CodeSentinel (CodeHealth MCP) is a codebase health analysis agent based on the Model Context Protocol (MCP), designed to surface issues that are "invisible in day-to-day work," such as dead code, circular dependencies, excessive coupling, and architectural drift, directly in the tools developers actually use, rather than leaving them only in CI dashboards that no one looks at.
[Main capabilities] The project provides 7 analysis tools that can be invoked in any MCP-compatible client. The analysis covers dead code, circular dependencies, excessive coupling, and architectural drift. It also comes with a complete Slack Agent Builder app, featuring a Block Kit UI (findings encoded by severity, health scores, actionable recommendations), thread-based follow-up analysis conversations, suggested prompts that trigger analysis with one click, and a globally reusable MCP server. It also includes remote MCP protocol health probing: synthetic Streamable HTTP / legacy SSE handshakes (initialize + tools/list), canonical tool schema hashing and drift alerts, discovery latency metrics, and secret scanning before tool descriptions and schemas enter the agent context.
[Usage] Integration is divided into local and remote:
- Claude Desktop configuration (stdio)
- Remote Streamable HTTP (Glama / hosted): requires public HTTPS + streamable-http, with the local default address being http://127.0.0.1:8787/mcp（健康检查：GET /health), and production must use HTTPS. The Cursor / Claude remote connector uses the same url + Authorization header; unauthenticated access to /mcp returns HTTP 401, and provider keys such as LLM_API_KEY remain server-side and are not echoed back.
- Deploy to Vercel (public HTTPS): stateless Streamable HTTP (JSON request/response) running on Vercel Fluid Compute, with no sticky sessions. After deployment, the MCP endpoint is https://$VERCEL_PROJECT_PRODUCTION_URL/mcp（特定部署用 VERCEL_URL), and the health check is https://$VERCEL_PROJECT_PRODUCTION_URL/health。需关闭生产主机上的 Vercel Deployment Protection, otherwise Glama/clients cannot complete initialize.
- Slack integration: add the Slack app manifest, enable Agent Builder, and @CodeHealth in any channel to trigger analysis. The demo workspace is codehealthdemo.slack.com, and the CodeSentinel agent (App ID A0BEHRDN5TQ) is installed and authorized.
[Data scanning method] Daytona sandbox scanning can optionally be enabled: set DAYTONA_API_KEY (a separate GITHUB_TOKEN can be set for private repositories), and the MCP tools and Slack analysis will shallow-clone the GitHub URL in a Daytona VM and return live import graph findings rather than demo data. When Daytona is unavailable or live scanning times out (SCAN_DEADLINE_MS in lib/repo-fetcher.js), lib/analysis-engine.js marks the request as fallback: true, and the analyzer returns deterministic demo findings; this is a documented, intentional fallback behavior rather than a silent error; live scans are marked scanMode: "daytona".
[Extension and project structure] Custom analyzers follow a simple interface: add a new analyzer under lib/analyzers/ and register it in analysis-engine.js, and it automatically becomes available in Slack and MCP. The project structure includes real AST analysis (ts-morph for TypeScript, tree-sitter for multiple languages), a GitHub App (automatic PR analysis with inline comments), historical trends (tracking health scores by repository), custom architecture rules (defining layer boundaries via configuration), team dashboards (aggregating health in Slack Canvas), and more.
[Availability notes] The project uses the MIT license (see LICENSE). It is known to appear in directories such as awesome-mcp-servers, MCP Registry, and Glama. The Slack assistant flow (listeners/assistant/message.js) performs a deterministic scan (runAnAfter alysis), it requests the AI to execute a summary (lib/llm-provider.js); the summarization step now runs a bounded degradation ladder (FULL → DEGRADED) via summarizeWithLadder, and explicitly degrades when the LLM is unavailable—findings are still delivered alongside it, but with the inline annotation "AI summary unavailable — LLM unreachable. Deterministic findings only"; LLMUnavailableError is still retained as a typed failure for other cases, and non-unavailable errors still fail explicitly. Test coverage is in test/assistant-degradation.test.js. When the analysis path itself becomes model-dependent (model-scored findings rather than model-summarized reports), this degradation ladder needs to be re-examined and extended.
