Moltline Code Review
Risk-scan a diff, flag AI-generated-code tells, find secrets. 5 of 7 tools need no account.
| Endpoint | https://mcp.moltlinestudio.com/codereview (streamable-http) |
|---|---|
| Registry version | 1.2.0 |
| Now | 7 tools · grade A (96) · pin ts_922e21fc30ffffce750c0893f9bd65a7 · protocol 2025-06-18 |
| First / last listed | 2026-11-12 01:54 UTC / 2026-11-12 01:54 UTC |
| Grade over time | 2026-11-12: A (96), 7 tools |
Is this your server? Own a server? ToolFit hosted watch re-checks it every 24 h ($0.25 per 30 days) or 6 h ($0.60) and sends you an HMAC-signed webhook when its tools or grade change: POST https://api.youraitools.co/toolfit/v1/watch. To opt out, see About & opt-out.
Tools: review_diff ai_code_smell_scan complexity_report secret_scan review_checklist security_deep_dive get_reviewer_persona
review_diff | Risk-scan a unified diff the way a senior reviewer triages a PR. FREE.
Flags added lines matching known risk patterns (injection sinks, disabled
TLS, downloads piped into a shell, credential-store reads, broad deletes,
persistence, bare excepts, debug prints, TODOs, N+1 hints, leaked secrets) with
the new-file line number and a severity (1 low - 4 high). Typical input
{"diff": "<git diff output>" params: diff* |
ai_code_smell_scan | Flag the tells of unreviewed AI-generated code in a source file. FREE.
Detects comments that restate the next line, leaked assistant preambles,
placeholder TODOs, shipped 'Example usage' blocks, over-broad try/except
that swallows errors, and auto-named identifiers. Typical input
{"code": "<file contents>"} returns {"reviewed_confidence": 0-100,
"hits": [{"smell": "...", "evidence": "<quoted snip params: code* |
complexity_report | Report structural complexity of a source file, function by function. FREE.
Measures per-function length, max nesting depth, and a cyclomatic-style
branch count (if/for/while/case/&&/||/except), flagging functions too
long or too deeply nested to review confidently. Typical input
{"code": "<file contents>"} returns {"functions": N, "detail":
[{"name": ..., "start": N, "lines": N, "branches": N, "m params: code*, language |
secret_scan | Scan text for accidentally-committed machine credentials and private-key material. FREE.
Reports each match's location and category so it can be rotated before it
leaks. Detection is pattern-based over the common leaked-credential
formats; it never echoes the matched value back. Typical input
{"text": "<file, diff, or config contents>"} returns {"leaked": bool,
"count": N, "findings": [{"line": N params: text* |
review_checklist | Produce a focused pull-request review checklist for a language or stack. FREE.
Covers the things that actually break in production, with extra items per
language. Typical input {"language": "python"} returns {"language":
"python", "checklist": ["...", ...], "note": "..."}.
Use before a review, to decide what to look for. Not for reviewing actual
code - pass code to review_diff or security_deep_d params: language |
security_deep_dive | Run an OWASP-oriented security pass over a source file. PREMIUM (license).
Checks injection sinks, auth/session handling, crypto misuse,
SSRF/deserialization, and unsafe file/path handling. Each finding cites
the line, the OWASP risk class, and a concrete fix direction. Typical
input {"code": "<file contents>"} returns {"issues": N, "findings":
[{"line": N, "class": "A03 Injection", "fix": "...", params: code* |
get_reviewer_persona | Load the Senior Reviewer persona for consistent, high-signal reviews. PREMIUM (license).
The persona is a reviewing voice that is skeptical, specific, and kind:
demands evidence over vibes and blocks only on real risk. Takes no
arguments. Returns {"persona": ..., "identity": ..., "rules": ["...",
...], "opening_move": "..."} ready to adopt as a system prompt.
Use to keep repeated reviews consist params: none |
Entries describe changes in tool definitions. They are not statements about a server, its quality or its author. The grade measures how the tool definitions fit model providers (token cost, schema compatibility, confusable names) as scored by the ToolFit engine at the time of the listing. JSON: append .json. Opt-out: how or hello@youraitools.co.