Moltline Code Review

com.moltlinestudio/codereviewVersion 1.2.0

Risk-scan a diff, flag AI-generated-code tells, find secrets. 5 of 7 tools need no account.

Status

Responds228 msNov 14, 2026, 14:11 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 14:11 UTC
Latency: 228 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 22:14 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://mcp.moltlinestudio.com/codereviewResponds228 msNov 14, 2026, 14:11 UTC

No sign-in

Claude Code

claude mcp add --transport http codereview https://mcp.moltlinestudio.com/codereview

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: codereview
Remote MCP server URL: https://mcp.moltlinestudio.com/codereview

Cursor

{
  "mcpServers": {
    "codereview": {
      "url": "https://mcp.moltlinestudio.com/codereview"
    }
  }
}

VS Code

code --add-mcp '{"name":"codereview","type":"http","url":"https://mcp.moltlinestudio.com/codereview"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

7 tools

Tools of Moltline Code Review
	Description		Read-only	Idempotent	Open world
`ai_code_smell_scan`Flag the tells of unreviewed AI-generated code in a source file. FREE. Detects comments that restate the next line, leaked assistant preambles, placeholder TODOs, shipped 'Example usage' blocks, over-broad try/except that swallows errors, and auto-named identifiers. Typical input {"code": "<file contents>"} returns {"reviewed_confidence": 0-100, "hits": [{"smell": "...", "evidence": "<quoted snippet>"}], "reading": "...", "note": "..."}. Use on a full source file suspected of unreviewed machine authorship. Not on a diff (review_diff), and the result is a signal to check, not proof of authorship. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.	Flag the tells of unreviewed AI-generated code in a source file. FREE. Detects comments that restate the next line, leaked assistant preambles, placeholder TODOs, shipped 'Example usage' blocks, over-broad try/except that swallows errors, and auto-named identifiers. Typical input {"code": "<file contents>"} returns {"reviewed_confidence": 0-100, "hits": [{"smell": "...", "evidence": "<quoted snippet>"}], "reading": "...", "note": "..."}. Use on a full source file suspected of unreviewed machine authorship. Not on a diff (review_diff), and the result is a signal to check, not proof of authorship. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.	No	Yes	Yes	No
`complexity_report`Report structural complexity of a source file, function by function. FREE. Measures per-function length, max nesting depth, and a cyclomatic-style branch count (if/for/while/case/&&/\|\|/except), flagging functions too long or too deeply nested to review confidently. Typical input {"code": "<file contents>"} returns {"functions": N, "detail": [{"name": ..., "start": N, "lines": N, "branches": N, "max_depth": N}], "flags": ["..."], "note": "..."}. Use when structure rather than correctness is the question. Not for vulnerabilities (security_deep_dive). Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.	Report structural complexity of a source file, function by function. FREE. Measures per-function length, max nesting depth, and a cyclomatic-style branch count (if/for/while/case/&&/\|\|/except), flagging functions too long or too deeply nested to review confidently. Typical input {"code": "<file contents>"} returns {"functions": N, "detail": [{"name": ..., "start": N, "lines": N, "branches": N, "max_depth": N}], "flags": ["..."], "note": "..."}. Use when structure rather than correctness is the question. Not for vulnerabilities (security_deep_dive). Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.	No	Yes	Yes	No
`get_reviewer_persona`Load the Senior Reviewer persona for consistent, high-signal reviews. PREMIUM (license). The persona is a reviewing voice that is skeptical, specific, and kind: demands evidence over vibes and blocks only on real risk. Takes no arguments. Returns {"persona": ..., "identity": ..., "rules": ["...", ...], "opening_move": "..."} ready to adopt as a system prompt. Use to keep repeated reviews consistent in voice and rigor. Not for running a review - the scan tools do that. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.	Load the Senior Reviewer persona for consistent, high-signal reviews. PREMIUM (license). The persona is a reviewing voice that is skeptical, specific, and kind: demands evidence over vibes and blocks only on real risk. Takes no arguments. Returns {"persona": ..., "identity": ..., "rules": ["...", ...], "opening_move": "..."} ready to adopt as a system prompt. Use to keep repeated reviews consistent in voice and rigor. Not for running a review - the scan tools do that. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.	No	Yes	Yes	No
`review_checklist`Produce a focused pull-request review checklist for a language or stack. FREE. Covers the things that actually break in production, with extra items per language. Typical input {"language": "python"} returns {"language": "python", "checklist": ["...", ...], "note": "..."}. Use before a review, to decide what to look for. Not for reviewing actual code - pass code to review_diff or security_deep_dive. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.	Produce a focused pull-request review checklist for a language or stack. FREE. Covers the things that actually break in production, with extra items per language. Typical input {"language": "python"} returns {"language": "python", "checklist": ["...", ...], "note": "..."}. Use before a review, to decide what to look for. Not for reviewing actual code - pass code to review_diff or security_deep_dive. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.	No	Yes	Yes	No
`review_diff`Risk-scan a unified diff the way a senior reviewer triages a PR. FREE. Flags added lines matching known risk patterns (injection sinks, disabled TLS, downloads piped into a shell, credential-store reads, broad deletes, persistence, bare excepts, debug prints, TODOs, N+1 hints, leaked secrets) with the new-file line number and a severity (1 low - 4 high). Typical input {"diff": "<git diff output>"} returns {"added_lines": N, "risk_score": 0-100 (100 = no risky pattern found; lower = riskier), "verdict": "...", "secrets": [...], "findings": [{"line": N, "severity": 1-4, "issue": "...", "code": "..."}], "note": "..."}. Use on a unified diff, when only the change matters. Not for whole-file analysis (complexity_report, ai_code_smell_scan). Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.	Risk-scan a unified diff the way a senior reviewer triages a PR. FREE. Flags added lines matching known risk patterns (injection sinks, disabled TLS, downloads piped into a shell, credential-store reads, broad deletes, persistence, bare excepts, debug prints, TODOs, N+1 hints, leaked secrets) with the new-file line number and a severity (1 low - 4 high). Typical input {"diff": "<git diff output>"} returns {"added_lines": N, "risk_score": 0-100 (100 = no risky pattern found; lower = riskier), "verdict": "...", "secrets": [...], "findings": [{"line": N, "severity": 1-4, "issue": "...", "code": "..."}], "note": "..."}. Use on a unified diff, when only the change matters. Not for whole-file analysis (complexity_report, ai_code_smell_scan). Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.	No	Yes	Yes	No
`secret_scan`Scan text for accidentally-committed machine credentials and private-key material. FREE. Reports each match's location and category so it can be rotated before it leaks. Detection is pattern-based over the common leaked-credential formats; it never echoes the matched value back. Typical input {"text": "<file, diff, or config contents>"} returns {"leaked": bool, "count": N, "findings": [{"line": N, "type": "<category>"}], "note": "..."}. Pattern matching only - a clean result is not proof, and every hit needs human confirmation before anyone acts on it. Not a general security review (security_deep_dive). Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.	Scan text for accidentally-committed machine credentials and private-key material. FREE. Reports each match's location and category so it can be rotated before it leaks. Detection is pattern-based over the common leaked-credential formats; it never echoes the matched value back. Typical input {"text": "<file, diff, or config contents>"} returns {"leaked": bool, "count": N, "findings": [{"line": N, "type": "<category>"}], "note": "..."}. Pattern matching only - a clean result is not proof, and every hit needs human confirmation before anyone acts on it. Not a general security review (security_deep_dive). Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.	No	Yes	Yes	No
`security_deep_dive`Run an OWASP-oriented security pass over a source file. PREMIUM (license). Checks injection sinks, auth/session handling, crypto misuse, SSRF/deserialization, and unsafe file/path handling. Each finding cites the line, the OWASP risk class, and a concrete fix direction. Typical input {"code": "<file contents>"} returns {"issues": N, "findings": [{"line": N, "class": "A03 Injection", "fix": "...", "code": "..."}], "owasp_note": "..."}. Use on one source file when vulnerabilities are the question. Not for style or structure (complexity_report), and never a substitute for a security professional on high-risk code. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.	Run an OWASP-oriented security pass over a source file. PREMIUM (license). Checks injection sinks, auth/session handling, crypto misuse, SSRF/deserialization, and unsafe file/path handling. Each finding cites the line, the OWASP risk class, and a concrete fix direction. Typical input {"code": "<file contents>"} returns {"issues": N, "findings": [{"line": N, "class": "A03 Injection", "fix": "...", "code": "..."}], "owasp_note": "..."}. Use on one source file when vulnerabilities are the question. Not for style or structure (complexity_report), and never a substitute for a security professional on high-risk code. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.	No	Yes	Yes	No

Details

Registry status: Active
Published: Sep 8, 2026
Updated: Sep 8, 2026
Website: https://moltlinestudio.com/servers.html#codereview⁠ (opens in a new tab)
Repository: https://github.com/GarphenGate/moltline-mcp⁠ (opens in a new tab)
Categories (suggested): SecuritySuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing