Security Review MCP

TypeScript MCP server for SecurityReview.ai, published as an npx-runnable package.

• Pure Node runtime (no Python bootstrap)
• Stdio MCP server compatible with Cursor, Windsurf, Claude Desktop, ChatGPT MCP, and other MCP clients
• 42 tools for project/document/review/workflow/integration operations
• 8 built-in security-analysis prompts
• 4 read-only MCP resources

Install / Run

Run directly with npx:

npx -y security-review-mcp \
  --api-url https://api.example.com \
  --api-token YOUR_API_TOKEN

Or provide credentials via .env in your current working directory:

SECURITY_REVIEW_API_URL=https://api.example.com
SECURITY_REVIEW_API_TOKEN=YOUR_API_TOKEN

Then run:

npx -y security-review-mcp

MCP Client Configuration

Cursor / Windsurf

{
  "mcpServers": {
    "security-review-mcp": {
      "command": "npx",
      "args": ["-y", "security-review-mcp"],
      "env": {
        "SECURITY_REVIEW_API_URL": "https://api.example.com",
        "SECURITY_REVIEW_API_TOKEN": "YOUR_API_TOKEN"
      }
    }
  }
}

With Jira + Confluence Integration

{
  "mcpServers": {
    "security-review-mcp": {
      "command": "npx",
      "args": ["-y", "security-review-mcp"],
      "env": {
        "SECURITY_REVIEW_API_URL": "https://api.example.com",
        "SECURITY_REVIEW_API_TOKEN": "YOUR_API_TOKEN",
        "JIRA_BASE_URL": "https://yourcompany.atlassian.net",
        "JIRA_EMAIL": "[email protected]",
        "JIRA_API_TOKEN": "YOUR_JIRA_TOKEN",
        "CONFLUENCE_BASE_URL": "https://yourcompany.atlassian.net",
        "CONFLUENCE_EMAIL": "[email protected]",
        "CONFLUENCE_API_TOKEN": "YOUR_CONFLUENCE_TOKEN"
      }
    }
  }
}

Environment Variables

| Variable | Required | Description | |---|---:|---| | SECURITY_REVIEW_API_URL | Yes* | SecurityReview API base URL | | SECURITY_REVIEW_API_TOKEN | Yes* | SecurityReview API bearer token | | SRAI_API_URL | Yes* | Backward-compatible API URL alias | | SRAI_API_TOKEN | Yes* | Backward-compatible API token alias | | JIRA_BASE_URL | No | Jira base URL | | JIRA_EMAIL | No | Jira user email | | JIRA_API_TOKEN | No | Jira API token | | CONFLUENCE_BASE_URL | No | Confluence base URL | | CONFLUENCE_EMAIL | No | Confluence user email | | CONFLUENCE_API_TOKEN | No | Confluence API token |

* Either SECURITY_REVIEW_* or SRAI_* must be present.

CLI Options

• --api-url <url>
• --api-token <token>
• --env-file <path>
• --jira-base-url <url>
• --jira-email <email>
• --jira-api-token <token>
• --confluence-base-url <url>
• --confluence-email <email>
• --confluence-api-token <token>
• --print-config
• --help

Compatibility flags (no-op, retained for older configs):

• --python <path>
• --force-install

Tool Catalog (42)

Projects

| Tool | Purpose | |---|---| | list_projects | List all projects | | get_project | Get project details by ID | | create_project | Create a new project | | get_project_settings | Get project settings/configuration | | get_latest_profile_version | Get latest project profile version by project ID |

Documents

| Tool | Purpose | |---|---| | list_documents | List project documents | | get_document | Get document details by ID | | get_document_evaluation | Get processed document evaluation | | upload_component_diagram | Upload component diagram from local file path | | upload_document | Upload base64 file content | | create_document_from_content | Create/upload a text document from content | | link_external_document | Link Jira/Confluence/GitHub document references |

Reviews

| Tool | Purpose | |---|---| | find_project_by_name | Fuzzy project lookup by name | | list_reviews | List reviews in a project | | list_reviews_by_project_name | Resolve project name then list reviews | | get_review | Get review details by ID | | get_review_overview | Build intent-focused review summary and artifacts | | create_review | Create a review with step config | | get_review_resource_documents | List available docs for review creation | | get_review_resource_compliance | List available compliance frameworks |

Workflow

| Tool | Purpose | |---|---| | list_ai_ide_workflows | List AI IDE workflows in a project | | get_ai_ide_workflow | Get AI IDE workflow by ID | | create_ai_ide_workflow | Create AI IDE workflow for a project | | create_ai_ide_event | Create AI IDE event within a workflow | | start_workflow | Start review workflow | | get_workflow_status | Get workflow status | | get_workflow_job_status | Get status for a specific job | | start_next_workflow_job | Start next pending job | | start_workflow_job | Start specific job by ID | | retry_workflow_job | Retry a failed job |

Integrations

| Tool | Purpose | |---|---| | fetch_jira_issue | Fetch Jira issue content | | fetch_confluence_page | Fetch Confluence page by ID or URL | | search_confluence_pages | Search Confluence via CQL | | fetch_and_link_to_srai | Link Jira/Confluence source to SRAI project |

Review Artifacts

| Tool | Purpose | |---|---| | get_security_objectives | Fetch review security objectives | | get_threat_scenarios | Fetch threat scenarios | | get_countermeasures | Fetch countermeasures | | get_components | Fetch identified system components/entities | | get_data_dictionaries | Fetch data dictionaries | | get_questions | Fetch generated security questions | | get_findings | Fetch review findings | | get_security_test_cases | Fetch security test cases |

Prompt Catalog (8)

| Prompt | Purpose | |---|---| | full_security_analysis | End-to-end structured security review | | security_objectives_analysis | Security objectives and requirement extraction | | component_analysis | Architecture/component extraction | | data_dictionary_analysis | Sensitive data and stepping stone identification | | threat_analysis | Threat generation with CVSS-oriented guidance | | countermeasure_analysis | Mitigation/control generation | | code_security_review | Security-focused code review guidance | | document_generation | Generate architecture/API/deployment documents from brief input |

Resource Catalog (4)

| Resource URI | Description | |---|---| | srai://projects | List all projects | | srai://projects/{project_id}/reviews | List project reviews | | srai://projects/{project_id}/reviews/{review_id}/summary | Review summary | | srai://projects/{project_id}/documents | List project documents |

Typical Workflows

1) Review Existing Project Artifacts

1. find_project_by_name
2. list_reviews_by_project_name
3. get_review_overview
4. get_threat_scenarios / get_findings

2) Create a New Review from Documents

1. create_project
2. upload_document or create_document_from_content
3. create_review
4. start_workflow
5. get_workflow_status

3) Bring in Jira/Confluence Context

1. fetch_jira_issue or fetch_confluence_page
2. link_external_document or fetch_and_link_to_srai
3. create_review

Troubleshooting

| Issue | Cause | Fix | |---|---|---| | Missing API URL | API URL not set | Set SECURITY_REVIEW_API_URL or SRAI_API_URL | | Missing API token | API token not set | Set SECURITY_REVIEW_API_TOKEN or SRAI_API_TOKEN | | Integration tool returns config error | Jira/Confluence env vars missing | Set required integration env vars | | npx install errors | Network/auth/cache issue | Retry with a valid npm auth/network setup; clear/fix npm cache if needed |

Development

npm install
npm run build
node dist/bin/security-review-mcp.js --help

Runtime Requirements

• Node.js >=18

License

UNLICENSED