Sphior Code MCP

sphior-code-mcp

Official Model Context Protocol (MCP) server for SPHIOR CODE — find security issues in your code and let your own AI assistant fix them, inside any MCP-compatible client.

No account needed to start. With no API key set, the server scans your local workspace with the bundled deterministic engine and hands the findings to your AI agent. Add an API key later if you want tamper-evident evidence, history and GRC integrations.

What this gives you

Your AI assistant can now answer questions like:

• *"Scan this project and fix the critical issues."* ← works with no account
• *"What are the highest-severity vulnerabilities in my code right now?"*
• *"Show me the fix for finding abc-123."*
• *"Mark this SQL injection alert as resolved — I just fixed it."* (requires an API key)
• *"What's our overall security posture this month?"* (requires an API key)

…using live data from SPHIOR's scanning engine — deterministic SAST (secrets + CWE patterns, analysed with real parsers across 14 languages) and SCA powered by OSV.dev. No AI is involved in detection, so the same code always produces the same findings.

Supported clients

This is a standard MCP stdio server, so it works with any MCP-compatible client:

Installation

# No install needed — use npx

npx -y sphior-code-mcp

Or install globally

npm install -g sphior-code-mcp sphior-code-mcp

Two modes

In local mode the server runs the same deterministic engine that powers the editor extensions (secrets + CWE patterns + taint analysis across 14 languages, parsed with real grammars) against the directory your client launched it in, then returns remediation guidance your agent can act on. It never contacts SPHIOR's servers.

Cloud-only tools return a clear message explaining what they need, rather than failing silently.

Configuration

Nothing is required to start. To unlock cloud features, set an API key from sphior.com/account/api:

export SPHIOR_API_KEY=sk_live_xxxxxxxxxxxx

Environment variables

Example config (Cursor / Claude Code / VS Code style)

Local mode — copy, paste, done. No account, no key.

{

"mcpServers": { "sphior-code": { "command": "npx", "args": ["-y", "sphior-code-mcp"] } } }

Claude Code users can skip the file entirely:

claude mcp add sphior-code -- npx sphior-code-mcp

Then ask your agent: *"Scan this project and fix the critical issues."*

Cloud mode — add the key to the same block:

{

"mcpServers": { "sphior-code": { "command": "npx", "args": ["-y", "sphior-code-mcp"], "env": { "SPHIOR_API_KEY": "sk_live_xxxxxxxxxxxx" } } } }

For GitHub Copilot in VS Code, use "servers" instead of "mcpServers" (the env block is optional here too):

{

"servers": { "sphior-code": { "type": "stdio", "command": "npx", "args": ["-y", "sphior-code-mcp"] } } }

Tools exposed

get_fix_context accepts path in local mode to scan a directory other than the one your client launched the server in.

Resources exposed

• sphior-code://summary — JSON snapshot of current posture
• sphior-code://findings/{id} — full detail per finding (auto-listed for open findings)

Reliability

• Exponential backoff retry on 5xx / network errors (3 attempts)
• 30-second request timeout (configurable)
• Graceful degradation — auth errors fail fast, server errors retry
• Structured errors with actionable hints
• stderr-only logging (stdout is reserved for MCP protocol)

Development

# In this directory

npm install npm run build

Local mode — no key needed

node bin/sphior-code-mcp.js

Cloud mode

SPHIOR_API_KEY=sk_test_xxx node bin/sphior-code-mcp.js

Type a JSON-RPC request to test

License

MIT © SPHIOR Security

Links

• 🌐 SPHIOR Code
• 📖 API Reference
• 🐛 Report issues
• 🔑 Get an API key