UpToCode

Name: UpToCode
Author: DDYRich72

by DDYRich72version 1.0.0i★ –iComputer or cloud

Registry nameio.github.DDYRich72/uptocode

Install

Overview

Description from the maker (original English)

Evidence-backed architecture-quality analysis for Python agent applications.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Computer or cloud
Transport: stdio, Streamable HTTP
Category: Other

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on the maker’s server: what you ask it goes through their server.
You fill in yourself: Authorization

You need

Runs in the cloudNothing to install; it connects over the internet
PyPIPython’s uv installed (for the uvx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

This address needs a key in a request header, which the add-connector menu cannot set. Use Claude Code, Cursor or VS Code instead.

Or run it on your computer

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "uptocode": {
      "command": "uvx",
      "args": [
        "uptocode",
        "serve",
        "--transport",
        "stdio"
      ]
    }
  }
}

Run this in your terminal

claude mcp add --transport http uptocode https://uptocode-mcp-1015314816960.us-central1.run.app/mcp --header 'Authorization: Bearer {UPTOCODE_API_KEY}'

Or run it on your computer

claude mcp add uptocode -- uvx uptocode serve --transport stdio

Fill in the empty values before running it.

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "uptocode": {
      "url": "https://uptocode-mcp-1015314816960.us-central1.run.app/mcp",
      "headers": {
        "Authorization": "Bearer {UPTOCODE_API_KEY}"
      }
    }
  }
}

Or run it on your computer

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "uptocode": {
      "command": "uvx",
      "args": [
        "uptocode",
        "serve",
        "--transport",
        "stdio"
      ]
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "uptocode": {
      "type": "http",
      "url": "https://uptocode-mcp-1015314816960.us-central1.run.app/mcp",
      "headers": {
        "Authorization": "Bearer {UPTOCODE_API_KEY}"
      }
    }
  }
}

Or run it on your computer

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "uptocode": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "uptocode",
        "serve",
        "--transport",
        "stdio"
      ]
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This address needs a key in a request header, which the add-connector menu cannot set. Use Claude Code, Cursor or VS Code instead.

Your choice stays on this device in a cookie; no account needed.

Values you fill in

Authorization HTTP header

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

We have not read this server’s tool list yet; we check endpoints in rotation.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account DDYRich72, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
… Not checked yet
Endpoint responds
Not checked yet; we check endpoints in rotation
… Not checked yet
Sign-in with OAuth
Not checked yet; we check endpoints in rotation
… Not checked yet
No hidden instructions in tool descriptions
Not checked yet; we read the tool list when we check the endpoint

Compared with others in Otheri

More stars than 0% of the other 32545 servers in this category
Published to the registry more recently than 18% of the other 32545 servers in this category
Basic checks equal to or better than 100% of the other 32545 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is UpToCode safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

The registry does not list a required key, though some servers ask you to sign in on first use.

Does it run on my computer or in the cloud?

Either way works: install it on your computer or connect to the cloud version.

Is it still maintained?

The GitHub repo last changed –, and the latest version (1.0.0) reached the registry 4 months ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. It connects by URL, so apps that accept remote MCP servers work too, such as ChatGPT in developer mode.

What can I use instead?

In the same category: Spec Driven Development, Remote Desktop Commander, Python MCP

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Spec Driven Development

by formulahendry

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

Runs on your computer★ 440MITUpdated 14 months ago

Install

Remote Desktop Commander

by desktop-commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

Runs in the cloud★ 211Updated yesterday

Install

Python MCP

by Files-com

Local-only Python MCP server for the Files.com API.

Runs on your computerUpdated today

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

UpToCode

UpToCode is a design-time architecture-quality scanner for Python and TypeScript agent applications. It finds missing execution bounds, run budgets, approvals, validation, resilience controls, evals, and observability; explains the evidence; and produces an approval-driven plan for Codex without rewriting source code.

The product is deliberately narrower than a general agent-security scanner. Version 1.7 recognizes OpenAI, Anthropic, CrewAI, PydanticAI, LlamaIndex, LangGraph, conservative custom Python/TypeScript loops, and positive evidence of unbounded context growth. Static scans are local and offline. Optional GPT‑5.6 judgment remains explicit, bounded, redacted, and code-sharing gated.

The Python distribution, import package, and command are all uptocode. Version 1.0.0

is the published baseline; this source tree is prepared as 1.10.0 for the operator-gated Batch 3 release train.

Install locally

UpToCode requires Python 3.11 or newer. Install the verified 1.0 release from PyPI:

python -m pip install "uptocode==1.0.0"

uptocode --help

For repository development, use the editable test environment:

python -m pip install -e ".[test]"

uptocode --help

All ordinary tests are mocked/offline:

python -m pytest -q

python scripts/acceptance.py

Judge test build

The repository and package are public. No hosted credential or paid model call is required for the complete offline test build.

git clone https://github.com/DDYRich72/UpToCode.git

cd UpToCode python -m venv .venv

Activate the environment with .venv\Scripts\activate on Windows PowerShell or source .venv/bin/activate on POSIX, then run:

python -m pip install --upgrade pip

python -m pip install -e ".[test]" uptocode scan fixtures/bad_python --fail-on critical uptocode scan fixtures/bad_python --format json --output report.json uptocode review report.json --approve AA001,AA003 --reject AA012 --non-interactive uptocode plan report.json --manifest .uptocode/manifest.json --output FIXPLAN.md python scripts/acceptance.py

The first scan intentionally exits 1 because the fixture contains critical findings. The remaining commands produce a report-bound review manifest and an approved-only FIXPLAN.md; they do not edit the fixture. To inspect the local MCP surface, run uptocode serve --transport stdio --root . from an MCP client or use the JSON registration under MCP registration. python scripts/acceptance.py also launches a real stdio server, lists all ten tools, and calls check_loop offline.

The submitted-content hosted transport is deployed at https://uptocode-mcp-1015314816960.us-central1.run.app/mcp. Its bearer credential is issued separately and read from UPTOCODE_API_KEY; never commit it or enter it into the website. The immutable production revision passed readiness, unauthorized-access, AA001, tool-discovery, judgment-gate, rate-limit, and payload-free-log checks. Hosted judgment is off, no OpenAI key is attached, and verification made zero paid model calls.

Scan, review, plan

uptocode scan PATH [--format terminal|json|html|github|sarif] [--output FILE]

[--judgment --send-code] [--fail-on critical|warning|info] [--include-experimental] [--share-safe] [--baseline FILE|--update-baseline FILE] [--changed-since REF] [--select RULES] [--ignore RULES] [--exclude GLOB] [--severity RULE=LEVEL] [--fail-on-analysis-warning] [--github-summary PATH] [--verbose] uptocode review REPORT [--approve IDS|--approve-all] [--reject IDS] [--reuse MANIFEST] [--non-interactive] uptocode plan REPORT --manifest MANIFEST [--output FIXPLAN.md] uptocode fix REPORT --manifest MANIFEST --runner codex|command [--command TEMPLATE] [--verify-command COMMAND] [--apply] uptocode serve --transport stdio --root PATH uptocode serve --transport streamable-http --mode hosted

Scanning, review, planning, and the default fix preview are non-mutating:

uptocode scan . --format json --output report.json

uptocode review report.json --approve AA001,AA003 --reject AA012 --non-interactive uptocode plan report.json --manifest .uptocode/manifest.json --output FIXPLAN.md uptocode fix report.json --manifest .uptocode/manifest.json --runner codex

review binds decisions to the exact report fingerprint. plan refuses a mismatched manifest and includes only approved findings. Neither command edits the scanned repository. fix is also a no-write dry-run unless --apply is supplied. The applying path requires a clean Git checkout, creates one retained uptocode/fix- branch/worktree per approved finding, invokes only the selected external runner there, verifies fingerprint absence, and never commits, merges, deletes work, or changes the invoking checkout.

Exit codes are 0 for no configured threshold breach, 1 for a finding at or above --fail-on (or a requested analysis-warning gate), and 2 for invalid configuration or an unrecoverable scan error. Experimental findings remain visible but require --include-experimental to affect --fail-on. --share-safe sanitizes JSON, HTML, or SARIF for distribution while retaining the repository revision. Baseline 2.1 reports new, aging, and resolved debt and preserves first_seen when updated. Suppressions may include owner, quoted reason, and an inclusive expires date. HTML requires --output. GitHub workflow commands escape untrusted command data and properties. SARIF 2.1.0 omits absent fields, declares default rule levels, and carries stable partial fingerprints. --github-summary PATH appends a bounded Markdown summary; when GITHUB_STEP_SUMMARY is set, the summary is appended there automatically.

Pre-commit

repos:

repo: https://github.com/DDYRich72/UpToCode rev: v1.1.0 hooks:
id: uptocode

Run pre-commit install, then use pre-commit run uptocode --all-files. To copy the project badge into your own README:

[![Scanned with UpToCode](https://img.shields.io/badge/scanned%20with-UpToCode-175cd3)](https://github.com/DDYRich72/UpToCode)

GitHub Action

The repository ships a composite Action that installs UpToCode from the Action checkout, runs the scan, uploads SARIF with always(), and only then returns the preserved scanner exit code:

permissions:

contents: read security-events: write

steps:

uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
uses: DDYRich72/UpToCode@v1.0.0 with: path: . fail-on: critical version: source upload-sarif: "true"

version: source installs from the checked-out Action source. An exact semantic version, such as 1.0.0, installs the matching uptocode PyPI release. Set upload-sarif: "false" when code-scanning upload is not desired; otherwise the calling workflow needs security-events: write.

Example terminal output:

UpToCode scan

Coverage: 1/1 files analyzed Findings: 11 | Warnings: 0 | Redactions: 3 [CRITICAL] AA001 agent.py:21 - Unbounded agent loop [CRITICAL] AA003 agent.py:11 - Ungated destructive action

Privacy model

Static scanning is the default and makes no network calls.
--judgment is rejected unless --send-code is also present.
Judgment sends only normalized evidence and bounded, redacted excerpts, grouped once per candidate rule. Requests use gpt-5.6, Pydantic Structured Outputs, store=false, a 2,000-token output ceiling, a 30-second timeout, and a six-rule call budget.
Recognized OpenAI keys, AWS access keys, bearer tokens, email addresses, and US Social Security numbers are replaced before report or judgment output. Detection is intentionally narrow and is not a substitute for a dedicated secret/PII scanner.
Nested .gitignore files, default build/dependency/generated exclusions, .uptocode.yml, 1 MiB per-file and 4 MiB aggregate limits, binary/non-Python exclusion, and explicit suppressions are honored. Production UpToCode source is gated at zero suppressions.
Refusal, timeout, authentication failure, or API failure never deletes static results; the report records partial or failed judgment status and an analysis warning.

No live API call is part of the offline test or acceptance suite. The submission smoke test requires a key and separate approval for paid usage.

Rules

ID	Architecture defect	Tier	Severity	Primary guidance
AA001	Unbounded agent loop	Static	critical	Agents SDK runner
AA002	Missing output/run budget controls	Static	critical	OpenAI practical guide
AA003	Ungated destructive action	Static + judgment	critical	Agents SDK approvals, OpenAI safety
AA004	Unvalidated tool arguments	Static	critical	OpenAI function calling, Anthropic tool definitions
AA005	Raw untrusted content in prompts	Judgment	critical	OpenAI safety, Anthropic guardrails
AA006	Secret or narrow PII exposure	Static	critical	OpenAI safety
AA007	Missing timeout, retry, or retry backoff	Static	warning	OpenAI practical guide
AA008	Unjustified orchestration complexity	Judgment	warning	Anthropic effective agents, OpenAI practical guide
AA009	Poor tool schema	Judgment	warning	OpenAI function calling, Anthropic tool definitions
AA010	Unvalidated model output before side effect	Static + judgment	warning	OpenAI function calling, OpenAI safety
AA011	No agent eval coverage	Static + judgment	warning	OpenAI evals, Google ADK evaluation
AA012	No agent observability	Static	info	Agents SDK tracing
AA013	Unbounded context growth	Static	warning	Anthropic effective agents, OpenAI practical guide

Only the beginning is shown; read the rest in the repo

UpToCode

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

Or run it on your computer

Or run it on your computer

Or run it on your computer

Or run it on your computer

Values you fill in

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Otheri

Common questions

Alternatives

Spec Driven Development

Remote Desktop Commander

Python MCP

README from the maker

UpToCode

Install locally

Judge test build

Scan, review, plan

Pre-commit

GitHub Action

Privacy model

Rules