jgravelle/jcodemunch-mcp
Symbol-level code retrieval for AI agents: fetch the function you need, not the whole file. Runs locally. 96.2% fewer tokens per lookup on average than grep-and-read on our 15-lookup benchmark. Works with Claude Code, Cursor, Codex and any MCP client. Free for non-commercial use; commercial use needs a one-time license.
- Repository: https://github.com/jgravelle/jcodemunch-mcp
- Commit:
30bbeb96a5a18dacdf0b49934397cde6b9283232 - Generated: 2026-11-14T00:10:05+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 86 | explicit | 95% | 100% |
| Code quality | 71 | adequate | 90% | 100% |
| Security | 75 | adequate | 85% | 100% |
AI provenance
Explicit AI attribution on 86% of first-party code added; an estimated 86% including velocity signals.
- Explicitly attributed share (lower bound): 85.5%
- Unattributed share in AI-consistent velocity bursts: 5.3%
- Estimated AI-generated share: 85.5%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 1,929 | 404,728 |
| OpenAI Codex | 13 | 3,540 |
| GitHub Copilot coding agent | 2 | 0 |
- AI tooling configured in repo: claude-code, generic-agent
Current source lines last changed by AI-attributed commits: 159,395 of 190,354.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 1.092 | 0.84 | 1.3x |
| Security | 0.684 | 0.808 | 0.85x |
- Stylometry index: 3.60 per 1,000 lines (narrated steps 18, placeholders 0, assistant phrasing 0, emoji 1097). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-02 | 5,859 | 44% |
| 2026-03 | 57,683 | 71% |
| 2026-04 | 74,403 | 82% |
| 2026-05 | 35,026 | 23% |
| 2026-06 | 14,187 | 100% |
| 2026-07 | 39,455 | 95% |
| 2026-08 | 63,858 | 97% |
| 2026-09 | 74,931 | 100% |
| 2026-10 | 73,328 | 94% |
| 2026-11 | 36,754 | 100% |
Evidence
- Claude Code: trailer 'Co-Authored-By: Claude' (30bbeb96a5a1)
- Claude Code: trailer 'Co-authored-by: Claude' (9811f30e58c3)
- Claude Code: trailer 'Co-Authored-By: Claude' (dcacf92cd111)
- Claude Code: trailer 'Co-authored-by: Claude' (eea6882828d0)
- Claude Code: trailer 'Co-authored-by: Claude' (dae7d010a2d3)
- Claude Code: trailer 'Co-Authored-By: Claude' (aa4271452ff6)
- Claude Code: trailer 'Co-Authored-By: Claude' (fad0a4f36897)
- Claude Code: trailer 'Co-authored-by: Claude' (07c1af2ed54e)
- Claude Code: trailer 'Co-authored-by: Claude' (0924d5f0f571)
- Claude Code: trailer 'Co-Authored-By: Claude' (8c7cb527df16)
- Claude Code: trailer 'Co-Authored-By: Claude' (197661324954)
- Claude Code: trailer 'Co-authored-by: Claude' (f7e9140da4c9)
- Claude Code: trailer 'Co-authored-by: Claude' (eab9c46d3dc9)
- Claude Code: trailer 'Co-authored-by: Claude' (05c7fb69817c)
- Claude Code: trailer 'Co-Authored-By: Claude' (add647389eb4)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 1.32, CI runs tests; 44% of function code in complex or long functions; 5% duplicated lines. Weakest area: complexity.
| Area | Score |
|---|---|
| Complexity (lizard) | 27 |
| Duplication | 72 |
| Code smells (Opengrep) | 70 |
| Tests and CI | 100 |
| Documentation | 100 |
| Type safety | 40 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 5,078; mean complexity 6.9, 90th percentile 14; 430 complex and 118 long functions
- Duplicated lines: 5.5% of 152,403 compared
- Tests: 250,942 test lines for 190,354 source lines (ratio 1.32); CI test commands: pytest; 99% of recent source commits also change tests
- Docs missing or thin: none
Most complex functions:
- index_folder in src/jcodemunch_mcp/tools/index_folder.py: complexity 362, 1462 lines
- _call_tool_impl in src/jcodemunch_mcp/server.py: complexity 298, 1628 lines
- main in src/jcodemunch_mcp/server.py: complexity 219, 2008 lines
- _run_config in src/jcodemunch_mcp/server.py: complexity 146, 494 lines
- run_init in src/jcodemunch_mcp/cli/init.py: complexity 136, 318 lines
Security
Security posture is adequate: 3 known vulnerabilities in 2 dependencies; 87 high-severity SAST findings; 24 high-severity workflow issues. Weakest area: ci actions.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 88 |
| Static analysis (Opengrep) | 86 |
| Vulnerable dependencies (OSV) | 90 |
| CI workflows (zizmor) | 1 |
| Posture (policy, updates, signing, lockfiles) | 100 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 3 in 2 packages (critical 0, high 0, medium 3, low 0)
-
Posture checks passed: security policy, dependency updates, signed commits; missing: lockfiles
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
.claude/hooks/_common.py:521 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
.claude/hooks/dod_checklist.py:519 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
.github/inbound/apply_depeval.py:112 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
.github/inbound/killswitch.py:43 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
.github/inbound/selfcheck.py:114 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
benchmarks/ab-kit/run_lookups.py:41 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
benchmarks/ab-kit/run_lookups.py:193 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
benchmarks/ab-kit/run_lookups.py:263 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
benchmarks/ab-kit/run_lookups.py:270 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args: Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] |
benchmarks/ab-kit/run_lookups.py:270 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
benchmarks/ab-kit/run_retrieval.py:31 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args: Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] |
benchmarks/ab-kit/run_retrieval.py:31 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
benchmarks/ab-kit/run_retrieval.py:34 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args: Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] |
benchmarks/ab-kit/run_retrieval.py:34 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
benchmarks/codex_surface/run_codex_arms.py:178 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
benchmarks/codex_surface/run_codex_arms.py:227 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
benchmarks/codex_surface/run_codex_arms.py:303 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
benchmarks/codex_surface/run_codex_arms.py:424 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
benchmarks/competitive/adapters/jcodemunch.py:125 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
benchmarks/competitive/run.py:106 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
benchmarks/competitive/sandbox.py:200 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
benchmarks/competitive/sandbox/mcp_driver.py:44 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
benchmarks/harness/run_benchmark.py:543 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
benchmarks/rust_fidelity/run_fidelity.py:106 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
benchmarks/self_latency/measure.py:144 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release v1.108.444 ships jcodemunch_mcp-1.108.444.tar.gz (2 downloads)
- binary-release-asset: release v1.108.443 ships jcodemunch_mcp-1.108.443.tar.gz (2 downloads)
- binary-release-asset: release v1.108.442 ships jcodemunch_mcp-1.108.442.tar.gz (1 downloads)
- binary-release-asset: release v1.108.441 ships jcodemunch_mcp-1.108.441.tar.gz (1 downloads)
- binary-release-asset: release v1.108.440 ships jcodemunch_mcp-1.108.440.tar.gz (2 downloads)
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 190,354; test lines: 250,942
| Language | Lines |
|---|---|
| Python | 424,859 |
| SQL | 13,613 |
| TypeScript | 866 |
| Rust | 613 |
| PowerShell | 370 |
| C# | 209 |
| Shell | 195 |
| PHP | 192 |
| Go | 78 |
| Elixir | 56 |