LLM Code Security Review MCP Server

This MCP server is a companion tool for thellm-code-security-reviewmethodology. It helps an LLM follow the review plan one step at a time. The LLMperforms the security review; the server tracks progress, makes sure the LLMactually reads all source code assigned to each subsystem, and does not acceptthe review as complete until every plan step is finished.

The Short Version

Load a review plan.
Codex receives one subsystem and one security area at a time.
The server checks that the assigned source was read before accepting theresult.
Progress is saved automatically. You can restart Codex, pause the review, orcontinue later without starting over.
Findings must be reviewed separately. The server organizes the work; it doesnot decide whether a reported issue is real.

That is the whole job.

What You Need

Codex on Linux, macOS, or another POSIX system;
Python 3.11 or newer;
a review plan created with the companion methodology.

The server has no third-party Python dependencies.

Install It

git clone https://github.com/drewrukin/llm-code-security-review-mcp.git
cd llm-code-security-review-mcp
python3 -m venv .venv
. .venv/bin/activate
python3 -m pip install .

Add the server to ~/.codex/config.toml. Replace the example path with theabsolute path to your clone:

[mcp_servers.llm-code-security-review-mcp]
command = "/absolute/path/to/llm-code-security-review-mcp/.venv/bin/llm-code-security-review-mcp-server"

Start a new Codex session after changing the configuration.

Run a Review

First, use the companion methodology to create a plan for your project. Thenstart a new Codex session and say:

Use the llm-code-security-review-mcp server to load <path-to-plan.json> and execute the review.

The server will provide the first task and keep the review moving until the planis complete.

Development

Run the test suite with:

python3 -m unittest discover -s tests

Released changes are in CHANGELOG.md. Please report securityproblems privately as described in SECURITY.md.

LLM Code Security Review MCP Server