Sourcery

Sourcery Agent Bundle

A hybrid plugin bundle for agent-driven Sourcery security workflows: an MCP server (12 tools over Sourcery's public security API, pinned OpenAPI snapshot), two Agent Skills, and adapters for Claude Code, Cursor, Codex/ChatGPT, VS Code, Devin, Grok (CLI + Bot), Amp, Hermes, OpenClaw, and Rovo Dev CLI. The server ships as the npm package @abyssbugg/sourcery — most hosts just register npx -y @abyssbugg/sourcery@latest. See docs/COMPATIBILITY.md for per-host install steps.

What is confirmed

Sourcery's current docs say the only public API is a Team-plan REST API for security findings. The documented API base is https://api.sourcery.ai/api, and the first documented request is:

curl https://api.sourcery.ai/api/v1/security-issues \

-H "Authorization: Bearer $SOURCERY_API_KEY"

Verified and pinned. The live OpenAPI document (https://api.sourcery.ai/api/openapi.json) is committed as a snapshot at openapi/sourcery-openapi.json:

• Info: Sourcery API 0.1.0 (OpenAPI 3.1.0)
• Fetched: 2026-09-10
• SHA-256: 9fdb45e657a6406c86ea0d0def2963d534e20bec1a9c88f7d62dbc2e6807f877

Every tool and the client allow-list are wired from that snapshot. The verified surface is exactly eight operations:

Why the Sourcery API + Git connector split

Sourcery's PR review controls are currently documented as GitHub/GitLab comment or label commands (review, summary, guide, title, resolve, dismiss, create issue) rather than public REST endpoints. Those actions are therefore best implemented through your GitHub/GitLab connector, while Sourcery is used for security findings.

Bundle shape

Repo root = plugin root. The portable core (plugin.json + skills/ + mcp.json) follows the Agent Plugins 1.0.0 standard, which Cursor and OpenAI (Codex, ChatGPT desktop) load natively; the other files are thin per-host adapters.

sourcery-agent-bundle/

plugin.json # Agent Plugins core manifest mcp.json # portable stdio wiring -> bin/sourcery skills/ sourcery-triage/SKILL.md # findings triage workflow sourcery-remediate/SKILL.md # minimal-change fix workflow bin/ sourcery # launcher: dist/cli.js when built, else npx @abyssbugg/sourcery agents/ sourcery-triager.md # read-only triage sub-agent (Claude format) .claude-plugin/plugin.json # Claude Code manifest + userConfig API key .mcp.json # Claude Code MCP wiring (npx) .agents/plugins/marketplace.json # Codex/ChatGPT local marketplace entry scripts/ install-rovodev.sh # Rovo Dev CLI wiring (mcp.json + skills) install-local-hosts.sh # grok, amp, hermes, openclaw, VS Code, Devin examples/ mcp.http.json # remote deployment template hooks/ # optional hooks example (SessionStart echo; not enabled) docs/ COMPATIBILITY.md # per-host setup matrix grok-bot-skill.md # paste-in skill for Grok Bot openapi/ sourcery-openapi.json # pinned spec snapshot (SHA-256 above) src/ # TypeScript: MCP server + findings CLI (@abyssbugg/sourcery) constants.ts # pinned facts: operations, enums, spec hash tests/ # TypeScript tests (constants drift pin, tools, client) python/ # Python reference implementation (server, client, prompts) src/sourcery_agent/ tests/ package.json # npm package manifest (@abyssbugg/sourcery) .env.example README.md

Tools

• sourcery_security_snapshot: counts by status/severity plus the first page of active issues — start here for a triage overview.
• sourcery_list_findings: list issues with repository_ids, issue_types, statuses, search, limit, cursor.
• sourcery_get_finding: fetch one issue (full record incl. source snippet and dependency graph).
• sourcery_get_security_counts: aggregate counts by status and severity.
• sourcery_bulk_update_findings: bulk status/severity changes (≤100 ids; SOLVED is scanner-owned and rejected).
• sourcery_list_groups, sourcery_get_group, sourcery_get_group_counts, sourcery_bulk_update_groups: the same capabilities for issue groups.
• sourcery_build_fix_prompt: builds the Sourcery-style minimal-change agent prompt from a finding; the DEPENDENCY path uses fixed_versions + manifest_file_path and renders the dependency chain.
• sourcery_capabilities: describes the verified surface, spec pin, and enum values.
• sourcery_api_request: compatibility bridge restricted to the eight verified operations.

CLI

npx -y @abyssbugg/sourcery@latest snapshot                          # counts + first page of active findings

npx -y @abyssbugg/sourcery@latest list --status ACTIVE --limit 50 # filterable list npx -y @abyssbugg/sourcery@latest get 1234 # one finding in full npx -y @abyssbugg/sourcery@latest fix-prompt 1234 # minimal-change agent prompt

Inside an enabled plugin host, bin/sourcery runs the same CLI (it prefers a locally built dist/cli.js and otherwise falls back to npx). Add --json to any query command for scripting.

Setup

Requirements: Node 20+. Most hosts register the MCP server directly:

export SOURCERY_API_KEY='...'

npx -y @abyssbugg/sourcery@latest # stdio MCP server (no args) npx -y @abyssbugg/sourcery@latest http # Streamable HTTP (127.0.0.1:8765/mcp)

Or install it as a plugin bundle — one step per host (details in docs/COMPATIBILITY.md):

For development and tests, see the Python reference implementation (its suite doubles as the bundle-packaging checker) and run npm test for the TypeScript suite. The server is built on the official MCP TypeScript SDK (@modelcontextprotocol/sdk).

Regenerating the pinned snapshot

When Sourcery publishes a spec change:

curl -sS --fail -o openapi/sourcery-openapi.json https://api.sourcery.ai/api/openapi.json

shasum -a 256 openapi/sourcery-openapi.json # update SPEC_SHA256 in src/constants.ts (+ python/src/sourcery_agent/constants.py, README/docs) npm test # tests/constants.spec.ts fails on drift

Sourcery's PR review commands (review, summary, guide, title, resolve, dismiss, create issue) remain GitHub/GitLab comment or label commands — implement those through your Git provider connector, not the Sourcery REST API.