Anthropic MCP Directory Review — CodeAnt AI #25

Hi from Anthropic 👋

We reviewed CodeAnt AI for inclusion in the Anthropic MCP Directory. We found several items that need to be addressed before we can list the server.

Required

1. File path validation — We observed that the ls, read, glob, and grep tools resolve user-supplied paths against the working directory using path.resolve but do not verify the resolved path remains inside that directory, so inputs like ../../etc reach the filesystem outside the intended scope. Please add a boundary check (e.g., reject when resolved.startsWith(cwd) is false) on each of these tools.

2. Privacy policy URL — We observed the privacy_policies URL in the manifest (https://codeant.ai/privacy) returns 404 after redirect. Please point this field at a live policy page.

3. Configuration disclosure — We observed the server reads a number of environment variables that are not declared in the manifest's user_config or mcp_config.env, including access tokens and URLs for Azure DevOps, Bitbucket, GitHub, and GitLab (the full set is visible in the source's process.env.* references). Please declare each one users are expected to set (with sensitive: true for tokens) so the install flow can collect them and the server's behavior is discoverable from the manifest.

4. Headless startup — We observed the server opens a browser during MCP initialization when no API token is present. Please remove the automatic browser launch from the init path and instead surface a clear error or no-op until the user invokes the existing codeant_login tool, so the server runs cleanly in headless and automated environments.

Recommended

5. Telemetry disclosure — We observed PostHog telemetry is initialized by default with opt-out via CODEANT_TELEMETRY_DISABLED. Please add a short note to the manifest long_description disclosing the collection and the opt-out variable.

6. Documentation URLs — We observed the manifest's support and documentation URLs (https://docs.codeant.ai/support, https://docs.codeant.ai/cli/claude-code-plugin) both return 404. Please update them to live pages or remove the fields until the docs are published.

We're happy to re-review once these are addressed. Feel free to reach out with any questions.