prod-code MCP server

⚡ prod-code

Remote code intelligence for fleets of coding agents

---

Why

A language server was designed for one human typing in one checkout. What runs on a machine now is a fleet: a resident agent in the main checkout, workers in their own worktrees, each asking the analyzer the kind of question a human asks once a minute and asking it ten times a second. Every worktree brings its own analyzer and its own mitts test, and they share the cores with your editor.

prod-code moves all of it one hop away. Measured on this repository, with nothing compiled on the laptop:

hover on a warm workspace	1–4 ms
tool call over a persistent session	~10 ms
a one-shot CLI command from the laptop, end to end (prod-code hover …)	~0.1 s
mitts clippy --workspace --all-targets on a 32-core node, one file changed	1 s
mitts test --workspace — 565 tests	5 min
mitts test --workspace --exclude prod-code-gateway	56 s
first load of a Rust workspace (build scripts, proc macros)	~45 s, once per worktree

These are recorded workloads; current test counts and timings are listed in each pull request. The live suite starts real gateways and drives their language servers. Unit and scripted-server tests complement those scenarios. The 56 s workload excludes the entire gateway crate. The required coverage floor is 80% of regions per Rust source file (python3 scripts/coverage.py --min 80). The default gate enumerates Rust sources in workspace package directories, skipping hidden, build-output, test, bench and example directories and workspace exclusions. It rejects missing measurements for enumerated files except those filtered by omitted_by_llvm_cov: test/example/bench paths, build scripts, modules declared only off Unix, and files without a recognized fn item. Those omissions need no zero-region report entry and are not coverage evidence. Malformed report entries fail; explicit zero-region entries are reported as having no code. These gate limits do not relax the required 80% floor; see Coverage for the evidence policy.

Architecture

flowchart TD
    subgraph ClientHost["Developer Workstation (Laptop / Desktop)"]
        Agent["AI Coding Agents\n(Claude Code, Codex, Antigravity)"]
        Editor["Code Editors\n(Zed, VS Code, Neovim)"]
        CLI["prod-code CLI"]

        Agent -->|"Native MCP tools"| MCPBridge["prod-code mcp"]
        Editor -->|"LSP protocol"| LSPBridge["prod-code lsp"]
        CLI -->|"Commands / Queries"| ClientCore["prod-code client"]

        MCPBridge & LSPBridge & ClientCore --> SyncEngine["Fast Mirror & Sync Engine\n(Base64 diffs, watermarks, local cache)"]
    end

    SyncEngine -->|"10 GbE LAN / Gossip (:9400)"| GatewayCluster

    subgraph GatewayCluster["Production Cluster (9 nodes · 355 CPU cores)"]
        subgraph LinuxAarch64["128-Core aarch64 (Ampere Altra)"]
            LinuxArmNode["Linux aarch64 build node (128 cpus)\nRust, Go, C++, Python, TS, Java, Kotlin"]
        end

        subgraph LinuxX86["High-Throughput x86_64 Nodes (192 cpus)"]
            LinuxX86Node1["Zen 5 build node (32 cpus)"]
            LinuxX86Node2["Zen 4 build node + telemetry (32 cpus)"]
            LinuxX86Node3["Polyglot build node (32 cpus)"]
            LinuxX86Storage["Storage & build nodes (96 cpus)"]
        end

        subgraph MacNodes["Apple Silicon macOS Nodes (35 cpus)"]
            MacNodeStudio["macOS build node (24 cpus) · Swift, Go"]
            MacNodeBook["macOS build node (11 cpus) · Swift"]
        end

        subgraph GatewayInternals["Gateway Architecture (per node)"]
            Router["Placement & Gossip Router"] --> Workspaces["Per-Worktree Mirrors\n(<repo>--wt-<hash>)"]
            Workspaces --> PrimarySalsa["Primary Salsa DB\n(rust-analyzer in-proc; child LSPs)"]
            Workspaces --> ShadowValidation["Validation Engines\n(private or shared by engine)"]
    Workspaces --> RemoteExec["Remote Builds, Lints & Tests\n(mitts, go, pytest, swift, etc.)"]
            GatewayInternals --> Telemetry["Prometheus Scrape (:9401)\n& Pushgateway (:9091)"]
        end
    end

    Telemetry --> Monitoring["Prometheus + VictoriaMetrics + Grafana"]

prod-code separates the lightweight developer interface from heavy language intelligence and compilation:

1. Mirroring over Mounting: Workspaces synchronize fast Base64 diffs over 10 GbE LAN instead of network-mounting filesystems (NFS/SSHFS), keeping filesystem operations local and fast.
2. Worktree Isolation: Rust worktree mirrors attach isolated overlays to a shared base compiler database (SharedWorkspace::with_base), while child language servers run isolated per-process, avoiding cross-session state corruption.
3. Validation Engines: Proposed edits use private validation engines for generic LSP engines and normally for Rust. Rust can fall back to its main engine; Go and other non-generic, non-Rust views use the shared view. See the validation details below.
4. Polyglot Cluster Gossip: Nodes discover each other via UDP gossip on :9401, evaluate load and memory pressure, and route requests to capable nodes (including automatic rerouting of Swift subprojects to macOS nodes).

Requirements

Building prod-code and running its development checks require Rust 1.95.0 or newer. With rustup, install the supported minimum and the check components, then build and check with Mitts:

rustup toolchain install 1.95.0 --profile minimal -c rustfmt -c clippy

Use Mitts for Rust builds, formatting, tests, and linting.

Install

Direct Download & Packages

Choose your preferred installation method for the prod-code CLI:

# Direct shell installer (detects OS and architecture)
curl -fsSL https://prod.codes/install.sh | sh

# Debian / Ubuntu (.deb)
curl -fsSLO https://github.com/alex09x/prod-code/releases/download/v0.3.29/prod-code_0.3.29_amd64.deb
sudo dpkg -i prod-code_0.3.29_amd64.deb

# RHEL / Fedora / Rocky Linux (.rpm)
sudo rpm -i https://github.com/alex09x/prod-code/releases/download/v0.3.29/prod-code-0.3.29-1.x86_64.rpm

# Arch Linux (.pkg.tar.gz)
sudo pacman -U https://github.com/alex09x/prod-code/releases/download/v0.3.29/prod-code-0.3.29-1-x86_64.pkg.tar.gz

# Build the client from source
mitts build --release -p prod-code-client --bins

Native notarized macOS installers (prod-code-0.3.29-macOS.pkg and .dmg) and standalone binaries for Linux (x86_64, aarch64) and macOS (arm64 Apple Silicon) are available on GitHub Releases.

In-Place Self-Updater

Keep your client installation up to date with a single command:

prod-code update --check   # check for newer releases on GitHub
prod-code update           # download, verify SHA-256 integrity, and replace binary in-place

When prod-code is updated, its MCP process re-executes between requests and announces notifications/tools/list_changed. The agent host must refresh its exposed tool catalog; some long-running sessions retain the old list. An updated executable or installed skill does not prove that a running host can call a newly added tool. See catalog discovery and refresh for verification and recovery.

Registering with AI Coding Agents

Register prod-code once; every repository accessed by your agent gains remote code intelligence tools:

For related investigation steps, the experimental code_workflow MCP tool composes lookups with bounded result passing and explicit partial failures. It also accepts short symbol-context and search-and-expand requests. See agent workflows for the read contract and guarded edits for explicit preview, apply and scoped verification steps. The first experimental slice is included in v0.3.49.

# Claude Code
claude mcp add --scope user prod-code -e "PROD_CODE_REMOTE=192.0.2.10:9400" -- prod-code mcp

# OpenAI Codex CLI
codex mcp add prod-code --env "PROD_CODE_REMOTE=192.0.2.10:9400" -- prod-code mcp

# Gemini CLI
gemini mcp add -s user prod-code prod-code mcp -e "PROD_CODE_REMOTE=192.0.2.10:9400"

For Google Antigravity, add the server definition to ~/.gemini/config/mcp_config.json (or use ~/.gemini/settings.json for Gemini CLI):

{
  "mcpServers": {
    "prod-code": {
      "command": "prod-code",
      "args": ["mcp"],
      "env": {
        "PROD_CODE_REMOTE": "192.0.2.10:9400"
      }
    }
  }
}

Running the Gateway Daemon

On the remote Linux or macOS worker host, install the separately packaged gateway from the repository root before invoking the server (the client source-install step installs only prod-code):

# Build the gateway on this worker host
mitts build --release -p prod-code-gateway --bin prod-code-server

# Start gateway server directly
prod-code-server --bind 0.0.0.0:9400 --storage /srv/prod-code/workspaces \
  --advertise 192.0.2.10:9400 --peers 192.0.2.11:9400,192.0.2.12:9400

# Or run with declarative gateway.toml
prod-code-server --config /etc/prod-code/gateway.toml

In an editor

prod-code lsp is an editor's language server. The language's own server (rust-analyzer, gopls, clangd, basedpyright, the TypeScript server, sourcekit-lsp) runs on the node, started for the editor's session in the node's copy of the checkout, and the bridge carries the protocol both ways:

• The editor's settings, rust-analyzer's check on save and the server's protocol extensions work as they do with a local server.
• A save reaches the node before the server hears of it.
• Files the server points at that exist only on the node (the standard library, dependency caches, generated files) are mirrored read-only under the user's cache directory.
• --language picks the server for one language of a mixed checkout.
• After a gateway interruption, the bridge retries for up to two minutes and restores open documents, including unsaved edits. Set PROD_CODE_RECONNECT=false to disable retries for ordinary disconnects; redirects and workspace model changes still reconnect. Requests already in flight are rejected so the editor can retry against the restored state. A stalled state replay is bounded and terminates the session instead of risking a partial editor-protocol frame; incompatible sync capabilities require a fresh session. While reconnecting, up to 2,048 editor messages and 32 MiB are queued; exceeding either limit ends the session rather than silently discarding edits. PROD_CODE_LSP_TRACE can name a local trace file containing the client version, message metadata and reconnect events without document contents. A running bridge keeps its current client executable until its editor language-server session is restarted.

For Zed there is an extension in editors/zed. Or point Zed's own rust-analyzer at prod-code lsp --language rust, which keeps everything Zed wires to rust-analyzer.

What it gives an agent

Tools use the node that holds the workspace. The tables describe current source; check CHANGELOG.md for the version that contains a change.

For a Git worktree, run the CLI from that worktree to select it. In an existing MCP session, supported navigation and grep calls can select another worktree of the same repository with workspace: "/absolute/path/to/worktree". Relative paths in the call resolve against that worktree. Omitting workspace uses the MCP session's configured workspace. For these calls, use filesystem paths without .. components; file URIs are not accepted.

code_source and prod-code source <path> --line N --context K read checkout files directly with the existing byte limit and line window; their language server is not required. External library and SDK paths retain gateway routing and access checks.

Find code

tool	what it does
code_search	find code by natural language query; ranked declarations with matching doc comments (dense embeddings fused with lexical ranking)
code_symbols	workspace symbol index by name, fuzzy matching, analyzer-backed
code_definition · code_references	exact symbol definition location; every reference and usage across the workspace
code_callers · code_callees · code_implementations · code_supertypes	call hierarchy in both directions as a tree to requested depth; trait/interface implementations, and supertypes or required traits
code_outline	declaration outline with kinds and line numbers for a single file or every source file in a directory
code_source	read stdlib, crate/package registry and SDK sources that live cached only on the gateway node
code_structural_search	AST pattern search across polyglot languages using metavariables ($name) without brittle regex
code_find_duplicates	clone and duplicate block detection across workspace files using Type-1 and Type-2 AST hashing

Understand it without reading everything

tool	what it does
code_slice	bounded transitive traversal of declarations referenced by a symbol; depth and byte budgets limit result size
code_hover · code_type_at	signature, precise inferred type, documentation, and markdown hover information
code_impact	blast radius of uncommitted changes: changed functions, reachable callers, and candidate tests
code_dependencies	workspace dependency graph analysis, direct and transitive dependencies, coupling metrics, and cycle detection
code_dead_code	reference-based unreferenced candidate declarations, marking unverified and protected symbols
code_prune_orphans	eligible dead-code candidates removed with safe delete and analyzer validation; unverified and protected symbols remain

Change it safely

Most custom planners below target Rust. The parameter, move, extract-function, wrap-return, and OOP refactoring tools also support Go, C/C++, TypeScript/JavaScript, Python, and Swift for their documented input shapes. Rename and server code actions depend on the selected language server. See ROADMAP-AUDIT.md for missing capabilities and ROADMAP.md for individual restrictions.

Analyzer diagnostics do not include every compiler or borrow-checker check. Tools with verify: "compile" can additionally run a shadow compiler check; semantic refusals still apply. A Rust file reported as unlinked-file is unchecked and cannot pass edit validation. New modules must be checked with their module declarations; new Cargo targets need a workspace reload or an explicit compiler check that includes them. Missing or malformed diagnostic reports also fail validation. Manifest and lockfile proposals need code_shadow_run with the appropriate parser or build command; JSON manifests, Markdown documentation, and SVG vector graphics are validated directly through built-in syntax parsers.

tool	what it does
code_validate_edit · code_validate_edits	in-memory analyzer diagnostics and syntax validation for proposed contents across one or many files before writing; detects broken references and schema violations
code_diagnostics	diagnostics for a file, in memory, without running a full build
code_rename · code_safe_delete	semantic rename across the workspace (a field with its accessors, with accessors); delete declaration only when zero references exist, or parameter with arguments
code_change_signature	Rust signature changes, including &name to borrow an owned parameter with every resolved call (the preview is the analyzer's check, which has no borrow checker; write with apply and verify: "compile" after a compiler check accepts it); Go reorder/removal through gopls and typed literal additions to ordinary functions with compiler checks
code_move	a declaration moved to another module across languages, with imports it takes and leaves behind
code_move_method · code_move_module	a method moved to the type of one of its parameters; a whole module moved to another parent with all referencing paths
code_extract_function	a selection extracted into a named function across languages; duplicate replacement defaults on within the file (duplicates: true); cross-file search requires other_files: true, and parameterized matching requires parameterize: true (both default false)
code_introduce_parameter_object	parameters bundled into a struct, dataclass, or object across callers and body uses
code_extract_parameter · code_inline_parameter	promote an expression to a parameter; inline a uniform constant parameter into the body
code_migrate_type	change a declared type, listing all incompatible sites before execution, with automatic .into() insertion
code_generify	turn a parameter's concrete type into a bounded generic type parameter, verifying callers against the new signature
code_invert_boolean	invert a boolean predicate, variable, or field, rewriting all conditions with identical runtime semantics
code_make_static · code_convert_to_method	turn a method that never uses self into an associated function; turn an associated function into a method
code_extract_delegate	move cohesive fields and methods to a helper delegate struct, updating accessors and instantiations
code_extract_trait · code_extract_interface	extract inherent methods into a trait or interface definition across languages with caller imports
code_loop_to_iterator	transform accumulator loops into idiomatic functional iterator chains across languages
code_introduce_variable	bind repeated expression once (let w1 = expr;) and replace occurrences safely
code_wrap_return	wrap return type in Option, Result, or Promise, adding ? or await at propagating callers
code_extract_field · code_encapsulate_field	turn an expression into a struct field; encapsulate a public field with getters/setters
code_schema_rename	rename a database/serialization schema field across multi-language models
code_assists · code_assist	list and apply analyzer code actions, quick fixes, and compiler suggestions directly to checkout
code_codemod	structural search and replace on syntax trees (pattern ==>> replacement), as diff or applied
code_generate_fixture	synthesize valid typed test fixtures and builders from struct definitions with default fallbacks
code_propose_expression	synthesize valid in-scope expressions evaluating to a requested target type
code_pull_up · code_push_down	pull members up to a superclass/trait or push members down to subclasses/implementors
code_replace_constructor_with_factory	replace direct constructor calls with named static factory methods
code_replace_constructor_with_builder	transform multi-parameter constructors into fluent builder patterns
code_replace_inheritance_with_delegation	refactor class inheritance hierarchies into composition and delegation
code_replace_conditional_with_polymorphism	replace switch/match/if-else conditionals with polymorphic dispatch
code_shadow_run	compare hypotheses and return the winning diff; concurrent overlays where supported (RAM optional), otherwise serialized in-place execution on the worker mirror

For a small one-off source change, use a contextual editor or patch and inspect the diff. For repeated structural changes, preview code_codemod or use the relevant refactoring tool before applying it.

Run it

tool	what it does
code_check · code_lint · code_test · code_benchmarks	compile check, lint, test, and benchmark on the node with parsed diagnostics; path narrows scope; fix: true applies compiler fixes
code_exec	execute any build or toolchain command in remote workspace copy; modified files, formatters, and lockfiles are written back
code_pull	retrieve files and compiled artifacts from the last execution node, preserving executable permissions; reports the node and checkout copy
code_diagnose_failure	run tests and generate diagnostic failure dossiers with sites, callers, changes, and printed assertion operands

Operate it

tool	what it does
code_status · code_sync	gateway health, registered engines, loaded workspaces, and running builds/tests; manual delta sync push or pull
code_report_issue	report a bug or missing feature directly to GitHub with sanitized diagnostics and automated issue deduplication

Every position tool also takes symbol instead of a file and a position, so an agent never has to grep for a line number:

{ "name": "code_callers", "arguments": { "symbol": "Metrics::record" } }

The same surface exists as a CLI for humans and scripts: prod-code search | slice | codemod | fixture | change-signature | schema-rename | migrate-type | move | move-method | move-module | parameter-object | extract-parameter | extract-field | encapsulate-field | wrap-return | make-static | convert-to-method | inline-parameter | introduce-variable | extract-trait | extract-interface | extract-delegate | pull-up | push-down | replace-constructor-with-factory | replace-constructor-with-builder | replace-inheritance-with-delegation | replace-conditional-with-polymorphism | prune | loop-to-iterator | invert-boolean | generify | hover | def | refs | callers | callees | impls | supertypes | symbols | outline | validate | diagnostics | check | lint | test | benchmarks | exec | impact | diagnose | rename | assists | assist | safe-delete | dead-code | dependencies | duplicates | structural-search | propose-expression | shadow-run | source | status | cluster | resolve | sync | pull | update | package | cert | metrics. The position commands take --symbol NAME instead of a file and a position, prod-code symbols <name> finds a declaration by name, and prod-code validate FILE --from NEW --with OTHER=NEW2 checks a multi-file change in one overlay.