sphior-code-mcp

sphior-code-mcp

Official Model Context Protocol (MCP) server for SPHIOR CODE — surface security findings from your GitHub repositories directly inside any MCP-compatible AI coding assistant.

What this gives you

Your AI assistant can now answer questions like:

• "What are the highest-severity vulnerabilities in my code right now?"
• "Show me the fix for finding abc-123."
• "Mark this SQL injection alert as resolved — I just fixed it."
• "What's our overall security posture this month?"

…using live data from SPHIOR CODE's scanning engine (AI SAST + SCA powered by OSV.dev).

Supported clients

This is a standard MCP stdio server, so it works with any MCP-compatible client:

Client	Config location	Setup
Cursor	~/.cursor/mcp.json	Add MCP
Claude Code	~/.claude.json	claude mcp add sphior-code -- npx sphior-code-mcp
VS Code	~/.config/Code/User/settings.json (mcp.servers)	Built-in MCP
GitHub Copilot (VS Code)	.vscode/mcp.json	Native MCP
Cline (VS Code extension)	~/.config/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json	Settings UI
Continue (VS Code extension)	~/.continue/config.yaml	mcpServers: section
Windsurf	~/.codeium/windsurf/mcp_config.json	Settings UI
Zed	~/.config/zed/settings.json (context_servers)	Native MCP
JetBrains AI Assistant (2024.3+)	Settings → Tools → AI Assistant → MCP	Built-in

Installation

# No install needed — use npx
npx -y sphior-code-mcp

# Or install globally
npm install -g sphior-code-mcp
sphior-code-mcp

Configuration

Set your API key from sphior.com/account/code/api-keys:

export SPHIOR_API_KEY=sk_live_xxxxxxxxxxxx

Environment variables

Variable	Required	Default	Description
SPHIOR_API_KEY	✅ Yes	—	Bearer token from your SPHIOR Code account
SPHIOR_API_BASE	No	https://sphior.com/api/v1	Override for self-hosted / regional deployments
SPHIOR_TIMEOUT	No	30000	Request timeout in ms (1000–300000)
SPHIOR_DEBUG	No	false	Enable verbose logging to stderr

Example config (Cursor / Claude Code / VS Code style)

{
  "mcpServers": {
    "sphior-code": {
      "command": "npx",
      "args": ["-y", "sphior-code-mcp"],
      "env": {
        "SPHIOR_API_KEY": "sk_live_xxxxxxxxxxxx"
      }
    }
  }
}

For GitHub Copilot in VS Code, use "servers" instead of "mcpServers":

{
  "servers": {
    "sphior-code": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "sphior-code-mcp"],
      "env": {
        "SPHIOR_API_KEY": "sk_live_xxxxxxxxxxxx"
      }
    }
  }
}

Tools exposed

Tool	Purpose
list_findings	List vulnerabilities (filter by severity / status / limit)
get_finding	Full details for one finding (CVSS, CWE, file path, fix hint)
get_security_summary	Posture overview (counts by severity, last scan, repos monitored)
get_fix_proposal	AI-generated patch (code + explanation + post-fix CVSS)
resolve_finding	Mark as fixed
mark_false_positive	Mark as not exploitable
health_check	Verify connection + auth

Resources exposed

• sphior-code://summary — JSON snapshot of current posture
• sphior-code://findings/{id} — full detail per finding (auto-listed for open findings)

Reliability

• Exponential backoff retry on 5xx / network errors (3 attempts)
• 30-second request timeout (configurable)
• Graceful degradation — auth errors fail fast, server errors retry
• Structured errors with actionable hints
• stderr-only logging (stdout is reserved for MCP protocol)

Development

# In this directory
npm install
npm run build
SPHIOR_API_KEY=sk_test_xxx node bin/sphior-code-mcp.js
# Type a JSON-RPC request to test

License

MIT © SPHIOR Security

Links

• 🌐 SPHIOR Code
• 📖 API Reference
• 🐛 Report issues
• 🔑 Get an API key