sphior-code-mcp

Official Model Context Protocol (MCP) server for SPHIOR CODE — surface security findings from your GitHub repositories directly inside any MCP-compatible AI coding assistant.

What this gives you

Your AI assistant can now answer questions like:

• "What are the highest-severity vulnerabilities in my code right now?"
• "Show me the fix for finding abc-123."
• "Mark this SQL injection alert as resolved — I just fixed it."
• "What's our overall security posture this month?"

…using live data from SPHIOR's scanning engine — deterministic SAST (secrets + CWE patterns, analysed with real parsers across 14 languages) and SCA powered by OSV.dev. No AI is involved in detection, so the same code always produces the same findings.

Supported clients

This is a standard MCP stdio server, so it works with any MCP-compatible client:

| Client | Config location | Setup | |---|---|---| | Cursor | ~/.cursor/mcp.json | Add MCP | | Claude Code | ~/.claude.json | claude mcp add sphior-code -- npx sphior-code-mcp | | VS Code | ~/.config/Code/User/settings.json (mcp.servers) | Built-in MCP | | GitHub Copilot (VS Code) | .vscode/mcp.json | Native MCP | | Cline (VS Code extension) | ~/.config/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json | Settings UI | | Continue (VS Code extension) | ~/.continue/config.yaml | mcpServers: section | | Windsurf | ~/.codeium/windsurf/mcp_config.json | Settings UI | | Zed | ~/.config/zed/settings.json (context_servers) | Native MCP | | JetBrains AI Assistant (2024.3+) | Settings → Tools → AI Assistant → MCP | Built-in |

Installation

# No install needed — use npx
npx -y sphior-code-mcp

# Or install globally
npm install -g sphior-code-mcp
sphior-code-mcp

Configuration

Set your API key from sphior.com/account/api:

export SPHIOR_API_KEY=sk_live_xxxxxxxxxxxx

Environment variables

| Variable | Required | Default | Description | |---|---|---|---| | SPHIOR_API_KEY | ✅ Yes | — | Bearer token from your SPHIOR Code account | | SPHIOR_API_BASE | No | https://sphior.com/api/v1 | Override for self-hosted / regional deployments | | SPHIOR_TIMEOUT | No | 30000 | Request timeout in ms (1000–300000) | | SPHIOR_DEBUG | No | false | Enable verbose logging to stderr |

Example config (Cursor / Claude Code / VS Code style)

{
  "mcpServers": {
    "sphior-code": {
      "command": "npx",
      "args": ["-y", "sphior-code-mcp"],
      "env": {
        "SPHIOR_API_KEY": "sk_live_xxxxxxxxxxxx"
      }
    }
  }
}

For GitHub Copilot in VS Code, use "servers" instead of "mcpServers":

{
  "servers": {
    "sphior-code": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "sphior-code-mcp"],
      "env": {
        "SPHIOR_API_KEY": "sk_live_xxxxxxxxxxxx"
      }
    }
  }
}

Tools exposed

| Tool | Purpose | |---|---| | list_findings | List vulnerabilities (filter by severity / status / limit) | | get_finding | Full details for one finding (CVSS, CWE, file path, fix hint) | | get_security_summary | Posture overview (counts by severity, last scan, repos monitored) | | resolve_finding | Mark as fixed | | mark_false_positive | Mark as not exploitable | | health_check | Verify connection + auth |

Resources exposed

• sphior-code://summary — JSON snapshot of current posture
• sphior-code://findings/{id} — full detail per finding (auto-listed for open findings)

Reliability

• Exponential backoff retry on 5xx / network errors (3 attempts)
• 30-second request timeout (configurable)
• Graceful degradation — auth errors fail fast, server errors retry
• Structured errors with actionable hints
• stderr-only logging (stdout is reserved for MCP protocol)

Development

# In this directory
npm install
npm run build
SPHIOR_API_KEY=sk_test_xxx node bin/sphior-code-mcp.js
# Type a JSON-RPC request to test

License

MIT © SPHIOR Security

Links

• 🌐 SPHIOR Code
• 📖 API Reference
• 🐛 Report issues
• 🔑 Get an API key