Why CodeScene CodeHealth MCP needs to run locally?

CodeScene CodeHealth MCP analysis runs inside the MCP. It does so by asking the LLM to provide it with a path to a file, which the MCP itself will then read and analyze, resulting in the code review being given back to the LLM for interpretation.

The only AI token cost here then is for the path of the file and for the code review itself, both rather small.

If we wanted to run the CodeScene CodeHealth MCP remotely such that it would not be on the developers machines, this wouldn’t work, because the MCP would not have access to the file the developer is working on to be able to read it, and we’d need to transfer the entire file content as a text string over JSON-RPC to the MCP instead.

This has the negative consequence of being extremely expensive, because instead of paying for the tokens of the file path, you now pay for the tokens of the entire file. In addition, if the file content exceeds the LLM context space, the review will fail because the file content simply does not fit inside the LLM context space, which it needs to fit in, in order to be sent to the MCP over JSON-RPC.

While the basic code health review itself would technically function remotely, even if very expensive and failing for very large files, we also have delta analyses tools like analyze_change_set and pre_commit_code_health_safeguard which require access to the git repository for access to historical file data and data in other branches, and those tools would not work at all in a remote MCP with no access to the developers file system and git repository.

These reasons are why we’ve decided to have the file reading part be done by the MCP itself, not the LLM, and why the MCP needs to run where the files themselves also are.