{"name":"moltline-codereview","description":"Moltline Code Review & AI-Code Verifier: review diffs and files the way a skeptical senior engineer would. Free: review_diff (risk-scan a unified diff), ai_code_smell_scan (flag AI-generated-code tells), complexity_report, secret_scan, review_checklist. Premium (license): security_deep_dive,...","url":"https://mcp.moltlinestudio.com/codereview","transport":"streamable-http","homepage":"https://moltlinestudio.com/servers.html","serverInfo":{"name":"moltline-codereview","version":"1.1.0"},"toolCounts":{"total":7,"free":5,"premium":2},"protocolVersion":"2025-11-25","protocolVersions":["2024-11-05","2025-03-26","2025-06-18","2025-11-25"],"pricing":{"freeTier":{"tools":5,"price":"0","currency":"USD","description":"Free forever. No account, no registration and no credentials are required to call them."},"details":"https://moltlinestudio.com/.well-known/pricing","terms":"https://moltlinestudio.com/terms.html","agentPayment":{"protocol":"x402","resource":"https://moltlinestudio.com/api","network":"eip155:8453","asset":"USDC","amount":"19000000","discovery":"https://moltlinestudio.com/.well-known/x402","description":"GET or POST the resource to receive an HTTP 402 carrying a machine-readable payment demand; retry with the transaction hash in the X-PAYMENT header and the licence key is returned in the response."},"premium":{"tools":2,"plan":"All-Access","price":"19.00","currency":"USD","period":"month","description":"One licence key unlocks the premium tools on every Moltline server. Billed monthly, cancellable at any time.","purchaseUrl":"https://moltlinestudio.com/#allaccess"}},"authentication":{"required":false},"tools":[{"name":"review_diff","description":"Risk-scan a unified diff the way a senior reviewer triages a PR. FREE.\n\nFlags added lines matching known risk patterns — injection sinks, disabled\nTLS, bare excepts, debug prints, TODOs, N+1 hints, leaked secrets — with\nthe new-file line number and a severity (1 low - 4 high). Typical input\n{\"diff\": \"<git diff output>\"} returns {\"added_lines\": N, \"risk_score\":\n0-100, \"verdict\": \"...\", \"secrets\": [...], \"findings\": [{\"line\": N,\n\"severity\": 1-4, \"issue\": \"...\", \"code\": \"...\"}], \"note\": \"...\"}.\n\nUse on a unified diff, when only the change matters. Not for whole-file\nanalysis (complexity_report, ai_code_smell_scan). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {\"error\": \"<what is wrong and how to fix it>\"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.","tier":"free","inputSchema":{"additionalProperties":false,"properties":{"diff":{"type":"string","description":"A unified diff exactly as produced by `git diff` — text with\n@@ hunk headers and +/- line prefixes. Only added (+) lines are\nscanned."}},"required":["diff"],"type":"object"}},{"name":"ai_code_smell_scan","description":"Flag the tells of unreviewed AI-generated code in a source file. FREE.\n\nDetects comments that restate the next line, leaked assistant preambles,\nplaceholder TODOs, shipped 'Example usage' blocks, over-broad try/except\nthat swallows errors, and auto-named identifiers. Typical input\n{\"code\": \"<file contents>\"} returns {\"reviewed_confidence\": 0-100,\n\"hits\": [{\"smell\": \"...\", \"evidence\": \"<quoted snippet>\"}], \"reading\":\n\"...\", \"note\": \"...\"}.\n\nUse on a full source file suspected of unreviewed machine authorship. Not\non a diff (review_diff), and the result is a signal to check, not proof of\nauthorship. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {\"error\": \"<what is wrong and how to fix it>\"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.","tier":"free","inputSchema":{"additionalProperties":false,"properties":{"code":{"type":"string","description":"Full source text to scan, any language; paste the file\ncontents as a single string."}},"required":["code"],"type":"object"}},{"name":"complexity_report","description":"Report structural complexity of a source file, function by function. FREE.\n\nMeasures per-function length, max nesting depth, and a cyclomatic-style\nbranch count (if/for/while/case/&&/||/except), flagging functions too\nlong or too deeply nested to review confidently. Typical input\n{\"code\": \"<file contents>\"} returns {\"functions\": N, \"detail\":\n[{\"name\": ..., \"start\": N, \"lines\": N, \"branches\": N, \"max_depth\": N}],\n\"flags\": [\"...\"], \"note\": \"...\"}.\n\nUse when structure rather than correctness is the question. Not for\nvulnerabilities (security_deep_dive). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {\"error\": \"<what is wrong and how to fix it>\"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.","tier":"free","inputSchema":{"additionalProperties":false,"properties":{"code":{"type":"string","description":"Full source text to analyze, pasted as a single string."},"language":{"default":"auto","type":"string","description":"Optional language hint, e.g. \"python\" or \"javascript\";\n\"auto\" (default) detects from syntax."}},"required":["code"],"type":"object"}},{"name":"secret_scan","description":"Scan text for accidentally-committed machine credentials and private-key material. FREE.\n\nReports each match's location and category so it can be rotated before it\nleaks. Detection is pattern-based over the common leaked-credential\nformats; it never echoes the matched value back. Typical input\n{\"text\": \"<file, diff, or config contents>\"} returns {\"leaked\": bool,\n\"count\": N, \"findings\": [{\"line\": N, \"type\": \"<category>\"}], \"note\": \"...\"}.\n\nPattern matching only - a clean result is not proof, and every hit needs\nhuman confirmation before anyone acts on it. Not a general security review\n(security_deep_dive). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {\"error\": \"<what is wrong and how to fix it>\"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.","tier":"free","inputSchema":{"additionalProperties":false,"properties":{"text":{"type":"string","description":"The file, diff, or config contents to scan, pasted as a\nsingle string."}},"required":["text"],"type":"object"}},{"name":"review_checklist","description":"Produce a focused pull-request review checklist for a language or stack. FREE.\n\nCovers the things that actually break in production, with extra items per\nlanguage. Typical input {\"language\": \"python\"} returns {\"language\":\n\"python\", \"checklist\": [\"...\", ...], \"note\": \"...\"}.\n\nUse before a review, to decide what to look for. Not for reviewing actual\ncode - pass code to review_diff or security_deep_dive. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {\"error\": \"<what is wrong and how to fix it>\"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.","tier":"free","inputSchema":{"additionalProperties":false,"properties":{"language":{"default":"general","type":"string","description":"Language or stack to tailor for: \"python\", \"javascript\",\n\"typescript\", \"go\", \"sql\", or \"general\" (default). Unknown values\nfall back to the general checklist."}},"type":"object"}},{"name":"security_deep_dive","description":"Run an OWASP-oriented security pass over a source file. PREMIUM (license).\n\nChecks injection sinks, auth/session handling, crypto misuse,\nSSRF/deserialization, and unsafe file/path handling — each finding cites\nthe line, the OWASP risk class, and a concrete fix direction. Typical\ninput {\"code\": \"<file contents>\"} returns {\"issues\": N, \"findings\":\n[{\"line\": N, \"class\": \"A03 Injection\", \"fix\": \"...\", \"code\": \"...\"}],\n\"owasp_note\": \"...\"}.\n\nUse on one source file when vulnerabilities are the question. Not for\nstyle or structure (complexity_report), and never a substitute for a\nsecurity professional on high-risk code. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {\"error\": \"<what is wrong and how to fix it>\"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.","tier":"premium","inputSchema":{"additionalProperties":false,"properties":{"code":{"type":"string","description":"Full source text to audit, pasted as a single string; any\ncommon language."}},"required":["code"],"type":"object"}},{"name":"get_reviewer_persona","description":"Load the Senior Reviewer persona for consistent, high-signal reviews. PREMIUM (license).\n\nThe persona is a reviewing voice that is skeptical, specific, and kind —\ndemands evidence over vibes and blocks only on real risk. Takes no\narguments. Returns {\"persona\": ..., \"identity\": ..., \"rules\": [\"...\",\n...], \"opening_move\": \"...\"} ready to adopt as a system prompt.\n\nUse to keep repeated reviews consistent in voice and rigor. Not for\nrunning a review - the scan tools do that. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {\"error\": \"<what is wrong and how to fix it>\"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.","tier":"premium","inputSchema":{"additionalProperties":false,"properties":{},"type":"object"}}],"resources":[],"prompts":[]}