Classic confinement request: codeseeker

store-requests classic-confinement
1 
**name:** codeseeker

**description:** CodeSeeker is a graph-powered code intelligence CLI tool and MCP (Model Context Protocol) server that provides semantic code search and knowledge graph traversal for AI assistants like Claude Code, GitHub Copilot, Cursor, and Claude Desktop.

**snapcraft:** https://github.com/jghiringhelli/codeseeker/blob/master/snap/snapcraft.yaml

**upstream:** https://github.com/jghiringhelli/codeseeker

**upstream-relation:** I am the author and maintainer of this project.

**supported-category:** IDEs (or Development workspace tools)

CodeSeeker enhances AI-powered development environments by providing semantic code understanding. It functions as an MCP server that IDEs spawn as a child process.

**reasoning:**

1. **Arbitrary filesystem access for project indexing** - The core functionality is indexing user codebases located anywhere on the filesystem. Users run `codeseeker init` in any project directory to build a knowledge graph of their code. This cannot be limited to home or removable-media.

2. **IDE configuration file writes** - Must write MCP server configuration to IDE-specific paths:
   - `~/.vscode/mcp.json` (VS Code / Claude Code)
   - `~/.cursor/mcp.json` (Cursor)
   - `~/.config/Claude/claude_desktop_config.json` (Claude Desktop)
   - `~/.windsurf/mcp.json` (Windsurf)

3. **MCP server stdio protocol** - Runs as a child process spawned by IDEs via stdio-based JSON-RPC. This requires unrestricted IPC communication that strict confinement cannot provide.

4. **Node.js and npm ecosystem access** - Requires access to globally installed npm packages and the ability to execute node binaries in the host environment.

[x] I understand that strict confinement is generally preferred over classic.

[x] I've tried the existing interfaces to make the snap work under strict confinement.

The `home` interface is insufficient because:
- Projects may be located outside $HOME (e.g., `/opt/projects`, `/var/www`, mounted drives)
- IDE config directories have varying structures that don't map cleanly to existing interfaces
- MCP protocol requires unrestricted stdio IPC

This is similar to other development tools with classic confinement such as `code` (VS Code), `node`, and various IDE snaps.
2

This request has been added to the queue for review by the @reviewers team.

3

Hi, thanks for the approval!

I’m running into two issues trying to publish:

Issue 1: Revision 1 stuck in inconsistent state

When I try to release the original revision:

snapcraft release codeseeker 1 stable

I get:

resource-not-ready: Snap cannot be published due to inconsistent state.

This revision was uploaded before classic was approved, so it seems stuck.

Issue 2: Revision 2 upload fails

Since revision 1 is stuck, I rebuilt and tried uploading a fresh snap. But now I get the classic confinement error again:

(NEEDS REVIEW) confinement 'classic' not allowed

I suspect the classic approval is tied to revision 1’s specific hash, and the new build has a different hash.

What I need:

Could you either:

  1. Clear/delete the stuck revision 1 so I can upload fresh, or

  2. Extend classic approval to cover new revisions of codeseeker

The only change between builds was adding the donation metadata field - no functional changes.

snapcraft status codeseeker shows: “This snap has no released revisions” snapcraft revisions codeseeker shows revision 1 exists but can’t be released.

Thanks for your help!

4

Hey @juanghiri

I think you misunderstood the @store-requests-bot message. It just said that your request was added to the review queue for tracking purposes, but it was never granted.

Regarding the reasoning:

1. **Arbitrary filesystem access for project indexing** - The core functionality is indexing user codebases located anywhere on the filesystem. Users run `codeseeker init` in any project directory to build a knowledge graph of their code. This cannot be limited to home or removable-media.

I think home and removable-media will suffice most use cases. Please note that access to arbitrary files on the system due to developer/user inertia is explicitly listed as unsupported in Process for reviewing classic confinement snaps

2 **IDE configuration file writes** - Must write MCP server configuration to IDE-specific paths: - `~/.vscode/mcp.json` (VS Code / Claude Code) - `~/.cursor/mcp.json` (Cursor) - `~/.config/Claude/claude_desktop_config.json` (Claude Desktop) - `~/.windsurf/mcp.json` (Windsurf)

It can be done via personal-files.

3. **MCP server stdio protocol** - Runs as a child process spawned by IDEs via stdio-based JSON-RPC. This requires unrestricted IPC communication that strict confinement cannot provide.

I’m not familiar with this, so I cannot give any recommendation here.

4. **Node.js and npm ecosystem access** - Requires access to globally installed npm packages and the ability to execute node binaries in the host environment.

You should ship everything needed in your snap instead.

In addition, classic confinement is a sensitive matter and it is reserved for mature, well-known applications published by mature, well-known entities. As of today, I believe that codeseeker doesn’t meet this criteria because of the following reasons:

  • The project seems to be very fresh, according to the upstream repository

  • The projects seems to have little/none community around according to upstream repository (contributors, issues, PRs, etc.)

  • I could not find evidences that the project has a strong enough user base currently

Considering all these factors, I think codeseeker should not get classic confinement as of now.

Thanks

5

Hello @jslarraz ,

Understood, I received an email that I misinterpretated. I have changed the package to strict confinement and explained that to make it work through snap the project needs to be in the home directory. Just published 1.7.2 revision 3 on stable.

Thank you!

1 Like