@codesherlock/codesherlock-prelive-mcp-server

CodeSherlock MCP Server – Setup & Usage Guide

Configure the Model Context Protocol server once and keep every commit and working tree scan consistent across your team.

Key Features

Analyze Uncommitted Changes

Scan staged and unstaged files before you commit so surprises never reach your repo.

Analyze Committed Changes

Review your latest commit to spot issues before pushing to remote or opening a PR.

Security Framework Coverage

Run checks aligned to OWASP Top 10 and the CWE catalog for focused security feedback.

Works With Your AI Assistant

Connects to AI assistants like Claude Code, Cursor, Windsurf, Cline, VS Code and other MCP-compatible tools via a lightweight server.

Prerequisites

Quick checklist to confirm before you start:

• Node.js (version 18.0.0 or higher) and npm installed on your system
• A Git repository with code you want to analyze
• An AI coding assistant that supports MCP (e.g., Claude Code, Cursor, VS Code, Cline, or similar)

The CodeSherlock MCP Server is available on the npm registry and can be used directly with npx.

Step 1: Get Your API Key

How to obtain it

• Visit the API key page: codesherlock.ai/codesherlock-mcp-server/mcp/api/key
• Sign in or create an account.
• Generate a new API key.
• Copy and store the key securely—you will be prompted for it by the MCP server.

Important security notes

• Never share your API key or commit it to version control.
• Store it in a password manager or environment variable.
• If a key is compromised, regenerate it immediately from your dashboard.

Step 2: Configure Your AI Assistant

You need to add the CodeSherlock MCP Server configuration to your AI assistant's settings. Follow the instructions for your preferred IDE/assistant below.

Quick Navigation:

• Cursor
• Antigravity
• Windsurf
• Claude Code
• VS Code - Co Pilot
• Cline

Cursor

Steps to Configure

• Click the Settings (gear icon) on the top right corner
• Settings panel opens as a new tab in the center of the screen
• In the settings sidebar, navigate to Tools & MCP section
• Click on New MCP Server/Add a custom MCP Server button
• This opens the mcp.json config file
• Add the configuration below and save
• Restart Cursor
• Verify the installation: You should see the CodeSherlock MCP Server listed as Enabled in the Tools & MCP section.
• Troubleshooting installation issues: If CodeSherlock MCP Server does not show up in Cursor under Settings → Tools & MCP, or if it appears there but is not enabled or fails to start, open your system terminal and run npx -y @codesherlock/codesherlock-mcp-server manually. This helps confirm that the package can be downloaded and executed successfully outside of Cursor. If this command fails, the issue is likely related to your local Node.js / npm / npx setup, network access, or package resolution rather than Cursor itself. If the command runs successfully in the terminal but the server still does not work inside Cursor, re-check your mcp.json configuration for formatting issues, save the file again, and restart Cursor before trying once more.

Configuration

{
  "mcpServers": {
    "codesherlock": {
      "name": "CodeSherlock MCP Server",
      "description": "CodeSherlock is an AI- based code analysis tool that validates unstaged changes and commits directly inside IDEs and AI Agents. It helps developers catch security, quality, and design issues early by combining deep analysis with compliance-aware checks OWASP, CWE, SOC-2 at the moment code is written. CodeSherlock also performs other security vulnerability reviews along with Maintainability, Reliability and Scalability checks. Use CodeSherlock to review and validate code especially generated via AI.",
      "command": "npx",
      "args": [
        "-y",
        "@codesherlock/codesherlock-mcp-server"
      ],
      "env": {
        "MCP_API_KEY": "your-api-key-here"
      }
    }
  }
}

Antigravity

Steps to Configure

• In the Antigravity agent chat window, click the three dots (...) menu.
• This opens the Manage MCP Servers page.
• On the Manage MCP Servers page, click View raw config.
• Paste the JSON configuration below into the raw config and save.
• Click the Refresh button on the same Manage MCP Servers page.
• Restart Antigravity if needed.
• Verify the installation: Open the Antigravity chat and you should see the CodeSherlock MCP Server tools available when you type @. Additionally, you can check the Manage MCP Servers page to see if it's listed and connected.

Configuration

{
  "mcpServers": {
    "codesherlock": {
      "name": "CodeSherlock MCP Server",
      "description": "CodeSherlock is an AI- based code analysis tool that validates unstaged changes and commits directly inside IDEs and AI Agents. It helps developers catch security, quality, and design issues early by combining deep analysis with compliance-aware checks OWASP, CWE, SOC-2 at the moment code is written. CodeSherlock also performs other security vulnerability reviews along with Maintainability, Reliability and Scalability checks. Use CodeSherlock to review and validate code especially generated via AI.",
      "command": "npx",
      "args": [
        "-y",
        "@codesherlock/codesherlock-mcp-server"
      ],
      "env": {
        "MCP_API_KEY": "your-api-key-here"
      }
    }
  }
}

Windsurf

Steps to Configure

• Click on the Settings (gear icon) on the top right corner and select Windsurf Settings (or press Ctrl+,)
• In the settings search box, type mcp
• Find the MCP Servers section
• Click on Open MCP Marketplace
• In the MCP Marketplace, click the Settings (gear icon) to add a custom server
• This opens the mcp_config.json config file
• Add the configuration below and save
• Restart Windsurf
• Verify the installation: Go to Windsurf Settings > MCP Servers and ensure the CodeSherlock MCP Server is listed and shows a connected or active status.

Configuration

{
  "mcpServers": {
    "codesherlock": {
      "name": "CodeSherlock MCP Server",
      "description": "CodeSherlock is an AI- based code analysis tool that validates unstaged changes and commits directly inside IDEs and AI Agents. It helps developers catch security, quality, and design issues early by combining deep analysis with compliance-aware checks OWASP, CWE, SOC-2 at the moment code is written. CodeSherlock also performs other security vulnerability reviews along with Maintainability, Reliability and Scalability checks. Use CodeSherlock to review and validate code especially generated via AI.",
      "command": "npx",
      "args": [
        "-y",
        "@codesherlock/codesherlock-mcp-server"
      ],
      "env": {
        "MCP_API_KEY": "your-api-key-here"
      }
    }
  }
}

Claude Code

Steps to Configure

• Run the following command in your terminal:

claude mcp add --transport stdio codesherlock --env MCP_API_KEY=cs_mcp_abcdef -- cmd /c npx -y @codesherlock/codesherlock-mcp-server

• Verify the configuration by running:

claude mcp list

• If the connection is successful, start Claude. If claude mcp list fails to connect, try reopening your terminal as an optional troubleshooting step.

Other useful commands:

claude mcp remove codesherlock   # Remove a server

Configuration

Manually add to config file (optional):

{
  "mcpServers": {
    "codesherlock": {
      "name": "CodeSherlock MCP Server",
      "description": "CodeSherlock is an AI- based code analysis tool that validates unstaged changes and commits directly inside IDEs and AI Agents. It helps developers catch security, quality, and design issues early by combining deep analysis with compliance-aware checks OWASP, CWE, SOC-2 at the moment code is written. CodeSherlock also performs other security vulnerability reviews along with Maintainability, Reliability and Scalability checks. Use CodeSherlock to review and validate code especially generated via AI.",
      "command": "npx",
      "args": [
        "-y",
        "@codesherlock/codesherlock-mcp-server"
      ],
      "env": {
        "MCP_API_KEY": "your-api-key-here"
      }
    }
  }
}

VS Code

Steps to Configure

Requires GitHub Copilot extension installed

• Press Ctrl+Shift+P (Windows) or Cmd+Shift+P (macOS) to open Command Palette
• Type MCP:Open User Configuration
• This opens the MCP configuration file
• Add the configuration below and save
• Restart VS Code
• Verify the installation: Open the GitHub Copilot Chat panel and type @. You should see the CodeSherlock MCP Server tools listed and available for use.

Configuration

{
  "servers": {
    "codesherlock": {
      "name": "CodeSherlock MCP Server",
      "description": "CodeSherlock is an AI- based code analysis tool that validates unstaged changes and commits directly inside IDEs and AI Agents. It helps developers catch security, quality, and design issues early by combining deep analysis with compliance-aware checks OWASP, CWE, SOC-2 at the moment code is written. CodeSherlock also performs other security vulnerability reviews along with Maintainability, Reliability and Scalability checks. Use CodeSherlock to review and validate code especially generated via AI.",
      "command": "npx",
      "args": [
        "-y",
        "@codesherlock/codesherlock-mcp-server"
      ],
      "env": {
        "MCP_API_KEY": "your-api-key-here"
      }
    }
  }
}

Cline

Cline is a VS Code extension. Install it from the VS Code marketplace or other supported IDEs.

Steps to Configure

• Open Cline panel in VS Code
• Click on Manage MCP Servers
• Click on the Settings (gear icon)
• Click on Configure MCP Servers button
• This opens the cline_mcp_settings.json config file
• Add the configuration below and save
• Restart VS Code
• Verify the installation: Open the Cline panel and go to the MCP Servers section. You should see the CodeSherlock MCP Server listed with a green status indicator, confirming it is connected and active.

Configuration

{
  "mcpServers": {
    "codesherlock": {
      "name": "CodeSherlock MCP Server",
      "description": "CodeSherlock is an AI- based code analysis tool that validates unstaged changes and commits directly inside IDEs and AI Agents. It helps developers catch security, quality, and design issues early by combining deep analysis with compliance-aware checks OWASP, CWE, SOC-2 at the moment code is written. CodeSherlock also performs other security vulnerability reviews along with Maintainability, Reliability and Scalability checks. Use CodeSherlock to review and validate code especially generated via AI.",
      "command": "npx",
      "args": [
        "-y",
        "@codesherlock/codesherlock-mcp-server"
      ],
      "env": {
        "MCP_API_KEY": "your-api-key-here"
      }
    }
  }
}

Step 3: Using CodeSherlock with Your AI Assistant

Once configured, you can start using CodeSherlock by prompting your AI assistant. The assistant will automatically invoke the MCP server tools to perform code analysis.

Analysis Types

CodeSherlock supports four analysis factors:

Factor	Description
power_analysis	A full-spectrum scan that covers the most essential and critical issues
owasp	Security analysis based on OWASP Top 10 vulnerabilities
cwe_mitre	Analyzes code against Common Weakness Enumeration (CWE) MITRE framework
cwe_kev	Analyzes code against CWE Known Exploited Vulnerabilities (KEV) catalog

Example Prompts

Drop these into your AI assistant to kick off a scan:

"Review my uncommitted changes using CodeSherlock"

"Use CodeSherlock to check my uncommitted code for CWE MITRE vulnerabilities"

"Analyze my latest commit for OWASP vulnerabilities using CodeSherlock"

"Check the last commit in my current repo for CWE KEV issues with CodeSherlock"

Understanding the Results

When Analysis Completes

The AI assistant will present the analysis results in a readable format, typically including:

• Number of issues found
• Severity levels (Critical, High, Medium, Low)
• Issue categories
• Affected files and line numbers
• Descriptions and recommendations for each issue

Troubleshooting

"Server not found" or "MCP server failed to start"

If the server does not show up in your IDE or fails to start, follow these steps:

• Manual Verification: Run npx -y @codesherlock/codesherlock-mcp-server in your system terminal.
  • If this fails: The issue is with your local Node.js/npm configuration or network access, rather than the IDE itself.
  • If this succeeds: The issue is likely with your IDE's MCP configuration.
• Check Configuration: Ensure your configuration file (e.g., mcp.json, cline_mcp_settings.json) is valid JSON and matches the format provided in the instructions above.
• Restart your IDE: Most AI assistants and IDEs require a full restart to pick up changes in MCP configuration files.

• Verify the configuration file path is correct
• Check that Node.js and npm are properly installed

"Authentication failed" or "Invalid API key"

• Verify your API key is correctly added to the configuration
• Check for any extra spaces or characters in the API key
• Regenerate your API key from the CodeSherlock dashboard
• Ensure you've restarted your AI assistant after adding the key

"Not a Git repository"

• Ensure you're analyzing a directory that contains a .git folder
• Initialize a Git repository if needed: git init

"No changes to analyze"

• For uncommitted analysis: Make sure you have modified files
• For commit analysis: Verify the commit exists using git log
• Check that you're in the correct Git repository

Analysis takes too long or times out

• Start with analyzing specific files or smaller changesets
• Check your internet connection
• Break large changes into smaller commits for analysis

General MCP host installation/run issues

If you encounter errors while installing or running the CodeSherlock MCP Server in any MCP host (Cursor, VS Code, etc.), try the following steps:

• Clear NPX cache

  Remove the cached package to force a fresh download:

  • macOS/Linux

    rm -rf ~/.npm/_npx
    

  • Windows (PowerShell)

    Remove-Item -Recurse -Force "$env:LOCALAPPDATA\npm-cache\_npx"
    

• Restart the MCP host

  Close and reopen your MCP host application (Cursor, VS Code, etc.) to ensure all connections are reset and the server is reloaded properly.

• Verify Node.js version

  Ensure you have Node.js v18 or higher installed:

  node --version
  

• Contact support

  If the issue persists after trying the above steps, please contact us at [e-mail].

Debugging NPX Execution

If you need to troubleshoot how the MCP client executes the server, understanding the internal npx behavior can be helpful:

• Execution Flow: The MCP client runs npx -y @codesherlock/codesherlock-mcp-server. The -y flag ensures non-interactive execution by automatically skipping installation prompts.
• Cache Location: npx does not install the package globally. Instead, it downloads and caches it temporarily:
  • Windows: %LOCALAPPDATA%\npm-cache\_npx\
  • Mac/Linux: ~/.npm/_npx/
• Executable Resolution: npx reads the downloaded package's bin field and maps it to execute build/index.js under the hood.
• Environment Variables: The MCP_API_KEY configured in your client settings is securely injected into the isolated Node.js process at runtime.

Best Practices

1. Integrate into Your Workflow

• Before committing: Analyze uncommitted changes to catch issues early
• After committing: Review commits before pushing to remote
• During code review: Use analysis results to supplement manual reviews

2. Choose the Right Analysis Factor

• Use OWASP Best for web applications and APIs; focuses on the OWASP Top 10 and other common web security risks.
• Use CWE MITRE Ideal when you need deeper, classification-based coverage of software weaknesses across all domains.
• Use CWE KEV Best for identifying known exploited vulnerabilities that are actively being used in attacks.
• Use Power Analysis A broad, high-coverage analysis designed to catch the most essential and critical issues across any type of project (web, mobile, backend, etc.)

3. Act on Results

• Prioritize Critical and High severity issues immediately
• Create tickets for Medium severity issues
• Document Low severity issues for future refactoring

Getting Help

If you face any issues, please send us a mail at [e-mail]. We will help you resolve the issue as soon as possible.