cleaner-code

Purpose

CodeSafer (repository name cleaner-code) is an AI code security scanner provided as a Model Context Protocol (MCP) server. It targets code rapidly generated by AI programming assistants, detecting hidden threats that traditional linters and manual review easily miss, completing the scan before the code runs on the local machine.

Main Capabilities

CodeSafer uses a hybrid detection approach:

• 8 static analysis scanners: use deterministic rules for known attack categories, are fast, and produce no false negatives on the patterns they cover.
• CodeBERT deep analysis: uses a transformer model to classify code blocks as malicious/benign and provides a confidence score, used to catch obfuscated or novel patterns that static rules miss.

Detection spans 9 categories:

1. Invisible Unicode characters—including zero-width space, zero-width joiner, and more than 30 other variants
2. BiDi / Trojan Source attacks—CVE-2021-42574
3. Homoglyphs—using Cyrillic/Greek characters to disguise as Latin characters, CVE-2021-42694
4. Unicode steganography—Glassworm patterns in whitespace characters
5. Rules-file backdoors—malicious instructions in AI configuration files such as .cursorrules and CLAUDE.md
6. Dependency risks—typosquatting and suspicious install scripts
7. Obfuscation patterns—eval + base64, packed payloads, reverse shells
8. Static analysis findings—from the 8 deterministic scanners
9. AI deep analysis—CodeBERT transformer detection of novel and obfuscated threats

Usage

CodeSafer runs as a local MCP server. AI clients (Claude Code, Cursor, etc.) call its tools when reviewing or generating code, and findings are returned inline. AI analysis runs locally against the tokenizer server, and data does not leave the user's machine.

CodeSafer exposes six tools to MCP clients; the materials do not list descriptions beyond the tool names one by one.

Requirements

• Node.js 18 or later
• An MCP-compatible client (Claude Code, Cursor, VS Code + Copilot, Cline)

Configure the MCP Client

For Claude Code (~/.claude.json or the project .mcp.json) and Cursor (.cursor/mcp.json), the materials give the configuration locations but do not provide the specific configuration code content.

After restarting the client, the CodeSafer tools will appear in the tool selector.

Example Instructions You Can Give the AI Client

• "Scan this file for hidden security issues."
• "Check the dependencies in package.json for typosquatting."
• "Scan .cursorrules for a rules-file backdoor."
• "Run a deep AI analysis of src/auth.ts."
• "Explain what a Trojan Source attack is and how to fix the finding above."

The client will call the corresponding MCP tool and return findings with severity level, line number, and remediation suggestions.

Use Cases

• Security review after code is generated by an AI programming assistant
• Check whether backdoors have been implanted in rules files such as .cursorrules and CLAUDE.md
• Check whether package.json dependencies have typosquatting risks
• Perform deep AI analysis on suspicious or obfuscated code
• Complete localized security scanning before code runs on the local machine

Pricing and Limits

CodeSafer can be used for free. Static analysis (scan_file, scan_directory, scan_rules_file, check_dependencies, explain_finding) is unlimited. AI deep analysis (ai_analyze) includes 10 free runs per session; higher AI quotas can be obtained through paid plans at codesafer.org.

Other Information

• Official website: codesafer.org
• Supported MCP clients: Claude Code, Cursor, VS Code + Copilot, Cline
• Technology stack: static analysis + CodeBERT deep learning, running locally
• License: ISC, see the repository LICENSE file for details
• Model Context Protocol: modelcontextprotocol.io
• Issue feedback: GitHub Issues
• Repository address:https://github.com/goldmembrane/cleaner-code

The project structure and specific MCP configuration code snippets are not fully expanded in the materials and are not provided for now.