CodeTrail (guanjen375/CodeTrail) is an MCP server listed on the M8ven Trust Index. M8ven has not graded it: we have no way to read this server ourselves. No publisher has claimed this listing.

Back to MCP Trust Indexm8ven
C
Emerging
74/100
21 min ago

CodeTrail

CodeTrail

→ guanjen375/CodeTrail· listed on github_code

Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

guanjen375

Source: github_code

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

GitHub

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configPYTHONIOENCODING
configAICODE_ROOT6. CodeTrail 沙箱鎖在「你啟動的那個資料夾」() —— 綁在 process 上,不會跟著你在 UI 切資料夾或切對話而移動。web UI 那顆「切換資料夾」按鈕對 CodeTrail 無效(切過去還是只讀啟動目錄)。換專案 = 到那個目錄重新啟動一個(TUI 重開 aicode;web 另起一個 backend)。
configAI_CODE_ALLOW_HOME_ROOT
configAICODE_MODEL讓 =<CODE_MODEL> 這種短名稱自動對應到實際 GGUF 路徑,不用每次打絕對路徑:
configAICODE_DYNAMIC_NUM_CTX_MAX
configAICODE_N_CTX
configAICODE_NUM_CTX
configXDG_STATE_HOME
configAICODE_MODEL_REMOTE_OK
configAICODE_LLAMA_BASE_URL
configMAIN_SESSION
configSESSION
configAUX_SESSION
configAICODE_H_LANG
configAICODE_VL_ANALYZE_MAX_TOKENS
configAICODE_VL_INGEST_MAX_TOKENS
configAICODE_VL_ANALYZE_TIMEOUT
configAICODE_VL_INGEST_TIMEOUT
configAICODE_RESERVED_OUTPUT_TOKENS
configAICODE_CTX_SOFT_THRESHOLD
configAICODE_CTX_HARD_THRESHOLD
configAICODE_CTX_GATE_ENABLED
configAICODE_CTX_METRICS_ENABLED
configAICODE_CTX_METRICS_PATH
configAI_CODE_ALLOW_EXTERNAL_IMPORT
configAI_CODE_IMPORT_ROOTS來源白名單()等細節見 [docs/basic-usage.md](docs/basic-usage.md)。第一次先照上面最短的指令跑起來就好。
configAI_CODE_EXTERNAL_IMPORT_DIR
configAI_CODE_EXTERNAL_IMPORT_MAX_MB
configAICODE_KB_CONTEXT_TARGET_TOKENS
configAICODE_KB_CONTEXT_REASONING_TOKENS
configAICODE_KB_CONTEXT_TIMEOUT
configAICODE_KB_CONTEXT_WINDOW_SAFETY
configAICODE_KB_CONTEXT_MAX_ABSENT_RATIO
configAICODE_RERANK_FALLBACK_POLICY只控制啟動後 reranker 呼叫失敗時的行為;啟動前 preflight 仍要求 reranker server ready:
configAICODE_CODE_RAG_REFRESH_TTL
configAICODE_CODE_RAG_CONTEXT_STORE_MAX_CHARS
configAICODE_CODE_RAG_COMMENT_MAX_CHARS
configAICODE_CODE_RAG_DOCSTRING_MAX_CHARS
configAICODE_CODE_RAG_EMBED_TEXT_MAX_CHARS
configAICODE_CODE_RAG_LEXICAL_SCAN_MAX_CHARS
configAICODE_CODE_RAG_LEXICAL_MAX_IDENTIFIERS
configAICODE_CODE_RERANK_PASSAGE_MAX_CHARS
configAICODE_CODE_RAG_RERANK_CANDIDATE_POOL
configAICODE_EMBED_BATCH_SIZE
configAICODE_EMBED_BATCH_MAX_CHARS
configAICODE_CHAT_TOP_P
configAICODE_CHAT_TOP_K
configAICODE_CHAT_MIN_P
configAI_CODE_PATCH
configAI_CODE_RUN_TESTS
configAI_CODE_USE_CONTAINER
configAI_CODE_CONTAINER_ENGINE
configAI_CODE_CONTAINER_IMAGE
configAI_CODE_CONTAINER_MEMORY
configAI_CODE_CONTAINER_CPU
configAI_CODE_CONTAINER_TIMEOUT
configAI_CODE_COLLECT_DATA
configAI_CODE_DATA_FILE
configLLAMA_BIN固定 clone 到 ~/llama.cpp —— launcher 預設找 ~/llama.cpp/build/bin/llama-server(放別處要設 ):
configAICODE_OBJDUMP
configEXPECTED_LLAMA_SERVERS
configAICODE_STATUS_PROC_ROOT
configAICODE_STATUS_SNAPSHOT
configAICODE_CTX_SAFETY_DISABLE
configAICODE_ACCEPT_CTX_RISK
configAICODE_TOOL_CANARY_TTL_SECONDS
configOPENCODE_CONFIG/其他位置/opencode.json，set_config.sh、aicode 與健檢都會改讀／改寫
configAICODE_COMPACTION_STATE
configAICODE_PROFILE
configAICODE_LESSONS_SKIP
configOPENCODE_DISABLE_PROJECT_CONFIG
configMODELS_DIR模型統一放 ~/models(set_config.sh 預設掃這裡;放別處用 或 --models-dir 指定)。
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

19/19 tools missing one or more hints — query_knowledge (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); query_knowledge_strict (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); code_rag_search (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +16 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/guanjen375-codetrail-lk1kxc)](https://m8ven.ai/mcp/guanjen375-codetrail-lk1kxc)
Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.
commit: b31098a979f87c7fa9fe57fadcf9e75ae62032c9
code hash: 22da3de34246f8cefb8638864d24b6a9fa34590529aee1667250f15d4ab8c99f
verified: 9/2/2026, 6:50:29 PM
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client