// SCAN REPORT

Code MCP Server

73 tools. 48 can modify or destroy data without limits.

5 destructive tools with no built-in limits. Policy required.

Last updated: 29 Jun 2026

48 can modify or destroy data

25 read-only

73 tools total

Community server · catalogue entry checked 29/06/2026

How to control Code MCP Server ↓

TOOL MAP

What Code MCP Server exposes to your agents

Read (25) Write / Execute (42) Destructive / Financial (5)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Code MCP Server tools

Destructive · High delete_file This tool performs an irreversible operation that cannot be undone. Destructive · High docker_containers The tool explicitly includes 'remove' among its operations, which irreversibly destroys Docker containers. Destructive · Medium remove_allowed_command Removing an allowed command from the project's whitelist is an irreversible configuration change that alters the security posture of the workspace. Destructive · High docker_cleanup Cleaning up Docker containers and resources is a destructive operation that removes running or stopped containers, potentially along with associated volumes, networks, and images.

48 of Code MCP Server's 73 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Code MCP Server

PolicyLayer is an MCP gateway — it sits between your AI agents and Code MCP Server, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "delete_file": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "add_allowed_command": {
    "limits": [
      {
        "counter": "add_allowed_command_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "analyze_code": {
    "limits": [
      {
        "counter": "analyze_code_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Code MCP Server — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON CODE →

Instant setup, no code required.

FULL CATALOGUE

All 73 Code MCP Server tools

DESTRUCTIVE 5 tools

Destructive delete_file Delete a file or directory Destructive docker_cleanup Clean up tracked Docker containers and resources Destructive docker_containers Manage Docker containers (list, start, stop, remove, etc.) Destructive remove_allowed_command Remove a command from the project\ Destructive rollback_session Rollback all changes made in the current AI session

EXECUTE 21 tools

Execute docker_build Build a Docker image from a Dockerfile Execute docker_compose Manage Docker Compose services Execute docker_images Manage Docker images (list, pull, push, remove, etc.) Execute docker_networks Manage Docker networks Execute docker_run Run a Docker container Execute docker_system Docker system operations and information Execute docker_volumes Manage Docker volumes Execute git_push Push commits to remote Execute install_dependencies Install all project dependencies Execute npm_command Run npm commands (install, test, build, etc) Execute pip_install Install Python packages using pip Execute run_command Execute a shell command Execute run_custom_tool Execute a custom tool defined in project configuration Execute run_javascript Execute JavaScript code or script with Node.js Execute run_python Execute Python code or script Execute run_tests Run tests using appropriate test runner Execute secure_run_command Execute a command with security restrictions (only allowed commands) Execute secure_run_command_sequence Execute multiple commands in sequence with security restrictions Execute start_coding_session Start a new AI coding session with automatic change tracking Execute start_server Start a development server Execute stop_server Stop a running server

WRITE 21 tools

Write add_allowed_command Add a command to the project\ Write apply_patch Apply a patch file to the workspace Write auto_commit_changes Automatically commit AI-made changes with tracking Write auto_select_workspace Automatically select the most appropriate VS Code workspace Write create_directory Create a new directory Write create_patch Create a patch file from differences between files or directories Write create_project Create a new project with boilerplate Write find_and_replace Find and replace text across multiple files with preview option Write generate_docker_compose Generate a Docker Compose file template Write generate_dockerfile Generate a Dockerfile template for a specific language/framework Write generate_sample_config Generate a sample .vscode-mcp.toml configuration file Write git_add Stage files for commit Write git_branch List, create, or switch branches Write git_commit Commit staged changes Write git_pull Pull changes from remote Write move_file Move or rename a file or directory Write save_project_config Save project-specific configuration to .vscode-mcp.toml Write set_workspace Set the active workspace directory Write smart_workspace_init Intelligently initialize workspace with VS Code detection and user choice Write update_project_config Update specific project configuration settings Write write_file Write content to a file

READ 25 tools

Read analyze_code Analyze code structure and dependencies Read analyze_file_differences Analyze differences between two files with detailed statistics Read compare_commits Compare two commits with detailed analysis Read compare_files Compare two files and show differences with multiple format options Read detect_vscode_workspaces Automatically detect open VS Code instances and their workspaces Read docker_check_availability Check if Docker is installed and available Read enhanced_git_diff Show git diff with multiple format options (unified, side-by-side, stat, word-diff) Read get_allowed_commands Get list of commands that are allowed to run in this project Read get_current_session Get information about the current coding session Read get_diff_stats Get diff statistics (files changed, lines added/removed) Read get_session_history Get history of commits in current session Read get_session_info Get information about the current coding session Read get_workspace Get current workspace path Read git_diff Show git diff Read git_log Show commit history Read git_status Get git repository status Read list_directory List contents of a directory with details Read list_processes List all running processes started by the agent Read list_workspaces List recently used workspaces Read load_project_config Load project-specific configuration from .vscode-mcp.toml Read present_workspace_choice Present detected workspaces to user for selection Read preview_changes Preview all changes before committing Read preview_changes_enhanced Enhanced change preview with multiple format options Read read_file Read the contents of a file Read search_code Search for patterns in code

OTHER 1 tools

Other end_coding_session End the current AI coding session

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Code MCP Server

Can an AI agent delete data through the Code MCP Server MCP server? +

Yes. The Code MCP Server server exposes 5 destructive tools including delete_file, docker_cleanup, docker_containers. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Code MCP Server? +

The Code MCP Server server has 21 write tools including add_allowed_command, apply_patch, auto_commit_changes. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Code MCP Server.

How many tools does the Code MCP Server MCP server expose? +

73 tools across 4 categories: Destructive, Execute, Read, Write. 25 are read-only. 48 can modify, create, or delete data.

How do I enforce a policy on Code MCP Server? +

Register the Code MCP Server MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Code MCP Server tool call.

Deterministic rules across all 73 Code MCP Server tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON CODE →

Instant setup, no code required.

73 Code MCP Server tools catalogued and risk-classified — across an index of 46,500+ MCP servers.

// WHERE THIS COMES FROM

These policies come from Code MCP Server's registry record.

The record behind this page: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.

Teams ship this data inside their own products. See what a licence covers →