CodeSherlock MCP Server

AI-powered code analysis inside your AI assistant.

CodeSherlock MCP Server connects to Claude Code, Cursor, Windsurf, VS Code, Cline, and other MCP-compatible tools — letting your AI assistant scan commits and working-tree changes for security, quality, and compliance issues without leaving your IDE.

Features

• Analyze the latest commit — scan files changed in your most recent commit before you push
• Analyze uncommitted changes — catch issues on staged and unstaged files before you commit
• Framework-focused analysis — OWASP Top 10, CWE/MITRE, CISA Known Exploited Vulnerabilities, or a combined power analysis
• Works with every major AI assistant — Claude Code, Cursor, Windsurf, VS Code (Copilot), Cline, Antigravity, and any other MCP-compatible host
• Zero global install required — runs via npx with no permanent footprint

Prerequisites

• Node.js 18 or later
• npm 7 or later
• A Git repository with committed or staged changes to analyze
• An AI coding assistant that supports MCP
• A CodeSherlock API key (get one here)

Quick Start

The server runs via npx , no global installation needed. All you need is your API key and one configuration block added to your AI assistant's MCP settings file.

Configuration

Add the block below to your AI assistant's MCP configuration file. Replace your-api-key-here with your actual key.

Cursor

Open Settings -> Tools & MCP -> New MCP Server and Add the configuration below to mcp.json

{
  "mcpServers": {
    "codesherlock": {
      "name": "CodeSherlock MCP Server",
      "description": "CodeSherlock is an AI- based code analysis tool that validates unstaged changes and commits directly inside IDEs and AI Agents. It helps developers catch security, quality, and design issues early by combining deep analysis with compliance-aware checks OWASP, CWE, SOC-2 at the moment code is written. CodeSherlock also performs other security vulnerability reviews along with Maintainability, Reliability and Scalability checks. Use CodeSherlock to review and validate code especially generated via AI.",
      "command": "npx",
      "args": [
        "-y",
        "@codesherlock/codesherlock-mcp-server"
      ],
      "env": {
        "MCP_API_KEY": "your-api-key-here"
      }
    }
  }
}

Save the mcp.json -> Restart Cursor. The server should appear under Tools & MCP with 1 tool enabled.

Antigravity

In the Antigravity agent chat window, click the three dots (...) menu. → Manage MCP Servers → View raw config** and paste:

{
  "mcpServers": {
    "codesherlock": {
      "name": "CodeSherlock MCP Server",
      "description": "CodeSherlock is an AI- based code analysis tool that validates unstaged changes and commits directly inside IDEs and AI Agents. It helps developers catch security, quality, and design issues early by combining deep analysis with compliance-aware checks OWASP, CWE, SOC-2 at the moment code is written. CodeSherlock also performs other security vulnerability reviews along with Maintainability, Reliability and Scalability checks. Use CodeSherlock to review and validate code especially generated via AI.",
      "command": "npx",
      "args": [
        "-y",
        "@codesherlock/codesherlock-mcp-server"
      ],
      "env": {
        "MCP_API_KEY": "your-api-key-here"
      }
    }
  }
}

save the mcp.json -> Click Refresh on the Manage MCP Servers page. -> restart Antigravity if needed.

Windsurf

Open Settings → MCP Servers → Open MCP Marketplace → Settings gear and add to mcp_config.json:

{
  "mcpServers": {
    "codesherlock": {
      "name": "CodeSherlock MCP Server",
      "description": "CodeSherlock is an AI- based code analysis tool that validates unstaged changes and commits directly inside IDEs and AI Agents. It helps developers catch security, quality, and design issues early by combining deep analysis with compliance-aware checks OWASP, CWE, SOC-2 at the moment code is written. CodeSherlock also performs other security vulnerability reviews along with Maintainability, Reliability and Scalability checks. Use CodeSherlock to review and validate code especially generated via AI.",
      "command": "npx",
      "args": [
        "-y",
        "@codesherlock/codesherlock-mcp-server"
      ],
      "env": {
        "MCP_API_KEY": "your-api-key-here"
      }
    }
  }
}

save the mcp_config.json -> Restart Windsurf

Claude Code

Run once in your terminal:

claude mcp add --transport stdio codesherlock --env MCP_API_KEY=your-api-key-here -- cmd /c npx -y @codesherlock/codesherlock-mcp-server

Verify with:

claude mcp list

To remove:

claude mcp remove codesherlock

Or add manually to your Claude config file:

{
  "mcpServers": {
    "codesherlock": {
      "name": "CodeSherlock MCP Server",
      "description": "CodeSherlock is an AI- based code analysis tool that validates unstaged changes and commits directly inside IDEs and AI Agents. It helps developers catch security, quality, and design issues early by combining deep analysis with compliance-aware checks OWASP, CWE, SOC-2 at the moment code is written. CodeSherlock also performs other security vulnerability reviews along with Maintainability, Reliability and Scalability checks. Use CodeSherlock to review and validate code especially generated via AI.",
      "command": "npx",
      "args": [
        "-y",
        "@codesherlock/codesherlock-mcp-server"
      ],
      "env": {
        "MCP_API_KEY": "your-api-key-here"
      }
    }
  }
}

VS Code (GitHub Copilot)

Press Ctrl+Shift+P → MCP: Open User Configuration and add the below configuration to json file:

{
  "servers": {
    "codesherlock": {
      "name": "CodeSherlock MCP Server",
      "description": "CodeSherlock is an AI- based code analysis tool that validates unstaged changes and commits directly inside IDEs and AI Agents. It helps developers catch security, quality, and design issues early by combining deep analysis with compliance-aware checks OWASP, CWE, SOC-2 at the moment code is written. CodeSherlock also performs other security vulnerability reviews along with Maintainability, Reliability and Scalability checks. Use CodeSherlock to review and validate code especially generated via AI.",
      "command": "npx",
      "args": [
        "-y",
        "@codesherlock/codesherlock-mcp-server"
      ],
      "env": {
        "MCP_API_KEY": "your-api-key-here"
      }
    }
  }
}

save the json file -> Restart VS Code. The tool will appear when you type @ in the Copilot Chat panel.

Cline

Open the Cline panel → Manage MCP Servers → Settings gear → Configure MCP Servers and add to cline_mcp_settings.json:

{
  "mcpServers": {
    "codesherlock": {
      "name": "CodeSherlock MCP Server",
      "description": "CodeSherlock is an AI- based code analysis tool that validates unstaged changes and commits directly inside IDEs and AI Agents. It helps developers catch security, quality, and design issues early by combining deep analysis with compliance-aware checks OWASP, CWE, SOC-2 at the moment code is written. CodeSherlock also performs other security vulnerability reviews along with Maintainability, Reliability and Scalability checks. Use CodeSherlock to review and validate code especially generated via AI.",
      "command": "npx",
      "args": [
        "-y",
        "@codesherlock/codesherlock-mcp-server"
      ],
      "env": {
        "MCP_API_KEY": "your-api-key-here"
      }
    }
  }
}

save -> restart VS Code -> In the MCP server section you can see the codesherlock mcp server.

Usage

Once configured, prompt your AI assistant — it will call the codesherlock_analyze tool automatically.

Example prompts

Review my uncommitted changes using CodeSherlock

Use CodeSherlock to check my uncommitted code for CWE MITRE vulnerabilities

Analyze my latest commit for OWASP vulnerabilities using CodeSherlock

Check the last commit in my current repo for CWE KEV issues with CodeSherlock

Analysis Types

| Factor | What it checks | |---|---| | power_analysis | Security, quality, and compliance combined (default) | | owasp | OWASP Top 10 vulnerabilities | | cwe_mitre | CWE/MITRE weakness catalog | | cwe_kev | CISA Known Exploited Vulnerabilities |

Understanding Results

Your AI assistant presents results grouped by file. Each issue includes:

• Severity level — CRITICAL, HIGH, MEDIUM, or LOW
• Issue category — e.g., Security, Reliability, Maintainability
• Affected file and line numbers
• Description of the problem
• Recommended fix with example code

Severity levels

| Label | Meaning | |---|---| | CRITICAL | Must fix immediately — actively exploitable | | HIGH | Fix before merging — serious risk | | MEDIUM | Fix soon — moderate risk | | LOW | Best-practice improvement |

Troubleshooting

Server not found or fails to start

• Run npx -y @codesherlock/codesherlock-mcp-server in your system terminal. If it fails there, the issue is with your Node.js/npm setup or network access — not the IDE. If it succeeds in the terminal but not the IDE, recheck your config JSON for syntax errors and restart the IDE.

Authentication failed or Invalid API key

• Verify your API key is correctly added to the configuration
• Check for extra spaces in the key value.
• Regenerate from the dashboard and restart your AI assistant.
• Ensure you've restarted your AI assistant after adding the key

Not a Git repository

• Ensure the directory you are analyzing contains a .git folder. Run git init if needed.

No changes to analyze

• For uncommitted analysis, ensure you have modified files.
• For commit analysis, verify the commit exists with git log.
• Check that you're in the correct Git repository

Analysis times out or takes too long

• Start with analyzing specific files or smaller changesets
• Check your internet connection
• Break large changes into smaller commits for analysis

Stale NPX cache causing issues

Clear the cache and restart your IDE:

# macOS/Linux
rm -rf ~/.npm/_npx

# Windows (PowerShell)
Remove-Item -Recurse -Force "$env:LOCALAPPDATA\npm-cache\_npx"

Best Practices

• Before committing — analyze uncommitted changes to catch issues early
• After committing — review the latest commit before pushing or opening a PR
• Choose the right factor — OWASP for web/API security; CWE MITRE for broad weakness coverage; CWE KEV for actively exploited vulnerabilities; Power Analysis for general-purpose scanning
• Act on severity — fix Critical and High immediately; ticket Medium for the next sprint; document Low for future refactoring

Security

• Code is transmitted to the CodeSherlock backend over HTTPS
• Never commit your API key to version control
• If your key is compromised, regenerate it immediately from the dashboard

How to integrate CodeSherlock in AI-DLC workflow :

Demo video : https://youtu.be/c55BcFvonl4?si=6Df8oNaL9wQeVn5w

Documentation

Full setup guide: https://docs.codesherlock.ai/codesherlock-mcp-server/mcp/setup/guide

Support

• Issues and feedback: [email protected]
• Documentation: https://docs.codesherlock.ai

License

MIT