema
{'type': 'object', 'required': ['code'], 'properties': {'code': {'type': 'string', 'description': 'Full source text to audit, pasted as a single string; any\ncommon language.'}}, 'additionalProperties': False}
Output schema
{'type': 'object', 'additionalProperties': True}
History
Recent tool changes
Added
get_reviewer_persona
Sept. 17, 2026, 12:36 p.m.
Added
security_deep_dive
Sept. 17, 2026, 12:36 p.m.
Added
review_checklist
Sept. 17, 2026, 12:36 p.m.
Added
secret_scan
Sept. 17, 2026, 12:36 p.m.
Added
complexity_report
Sept. 17, 2026, 12:36 p.m.
Added
ai_code_smell_scan
Sept. 17, 2026, 12:36 p.m.
Added
review_diff
Sept. 17, 2026, 12:36 p.m.
Discover
Similar MCP servers
hyperion
com.thetempleofdoom.hyperion/hyperion
Acts as a paid MCP tool marketplace and utility gateway with server discovery, HTTP and JavaScript tools, research, data conversi…
Vee3
io.github.Vee3io/vee3
Manages Clerk authentication infrastructure, including users, organizations, domains, sessions, tokens, OAuth, SSO, machines, per…
IA-QA — 130+ QA & Dev Tools for AI Agents
io.github.JcJamet/ia-qa-toolbox
Provides deterministic QA, evaluation, testing, code analysis, prompt and RAG checks, model comparison, and web security diagnost…
validoria-mcp
com.validoria/validoria-mcp
Runs continuous website, API, and webshop tests covering security, SEO, performance, accessibility, browser journeys, and inciden…
HubVibe: Pay-per-Call Tools for AI Agents: Web Search, Email Verify, KYC, Stocks, Crypto, News, Data
io.github.Its-fortunatefolly/hubvibe
Offers paid utilities for web audits, HTTP fetching and extraction, BigQuery analysis, LLM processing, code execution, blockchain…
developer-tools
net.programmes/developer-tools
Provides general-purpose developer utilities for encoding, hashing, encryption, JSON, HTML, CSS, networking, and related data tra…
Qiniso
io.github.qinisolabs/qiniso
Provides deterministic formatting, parsing, holiday and tax lookups, address handling, and checksum or structure validation for i…
ContrastAPI
com.contrastcyber/api
Provides security research and assessment tools covering CVEs, IOCs, dependencies, secrets, injection risks, HTTP headers, domain…