Field-by-field comparison
Compare the evidence before choosing an MCP.
Each signal stays separate, missing facts remain visible, and the column order follows your selection.
| Evidence field | Codebase MemoryMCP100 Selected | codaMCP100 Selected |
|---|---|---|
| Task fit | ||
| Best for |
|
|
| Not ideal for |
|
|
| Avoid when |
|
|
| Provenance | ||
| Provenance details | Community implementation io.github.DeusData · Publisher source ↗ | First-party MCP ecosystem:coda · Publisher source ↗ |
| Maintenance | ||
| Maintenance details | Repo: Aug 14, 2026 Package: Aug 14, 2026 | Repo: Not documented Package: Not documented |
| Popularity evidence | ||
| GitHub stars | 38,935 GitHub stars · checked 2026-08-14T18:46:26.000Z | Not documented |
| 30-day package downloads | 28,015 30-day package downloads · checked 2026-08-14T18:46:26.000Z | No reliable download data |
| External adoption evidence |
| Not documented |
| Client coverage | ||
| Client coverage details | Claude Code✓ Local stdio Claude Desktop✓ Local stdio Codex✓ Local stdio VS Code✓ Local stdio Cursor✓ Local stdio OpenCode✓ Local stdio | Claude Code✓ Streamable HTTP Claude Desktop✓ Streamable HTTP Codex✓ Streamable HTTP VS Code✓ Streamable HTTP Cursor✓ Streamable HTTP OpenCode✓ Streamable HTTP |
| Client coverage note | Local stdio runs on your computer. Streamable HTTP connects to a remotely hosted MCP server. | |
| Access and data | ||
| Authentication | No authentication or API key is documented for local stdio. CBM_ALLOWED_ROOT is an optional filesystem containment control; no containment is imposed when it is unset. | The official hosted endpoint supports OAuth 2 and personal access tokens. |
| Cost | The MIT-licensed native software lists no service fee. Local storage and package-manager costs are separate. | The MCP integration has no separately verified MCP100 price conclusion. Publisher subscriptions, API usage, compute, storage, and AI-client charges may apply. |
| Permissions | Indexes repositories, queries code and graphs, performs architecture and impact analysis, manages ADRs and watchers, deletes projects, and writes agent configuration, instruction, Skill, and hook files. | Coda document sharing, user permissions, admin controls, and OAuth or PAT scope determine access. |
| Data handling | The publisher says processing is local and code does not leave the machine. Indexes, embeddings, memories, SQLite data, and logs persist under the local CBM cache directory. | Authorized service data and tool results pass through the MCP server to the connected AI client. Review the publisher and client data policies before using sensitive files & knowledge information. |
| Limitations | ||
| Tradeoffs |
|
|
| Risk context | Indexing can capture sensitive files, while persistent graph data and installer/configuration writes expand local exposure. Set CBM_ALLOWED_ROOT, protect the cache, and use explicit project paths. | Documents and tables can contain broad internal knowledge, and write tools can alter shared operational records. Use a test environment where practical, least-privilege credentials, narrowly enabled tools, and explicit confirmation for mutations. MCP100 did not execute third-party server code during this documentation review. |
| Evidence date | ||
| Editorial review | 2026-08-11 | 2026-07-30 |
| Candidate evidence | 2026-08-14T18:46:26.000Z | 2026-07-30T19:00:00.000Z |
Popularity, maintenance, fit, permissions, and client support are independent evidence fields.
Read the evidence method →