securityreview-kit

Bootstrap security-review-mcp for AI IDEs and CLI tools in one command.

securityreview-kit configures the SRAI security review MCP server and installs workspace rules so your AI assistant consults security threat models and countermeasures before generating code.

Quick Start

# Interactive mode (recommended)
npx securityreview-kit init

# Or specify targets directly
npx securityreview-kit init --target cursor --api-url https://api.example.com --api-key YOUR_TOKEN

# Install for multiple targets
npx securityreview-kit init --target cursor claude vscode

# Install for all supported targets
npx securityreview-kit init --all --api-url https://api.example.com --api-key YOUR_TOKEN

# Re-open project selection menu and update installed rules
npx securityreview-kit init --switch-project

Supported Targets

| Target | Flag | MCP Config | Workspace Rule | |---|---|---|---| | Cursor | cursor | .cursor/mcp.json | .cursor/rules/srai-security-review.mdc, .cursor/rules/ctm_sync_rule.mdc, .cursor/commands/ctm_sync.md, .cursor/agents/ctm_sync.md, .cursor/commands/create-ide-workflow.md, .cursor/commands/srai-profile.md, .cursor/skills/threat-modelling/SKILL.md | | Claude Code | claude | .claude/settings.json | CLAUDE.md | | VS Code Copilot | vscode | .vscode/mcp.json | .github/copilot-instructions.md | | Windsurf | windsurf | .windsurf/mcp_config.json | .windsurf/rules/srai-security-review.md | | Codex | codex | .codex/config.toml | AGENTS.md | | Gemini CLI | gemini | .gemini/settings.json | GEMINI.md | | Antigravity | antigravity | .gemini/settings.json | .agents/rules/srai-security-review.md |

Commands

securityreview-kit init

Configure security-review-mcp for your IDE/CLI. Runs interactively when no flags are provided.

Options:
  -t, --target <name...>  Target IDE/CLI (cursor, claude, vscode, windsurf, codex, gemini, antigravity)
  -a, --all               Install for all supported targets
  --project-name <name>   (Optional) Preselect project name from fetched API project list
  --api-url <url>         SRAI API URL (or set SECURITY_REVIEW_API_URL env var)
  --api-key <token>       SRAI API Token (or set SECURITY_REVIEW_API_TOKEN env var)
  --switch-project        Fetch projects and only update mapped workspace rules
  --skip-mcp              Skip MCP server config installation
  --skip-rules            Skip workspace rule installation

securityreview-kit init --switch-project

Fetches projects from https://<api-url>/api/projects/ using Authorization: Bearer <api-key>, shows a single-select menu, and updates installed workspace rules with the selected project.

securityreview-kit status

Show current configuration status for all supported targets in the workspace.

Environment Variables

| Variable | Description | |---|---| | SECURITY_REVIEW_PROJECT_NAME | Optional default project name to preselect in the project menu | | SECURITY_REVIEW_API_URL | SRAI platform API endpoint | | SECURITY_REVIEW_API_TOKEN | Your SRAI API token |

These can be provided via CLI flags, environment variables, or interactive prompts.

What Gets Installed

MCP Server Config — tells your IDE how to launch the security-review-mcp server via npx.

Workspace Rules — instructs the AI assistant to consult SRAI threat models and countermeasures before generating security-relevant code. If configured, the selected SRAI project name is injected into the MCP workflow instructions in the installed rule content.

How It Works

1. Run securityreview-kit init
2. Select your IDE/CLI target(s)
3. Choose whether to install workspace rules and MCP config
4. If MCP is selected, enter your SRAI credentials (API URL, token)
5. The tool fetches /api/projects/ and you select exactly one SRAI project from the menu
6. The tool creates/merges MCP config and workspace rule files
7. Your AI assistant now has access to SRAI security reviews

The tool is idempotent — running it multiple times safely updates existing configs without duplicating content.