What It Does

This package runs a local MCP stdio server that lets MCP-compatible agents read Acrity workspace data through the Acrity public API.

The server uses an existing Acrity public API key. It does not accept or create provider secrets.

Tools

| Tool | Public API route | Required scope | | --- | --- | --- | | get_acr_context | GET /api/v1/context | Valid API key | | list_repositories | GET /api/v1/repositories | Repositories.Read | | get_repository | GET /api/v1/repositories/{id} | Repositories.Read | | list_pull_requests | GET /api/v1/pull-requests | Reviews.Read | | get_pull_request | GET /api/v1/pull-requests/detail | Reviews.Read | | list_reviews | GET /api/v1/reviews | Reviews.Read | | get_review_findings | GET /api/v1/reviews/{runId} | Reviews.Read | | check_bootstrap_eligibility | GET /api/v1/repositories/{id}/bootstrap/eligibility | Repositories.Read | | get_bootstrap_status | GET /api/v1/repositories/{id}/bootstrap | Repositories.Read | | get_bootstrap_artifact | GET /api/v1/repositories/{id}/bootstrap/artifact | Repositories.Read | | list_security_scans | GET /api/v1/security-scans | SecurityScans.Read | | get_security_scan | GET /api/v1/security-scans/{runId} | SecurityScans.Read | | start_security_scan | POST /api/v1/security-scans | SecurityScans.Write |

Configuration

ACRITY_API_KEY is required.

ACRITY_API_BASE_URL is optional and defaults to https://acrity.io.

export ACRITY_API_KEY="sk_prod_..."
export ACRITY_API_BASE_URL="https://acrity.io"
export ACRITY_MCP_TIMEOUT_MS="20000"

Recommended read-only scopes:

Repositories.Read
Reviews.Read
SecurityScans.Read

Add SecurityScans.Write only when the agent should queue manual dependency security scans with start_security_scan.

Run With npx

ACRITY_API_KEY="sk_prod_..." npx -y @acrity/mcp-server

MCP Client Configuration

{
  "mcpServers": {
    "acrity": {
      "command": "npx",
      "args": ["-y", "@acrity/mcp-server"],
      "env": {
        "ACRITY_API_KEY": "sk_prod_..."
      }
    }
  }
}

To point the server at another Acrity environment, add ACRITY_API_BASE_URL. Do not include /api; the MCP server appends /api/v1/* paths itself.

Recommended First Call

Call get_acr_context first. It verifies that the API key is active and reports available scopes before the agent attempts deeper tools.