Code Assistant MCP Server for Trusted Repositories

Overview

This MCP (Model Context Protocol) server provides a local code-assistant backend for exploring and modifying code in one or more trusted repositories. It exposes an MCP-compatible API that lets an LLM-driven agent introspect files, run repository-aware searches, propose and apply patches, and keep a consistent workspace state. The server is intended as a developer tool to integrate LLMs into code workflows while keeping model actions bounded to repository contents.

Because the server executes repository operations on behalf of a model-driven agent, it does not attempt to fully sanitise or harden prompts against sophisticated prompt-injection attacks. For that reason, you should run the server only with repositories and models that you explicitly trust, and in controlled network environments.

Features

• Repository-aware workspace management (clone, sync, checkout)
• File read and patch application APIs (view, diff, apply)
• Search and symbol indexing for fast code navigation
• Session-based context for multi-step model interaction
• Simple access controls and repository whitelisting
• CLI and HTTP endpoints for automation and tooling integration
• Designed to integrate with MCP-compatible agents / clients

Installation / Configuration

Clone the repository and install dependencies. The project uses Node.js in this example.

git clone https://github.com/stippi/code-assistant.git
cd code-assistant
npm install

Start the server in development mode:

export NODE_ENV=development
npm run dev

Build and run in production:

npm run build
NODE_ENV=production node ./dist/server.js

Docker example:

docker build -t code-assistant .
docker run -p 8080:8080 \
  -e PORT=8080 \
  -e REPO_WHITELIST="github.com/your-org/your-repo" \
  code-assistant

Common environment variables

Configuration file (optional)

{
  "port": 8080,
  "workDir": "./workspaces",
  "repoWhitelist": ["github.com/your-org/your-repo"],
  "sessionTtl": 3600,
  "logLevel": "info"
}

Available Tools / Resources

The server exposes several built-in tools intended to be called by an MCP-capable agent:

• file.read: Read a file from a repository workspace
  • Input: repo, path, commitish (optional)
  • Output: file contents, metadata
• file.patch: Apply a unified-diff style patch to a file or set of files
  • Input: repo, patch (unified diff)
  • Output: success/failure, new commit hash
• repo.list: List configured/whitelisted repositories
• repo.clone: Clone or update a repository to the local workspace
• repo.checkout: Checkout a branch/commit
• search.code: Search codebase by pattern, regex or symbols
  • Output: snippets, file paths, line numbers
• session.open / session.close: Manage model interaction sessions with context

API examples (HTTP)

Read a file:

curl -X POST http://localhost:8080/mcp/file.read \
  -H "Content-Type: application/json" \
  -d '{"repo":"github.com/your-org/your-repo","path":"src/index.js"}'

Apply a patch:

curl -X POST http://localhost:8080/mcp/file.patch \
  -H "Content-Type: application/json" \
  -d '{"repo":"github.com/your-org/your-repo","patch":"--- a/src/old.js\n+++ b/src/old.js\n@@ -1,3 +1,4 @@\n+// new line\n ..."}'

Use Cases

• Exploratory code understanding
  • Open a session, use file.read and search.code to let an LLM build a model of a codebase. Useful for onboarding or quickly answering architecture questions.
• Automated refactoring
  • Have the model propose a set of patches (file.patch) to modernize API usage, rename identifiers, or introduce patterns across files, then review and apply them.
• Pull-request generation
  • Generate a branch with a set of changes, create a commit via file.patch, and push the branch externally (push must be performed by a separate, guarded process).
• Targeted bug fixes
  • Given a failing test or bug report, allow the model to inspect failing files, propose fixes, and run test commands externally to validate patches.
• Code review augmentation
  • Use the server to fetch diffs and present them to the model for summarization and checklist generation.

Concrete example: Add a missing null check

1. Use search.code to find potential call sites.
2. Use file.read to fetch the offending file.
3. Ask the model to produce a unified diff that adds a guard clause.
4. Submit the diff to file.patch and evaluate locally.

Security and Best Practices

• Only add repositories you fully trust to REPO_WHITELIST. The server intentionally provides capabilities that can modify code.
• Run the server on a private network or developer machine; do not expose it to untrusted public networks.
• Use session TTLs and logging to audit model-driven actions.
• Consider human review workflows before pushing changes back to remote repositories.

For the latest source and issues, see the GitHub repository: https://github.com/stippi/code-assistant.