@finishkit/mcp

MCP server for FinishKit. Production readiness scanner for AI-built apps. Enables AI agents in Claude, Cursor, Windsurf, and VS Code to check if your code is ready to ship.

What AI Agents Can Do

| Tool | Description | |---|---| | scan_repo | Check if your app is ready to ship. Triggers a production readiness scan and returns a prioritized finish plan. | | get_scan_status | Check progress of a production readiness scan. Returns current phase and progress percentage. | | get_findings | Get the production readiness report with prioritized findings blocking launch. | | get_patches | Get auto-generated code patches that fix production readiness issues. | | list_projects | List all repositories connected to FinishKit for production readiness scanning. | | create_project | Get instructions to connect a new GitHub repository to FinishKit. | | request_intelligence_pack | Request a production readiness analysis pack tailored to your technology stack. | | sync_findings | Sync production readiness findings from a local analysis back to the FinishKit dashboard. | | finishkit_setup | Set up FinishKit or check connection status. Creates a browser-based setup link if not connected. |

Quick Start

No API key required to get started. The server starts in setup mode and guides you through connecting your account.

Option A: Browser login (recommended)

npx @finishkit/mcp login

Opens your browser. Sign in with GitHub or Google. Your editor picks up the key automatically. No copy-paste, no config editing, no restart.

Option B: Setup command

npx @finishkit/mcp setup

Auto-detects your editor and configures FinishKit. Or target a specific editor:

npx @finishkit/mcp setup --claude-code
npx @finishkit/mcp setup --cursor
npx @finishkit/mcp setup --windsurf
npx @finishkit/mcp setup --codex
npx @finishkit/mcp setup --vscode

Then ask your AI to scan your project. It will show a setup link if you haven't connected yet.

Option C: Manual configuration

Add the following to your editor's MCP config file:

Claude Desktop (~/.claude/claude_desktop_config.json), Cursor (~/.cursor/mcp.json), Windsurf (~/.codeium/windsurf/mcp_config.json), VS Code Copilot (.vscode/mcp.json):

{
  "mcpServers": {
    "finishkit": {
      "command": "npx",
      "args": ["-y", "@finishkit/mcp"],
      "env": {
        "FINISHKIT_API_KEY": "fk_live_your_key_here"
      }
    }
  }
}

Claude Code:

claude mcp add finishkit -- npx -y @finishkit/mcp

Get an API key at finishkit.app/activate.

Works Without API Key

The server always starts, even without an API key configured. This means FinishKit tools always appear in your IDE.

When called without a key, the finishkit_setup tool creates a browser-based activation link. Click the link, sign in, and your editor picks up the key on the next tool call. No restart needed.

Two tools always work without a key:

• finishkit_setup: Creates a setup link and checks connection status.
• create_project: Returns instructions for connecting a repository through the FinishKit dashboard.

Tools Reference

scan_repo (Primary Tool)

Check if your app is ready to ship. Triggers a production readiness scan on a GitHub repository, analyzing security, deployment, stability, tests, and UI completeness. Returns a prioritized finish plan with all findings. Typically takes 2-8 minutes.

| Parameter | Type | Required | Description | |---|---|---|---| | repo_owner | string | Yes | GitHub org or username (e.g., myorg) | | repo_name | string | Yes | Repository name without owner (e.g., my-app) | | run_type | enum | No | baseline (default), pr, or manual_patch | | commit_sha | string | No | Specific commit to scan; defaults to latest |

Returns: Finding counts by severity and category, human-readable summary, dashboard URL.

get_scan_status

Check progress of a production readiness scan. Returns current phase and progress percentage.

| Parameter | Type | Required | Description | |---|---|---|---| | run_id | string | Yes | Run ID from scan_repo or the dashboard |

get_findings

Get the production readiness report with prioritized findings blocking launch. Filter by category (blockers, security, deploy, stability, tests, ui) or minimum severity (critical, high, medium, low).

| Parameter | Type | Required | Description | |---|---|---|---| | run_id | string | Yes | Run ID of a completed scan | | category | enum | No | blockers, security, deploy, stability, tests, ui | | severity | enum | No | Minimum severity: critical, high, medium, low | | limit | number | No | Max findings to return (1-100, default 50) |

get_patches

Get auto-generated code patches that fix production readiness issues. Each patch includes a unified diff you can apply directly.

| Parameter | Type | Required | Description | |---|---|---|---| | run_id | string | Yes | Run ID of a completed scan |

list_projects

List all repositories connected to FinishKit for production readiness scanning. No inputs required.

create_project

Get instructions to connect a new GitHub repository to FinishKit for production readiness scanning. Works without an API key.

| Parameter | Type | Required | Description | |---|---|---|---| | repo_owner | string | Yes | GitHub org or username | | repo_name | string | Yes | Repository name |

request_intelligence_pack

Request a production readiness analysis pack tailored to your technology stack. Returns framework-specific rules, security advisories, and analysis prompts for local scanning.

| Parameter | Type | Required | Description | |---|---|---|---| | framework | string | Yes | Web framework (e.g., nextjs, remix, vite) | | language | enum | Yes | typescript or javascript | | package_manager | enum | Yes | npm, pnpm, yarn, or bun | | framework_version | string | No | Framework version (e.g., 16.0.0) | | integrations | array | No | Detected integrations (e.g., ["supabase", "stripe"]) | | dependencies | object | No | Package versions for CVE lookup | | focus | enum | No | full (default), security, api, deploy, stability |

sync_findings

Sync production readiness findings from a local analysis back to the FinishKit dashboard. Creates a run record and inserts findings with deduplication.

| Parameter | Type | Required | Description | |---|---|---|---| | project_name | string | Yes | Project display name | | agent_id | enum | Yes | claude-code, cursor, codex, windsurf, custom | | pack_id | string | Yes | Intelligence pack ID used | | pack_version | string | Yes | Intelligence pack version used | | started_at | string | Yes | ISO timestamp when analysis started | | finished_at | string | Yes | ISO timestamp when analysis finished | | detected_stack | object | Yes | Detected stack metadata | | findings | array | Yes | Array of findings from the analysis | | summary | string | Yes | Human-readable summary |

finishkit_setup

Set up FinishKit or check connection status. If not connected, creates a browser-based activation link. If connected, shows available tools. Always works, even without an API key. No inputs required.

Resources Reference

| URI | Description | |---|---| | finishkit://projects | All projects as a JSON array | | finishkit://projects/{id} | Single project details by ID | | finishkit://runs/{run_id}/findings | All findings for a scan run | | finishkit://runs/{run_id}/events | Full event log for a scan run |

For AI Agents

If you are an AI agent with access to FinishKit MCP tools:

Primary workflow: Scan a repository

1. Call scan_repo with the repository owner and name
2. The tool handles the full lifecycle (trigger, poll, wait for completion)
3. Returns finding counts by severity and category
4. Call get_findings for detailed findings list
5. Call get_patches for generated code fixes

Example: User asks "scan myorg/myapp for security issues"

scan_repo({ repo_owner: "myorg", repo_name: "myapp", run_type: "baseline" })

Then:

get_findings({ run_id: "<from scan_repo response>", category: "security" })

Handling common situations

• "FinishKit is not connected": Use finishkit_setup to get a browser activation link
• "Project not found": The repository must be connected at https://finishkit.app/dashboard first
• "Authentication failed": The API key is invalid. Run npx @finishkit/mcp login to re-authenticate
• "Plan limit reached": User needs to upgrade at https://finishkit.app/dashboard/settings

Key facts

• scan_repo typically takes 2-8 minutes. It blocks until complete, no need to poll separately.
• Findings have severity: critical, high, medium, low
• Findings have category: blockers, security, deploy, stability, tests, ui
• Critical and high findings should be fixed before production deployment

Authentication

The simplest way to authenticate is npx @finishkit/mcp login, which opens your browser and stores the key locally at ~/.finishkit/credentials.

The MCP resolves API keys in this order:

1. FINISHKIT_API_KEY environment variable (highest priority)
2. ~/.finishkit/credentials file (written by login or setup --api-key)
3. No key (setup mode with browser activation link)

To get an API key manually:

1. Visit finishkit.app/activate
2. Sign in with GitHub or Google
3. Copy the key (starts with fk_live_)

API keys authenticate via Authorization: Bearer <key> on every request. Keep your key secret and never commit it to source control.

Requirements

• Node.js 18+
• A FinishKit account (finishkit.app) for scanning (optional for setup)
• At least one repository connected to FinishKit via the GitHub App (for scanning)

Registry Listings

• Smithery
• npm: @finishkit/mcp

License

MIT - Copyright (c) 2026 FinishKit