MCP Server

​

Prerequisites

• A CodeAnt AI account. The cloud security and pentest tools return data only if your organization uses those CodeAnt AI products.
• CodeAnt CLI 0.5.10 or later and Node.js 18 or later. Skip this if you use the Claude Desktop extension, which doesn’t need either.
  npm install -g codeant-cli@latest
  codeant --version
  
• For the pull request and comment tools, a token for your Git provider. See Pull request tools.

​

Install

claude mcp add --scope user --transport stdio codeant -- codeant mcp

/plugin marketplace add CodeAnt-AI/codeant-cli
/plugin install codeant@codeant-cli

{
  "mcpServers": {
    "codeant": {
      "command": "codeant",
      "args": ["mcp"]
    }
  }
}

{
  "mcpServers": {
    "codeant": {
      "command": "codeant",
      "args": ["mcp"]
    }
  }
}

{
  "servers": {
    "codeant": {
      "type": "stdio",
      "command": "codeant",
      "args": ["mcp"]
    }
  }
}

code --add-mcp '{"name":"codeant","command":"codeant","args":["mcp"]}'

{
  "mcpServers": {
    "codeant": {
      "command": "codeant",
      "args": ["mcp"]
    }
  }
}

{
  "context_servers": {
    "codeant": {
      "command": "codeant",
      "args": ["mcp"],
      "env": {}
    }
  }
}

codex mcp add codeant -- codeant mcp

[mcp_servers.codeant]
command = "codeant"
args = ["mcp"]

{
  "mcpServers": {
    "codeant": {
      "command": "codeant",
      "args": ["mcp"]
    }
  }
}

​

Authenticate

1. CODEANT_API_TOKEN in the MCP server’s environment, including the desktop extension’s CodeAnt API token setting.
2. The token saved in ~/.codeant/config.json by codeant login, codeant set-codeant-api-key, or the codeant_login tool. The server reads this file on every request, so signing in or out in a terminal takes effect without restarting the client.

​

Tools

​

Example agent requests

• “List my repositories, then show critical SAST findings for the API repository.”
• “Show the ten highest-priority Hotlist findings.”
• “Show failing high-severity checks from the latest AWS CSPM scan.”
• “Fetch this Hotlist finding by its stable ID and explain the remediation.”
• “List the open issues in the latest pentest engagement.”
• “Review my staged changes with CodeAnt.” This needs a client that starts the server in your repository, such as Claude Code.

​

Configuration reference

"codeant": {
  "command": "codeant",
  "args": ["mcp"],
  "env": {
    "GITHUB_TOKEN": "<your GitHub token>"
  }
}

​

Pull request tools

​

Working directory and repository detection

• Claude Code starts the server in your project, so both work without extra parameters.
• Claude Desktop, with the extension or a manual configuration, starts it outside your projects. Pass name (owner/repo) and remote (github, gitlab, bitbucket, or azure) to the pull request tools. Local review isn’t available.
• Other clients: ask the agent to run codeant_review_local. If it returns Could not find a .git directory, the client starts the server outside your repository. Pass name and remote to the pull request tools, and run codeant review in a terminal for local review.
• Azure DevOps: always pass name as project/repo. Detection from Azure DevOps remote URLs doesn’t produce that form.

​

Self-hosted CodeAnt AI

​

Enable write tools

"env": {
  "CODEANT_READ_ONLY": "0"
}

claude mcp remove --scope user codeant
claude mcp add --scope user -e CODEANT_READ_ONLY=0 --transport stdio codeant -- codeant mcp

​

Approve tools automatically

{
  "permissions": {
    "allow": [
      "mcp__codeant__codeant_scans_orgs",
      "mcp__codeant__codeant_scans_repos",
      "mcp__codeant__codeant_scans_results",
      "mcp__codeant__codeant_hotlist_list"
    ]
  }
}

​

Results and paging

• One page per call. Most list tools return a total and take limit and offset, but some differ: the Hotlist uses cursor and next_cursor, codeant_pr_list returns no total, and codeant_scans_history takes no offset. See each tool in the MCP tool reference for its paging fields.
• Small default page sizes:

  Tool	Default page size
  codeant_scans_repos	100 repositories
  codeant_scans_results	50 findings
  codeant_hotlist_list	10 findings
  codeant_findings_antipatterns	25 findings
  codeant_cloud_findings_list	25 findings
  codeant_cloud_scan_history	10 newest scans per provider
  codeant_pentest_history	25 newest engagements

• Slim records. Repository lists, cloud scan history, cloud findings, and pentest history leave out bulky fields such as raw provider metadata, per-service rollups, compliance mappings, and billing details. Pass full: true to include them.
• Size limit. The server refuses any result over 80,000 characters (about 20,000 tokens) and returns a hint for narrowing the request. If your client accepts larger results, raise CODEANT_MCP_MAX_RESULT_CHARS in the server’s environment. In Claude Code, also start Claude Code with a higher MAX_MCP_OUTPUT_TOKENS, for example MAX_MCP_OUTPUT_TOKENS=50000 claude. The desktop extension doesn’t have a setting for the limit.

​

Privacy and telemetry

• Tools send requests to the CodeAnt API with your token. The pull request tools call your Git provider directly.
• codeant_review_local sends the diff and the full current contents of each changed file to CodeAnt for review. While reviewing, CodeAnt can also read, list, and search other files in the repository for context. The tool never modifies files.
• Local reviews send usage events to PostHog. The events are tied to your CodeAnt API token and can include review error messages. To turn them off, set CODEANT_TELEMETRY_DISABLED=1 in the server’s environment, run codeant set-telemetry false (not in the desktop extension), or enable Disable telemetry in the desktop extension.

​

Troubleshooting

npx @modelcontextprotocol/inspector codeant mcp