Security Engineer

io.github.GuardBeePublished by GitHub account GuardBeev0.1.1Updated Nov 7, 2026

Fix GuardBee AI Security Engineer findings in your repo with your coding agent, then verify

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Lets a coding agent pull GuardBee security assessment findings, apply reviewable fixes in your repo, and verify them on the live site.

What you can do
  • List recent security assessments and read their findings by priority with the platforms each can be fixed on
  • Detect the stack (Next.js, Express, Nginx, Apache, Cloudflare) from repository files and locate config files to diff against
  • Get a reviewable fix per finding, including an exact diff when you supply an Nginx or Apache config
  • Record that a fix was applied, with a commit SHA or PR URL as reference
  • Re-run the original check against the live site after deployment to confirm the issue is resolved
When to use it
Use it when your team runs GuardBee AI Security Engineer assessments and you want a coding agent to turn the top findings into concrete edits in your own repository, then confirm the fix after deploying.
Requirements
Runs locally over stdio via the npm package, so Node.js and npx are needed. Requires a GuardBee API key with remediations.read and remediations.write scopes, passed as GUARDBEE_API_KEY. Optional GUARDBEE_BASE_URL and GUARDBEE_TELEMETRY variables. Network access to GuardBee and to the live site for verification.
Before you install
The API key grants read and write access to remediation data, so treat it as a secret. The server records applied fixes and re-checks the live site, which sends requests to your deployed site. Telemetry is off by default but sends tool names, success, duration and short parameter values such as file paths when enabled. File edits are made by your agent and need your approval.

Installation

In SourceWeft

  1. Open Security Engineer in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@guardbee/mcp-security-engineer

🇬🇧 English | 🇹🇷 Türkçe

[npm version] [npm downloads] [License: MIT]

Fix GuardBee AI Security Engineer findings in your own repository with your coding agent (Claude Code, Cursor, VS Code), then verify the fix on the live site.

GuardBee finds and explains the issue and proposes a fix for your platform. Your coding agent makes the change in your repository, and you approve it. GuardBee never edits your code or servers.

Telemetry is off by default. With GUARDBEE_TELEMETRY=1 it sends the server, tool, success, duration and short parameter values such as a file path; longer strings and fields like content, token or password are replaced with a placeholder. See @guardbee/mcp-telemetry.

Tools

ToolWhat it does
list_assessmentsRecent AI Security Engineer assessments of your workspace
get_assessmentActionable findings, highest priority first, with the platforms each can be fixed on
detect_stackDetects Next.js, Express, Nginx, Apache or Cloudflare from your repository's files, and finds config files to diff against
get_fixA reviewable fix for a finding. If you pass your Nginx or Apache config, you get an exact diff.
report_appliedRecords that the fix was applied, with the commit SHA or PR URL as a reference
verify_fixAfter you deploy, re-runs the check that reported the finding against the live site

Setup

  1. In GuardBee, open Developers → API keys and create a key with the remediations.read and remediations.write scopes.
  2. Add the server to your agent.

Claude Code

bash
claude mcp add guardbee-security-engineer -e GUARDBEE_API_KEY=gb_... -- npx -y @guardbee/mcp-security-engineer

Cursor / VS Code (mcp.json)

json
{  "mcpServers": {    "guardbee-security-engineer": {      "command": "npx",      "args": ["-y", "@guardbee/mcp-security-engineer"],      "env": { "GUARDBEE_API_KEY": "gb_..." }    }  }}

Example

"Fix the top GuardBee findings of my latest assessment in this repo."

The agent:

  1. Calls list_assessments and then get_assessment.
  2. Calls detect_stack. For example, it finds Next.js and deploy/nginx.conf.
  3. Calls get_fix for each finding, edits next.config.js or the Nginx config, and shows you the diff.
  4. After you approve and commit, calls report_applied with the commit SHA.
  5. After you deploy, calls verify_fix, and GuardBee confirms the issue is resolved.

Configuration

VariableDefault
GUARDBEE_API_KEYrequired
GUARDBEE_BASE_URLhttps://app.guardbee.ai
GUARDBEE_TELEMETRYoff; 1 turns on anonymous usage telemetry

Security

  • The server only reads files inside the project root, and only the config file you name. Paths outside the root are rejected.
  • File edits are made by your agent, and you approve them there.
  • All actions are recorded in the GuardBee activity log, marked as coming from an MCP client.

License

MIT

Source: packages/security-engineer/README.md at commit 952a0bf

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.1LatestNov 7, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts