BenAHammond

Code Auditor MCP — AI skill for Claude Code

AI community

Architectural invariants and code quality analysis, enforced inside your AI agent's edit loop.

How to install Code Auditor MCP

This entry records only its repository, not the path inside it, so there is no exact command to give. Open BenAHammond/code-auditor-mcp and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Code Auditor MCP does

Architectural invariants and code quality analysis, enforced inside your AI agent's edit loop. MCP server + CLI + Claude Code plugin. TypeScript, JavaScript, Go.

Alternatives in AI

Next AI Draw Io — Draw and edit draw.io diagrams by chatting with an AI 36.3k ★
Sentrux — Real-time architectural sensor that helps AI agents close the feedback loop, enabling recursive self-improveme 2.9k ★
Paul — Plan-Apply-Unify Loop — Structured AI-assisted development for Claude Code 1.2k ★

README

Code Auditor

Architectural invariants enforced inside your AI agent's edit loop. When the agent writes code that breaks a project rule, Code Auditor catches it and blocks the edit. The agent sees the rule's message and fixes itself.

Install

npm install -g code-auditor-mcp
code-audit install --agent all

Two commands to install everywhere. `code-audit install --agent all` copies the skill to every AI coding tool on your machine. Use `--agent` for specific tools.

What you get per tool: the skill (SKILL.md), MCP server access, and hook wiring where the tool supports it (blocking on Claude Code and Codex, advisory on Cursor).

code-audit install --list   # see the support matrix

Claude Code users can also install via plugin:

claude plugin marketplace add BenAHammond/code-auditor-mcp
claude plugin install code-auditor

The hook auto-installs the auditor on first use via npx.

Prompt examples

**"Index the codebase and run a full audit. Create tasks from any violations."**

**"Create a `.codeauditor.json` that bans lodash imports and prevents `src/languages/` from importing anything in `src/analyzers/`."**

**"Run a full code audit and create tasks from the violations."**

**"Sync the code index and audit only what changed vs main."**

**"Add an ast-pattern rule that blocks `new Function(...)`."**

**"Add a naming rule requiring hooks in `src/hooks/` to start with `use`."**

**"Add a call-constraint so `chargeCustomer()` in `src/services/payment.ts` can only be called from `src/api/`."**

Rule kinds

Five kinds. The agent writes them to `.codeauditor.json`. Bad configs fail the audit, not silently.

Kind	What it blocks
`import-ban`	Banned module imports
`call-constraint`	Function calls from unauthorized files
`module-boundary`	Imports across module boundaries
`naming`	Exported symbols not matching a pattern
`ast-pattern`	AST nodes matching an ast-grep pattern