54
/ 100
1 month ago
glama

CodeCompass

Helps developers tackle legacy codebases by giving AI coding assistants context through Qdrant vector store and Agentic RAG with Ollama or DeepSeek.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Known vulnerabilities in dependencies: 1 critical, 16 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 4 credentials: CLAUDE_API_KEY, DEEPSEEK_API_KEY, GEMINI_API_KEY, OPENAI_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies1 critical16 high14 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalvitest@3.1.4GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

high@modelcontextprotocol/sdk@1.12.1GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.12.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.12.1GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highaxios@1.9.0GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configAGENT_ABSOLUTE_MAX_STEPS: Absolute maximum number of steps the agent can take, even if it requests more. Default: 15
configAGENT_DEFAULT_MAX_STEPS: Default maximum number of steps (tool calls or LLM responses) the agent will take. Default: 10
configAGENT_MAX_CONTEXT_ITEMS
configAGENT_QUERY_TIMEOUT: Timeout in milliseconds for agent's LLM reasoning steps. Default: 180000 (3 minutes)
🔐 secretCLAUDE_API_KEY: Your API key for Anthropic Claude.
configCODECOMPASS_FORCE_SRC_PATHS_FOR_TESTING
configCODECOMPASS_INTEGRATION_TEST_MOCK_LLM
configCODECOMPASS_INTEGRATION_TEST_MOCK_QDRANT
configCOLLECTION_NAME: Name of the Qdrant collection for this repository.
configCOMMIT_HISTORY_MAX_COUNT_FOR_INDEXING
🔐 secretDEEPSEEK_API_KEYexport ="your_deepseek_api_key_here"
configDEEPSEEK_API_URL: Custom API URL for DeepSeek if not using the default.
configDEEPSEEK_MODEL
configDEEPSEEK_RPM_LIMIT: Requests per minute limit for DeepSeek. Default: 20
configDIFF_CHUNK_OVERLAP_CHARS
configDIFF_CHUNK_SIZE_CHARS
configDIFF_LINES_OF_CONTEXT
configEMBEDDING_DIMENSION
configEMBEDDING_MODEL: The specific model to use for embeddings via Ollama.
configEMBEDDING_PROVIDER: Specifies the provider for generating embeddings.
configFILE_INDEXING_CHUNK_OVERLAP_CHARS: Overlap between chunks when indexing large files (in characters). Default: 200
configFILE_INDEXING_CHUNK_SIZE_CHARS: Target size for chunks when indexing large files (in characters). Default: 1000
configFORCE_PROVIDER_AVAILABLE
configFORCE_PROVIDER_UNAVAILABLE
🔐 secretGEMINI_API_KEY: Your API key for Google Gemini.
configHTTP_PORTport <number> (optional): Specify the HTTP port for the server. This overrides the environment variable and the default port (3001).
configLLM_PROVIDERexport ="deepseek"
configLOG_LEVEL: Logging level (e.g., error, warn, info, verbose, debug, silly). Default: info
configMAX_DIFF_LENGTH_FOR_CONTEXT_TOOL: Maximum length of a git diff to include in context without summarization.
configMAX_DIR_LISTING_ENTRIES_FOR_CAPABILITY
configMAX_FILES_FOR_SUGGESTION_CONTEXT_NO_SUMMARY: Maximum number of files to list directly in the generate_suggestion tool's context
configMAX_FILE_CONTENT_LENGTH_FOR_CAPABILITY
configMAX_REFINEMENT_ITERATIONS: Maximum number of iterations for query refinement. Default: 3
configMAX_SNIPPET_LENGTH_FOR_CONTEXT_NO_SUMMARY: Maximum length of a code snippet to include in context without summarization.
configOLLAMA_HOST: URL for the Ollama server.
🔐 secretOPENAI_API_KEY: Your API key for OpenAI.
configQDRANT_BATCH_UPSERT_SIZE
configQDRANT_HOST: URL for the Qdrant vector store server.
configQDRANT_SEARCH_LIMIT_DEFAULT: Default number of results to fetch from Qdrant during standard searches. Default: 10
configREFINEMENT_MODEL: LLM model to use for LLM-powered query refinement.
configREQUEST_ADDITIONAL_CONTEXT_MAX_SEARCH_RESULTS: Number of search results to fetch when agent uses 'request_additional_context' with type 'MORE_SEARCH_RESULTS'. Default: 20
configSIMULATE_EADDRINUSE_FOR_PROXY_SUITE_LISTEN
configSIMULATE_EADDRINUSE_FOR_TEST
configSKIP_QDRANT_INIT
configSUGGESTION_MODEL: The specific model to use for suggestions.
configSUGGESTION_PROVIDER
configSUMMARIZATION_MODEL: LLM model to use for summarization tasks (e.g., long diffs, long snippets).
configTEST_PROVIDER_UNAVAILABLE
configUSE_MIXED_PROVIDERS
configVITEST
configVITEST_TESTING_FAIL_HANDLER
configVITEST_WORKER_ID
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/alvinveroy-codecompass-xviesm)](https://m8ven.ai/mcp/alvinveroy-codecompass-xviesm)
commit: dade89cf1c863c73d7c5195bf27c0a30162fd885
code hash: 9ea0ab24bfca286b36a8eef90fda8f49b243d600bcc5ae5e44a939379f091eb9
verified: 6/11/2026, 11:59:40 AM
view raw JSON →