SymbioticSec

io.github.SymbioticSecPublished by GitHub account SymbioticSecv1.0.1Updated Oct 24, 2026

Symbiotic CLI MCP Server for security scanning and analysis

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A local MCP server that runs Symbiotic CLI security scans on code and infrastructure files and returns findings with severity and fixes.

What you can do
Run static code analysis on selected files or a whole workspace, and scan infrastructure files for security issues, or both together in one comprehensive scan. List the programming languages the scanner supports. Return formatted results with severity levels, triage of likely false positives, and remediation suggestions, and offer to apply automatic fixes. Scans work on temporary copies, so the workspace itself is left unchanged.
When to use it
Use it when you want an assistant to review a repository or infrastructure configuration for security vulnerabilities and explain or fix what it finds, for example through a Cursor security-review command.
Requirements
Runs locally as a Node.js process (npm package) and needs the Symbiotic CLI installed separately. Requires a Symbiotic Security account and an API token supplied in the SYMBIOTIC_API_TOKEN environment variable. Network access is needed to reach the Symbiotic service.
Before you install
The API token is a secret placed in the client configuration; keep it out of shared files. Code and infrastructure files are sent to the Symbiotic service for analysis, so avoid scanning repositories you are not allowed to share externally. The server can offer to apply automatic fixes, which modify your files, so review changes before accepting them.

Installation

In SourceWeft

  1. Open SymbioticSec in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Symbiotic MCP Server

A Model Context Protocol (MCP) server for security analysis using Symbiotic CLI

Description

This server exposes security analysis tools via the MCP protocol for any MCP-compatible client. It allows scanning code and infrastructure files without affecting your workspace.

Available Tools

  • code_scan_files - Static code analysis
  • infra_scan_files - Infrastructure security scanning
  • security_scan_files - Comprehensive security scan (code + infrastructure)
  • get_supported_languages - List of supported programming languages

Cursor Integration

Setting up the Security Review Command

  1. Create a .cursor directory in your project root if it doesn't exist
  2. Create or update .cursor/commands/security-review.md with the contents of security-review.md

Using the Command

  1. Open the chat panel in Cursor (Cmd+L or Ctrl+L)
  2. Type /security-review followed by optional file paths or glob patterns
  3. The command will perform a comprehensive security analysis, including:
    • Scanning selected files or the entire workspace
    • Analyzing for security vulnerabilities
    • Triaging findings and filtering false positives
    • Providing a detailed report with severity levels and remediation suggestions
    • Offering to apply automatic fixes for identified issues

Installation

  1. Install symbiotic-cli
bash
https://github.com/SymbioticSec/cli/releases
  1. Get API token

Create an account on Symbiotic Security and retrieve your API token.

  1. Build and start

Clone this repository and install dependencies:

bash
npm installnpm run build

MCP Configuration

In VSCode, open MCP: Open User Configuration and add in servers:

json
{ "servers": {  "symbiotic-security": {       "command": "node",      "args": ["path/to/build/index.js"],      "env": {        "SYMBIOTIC_API_TOKEN": "your_token_here",    }  },}

Configuration for other MCP clients may vary but generally follows the same structure.

json
{  "mcpServers": {    "symbiotic-security": {      "command": "node",      "args": ["path/to/build/index.js"],      "env": {        "SYMBIOTIC_API_TOKEN": "your_token_here"      }    }  }}

Important environment variables:

  • SYMBIOTIC_API_TOKEN (required) - Your Symbiotic API token

Note: Configuration file name and location may vary depending on your MCP client.

Transport Modes

  • STDIO (default) - Standard communication for MCP
  • SSE - Server-Sent Events over HTTP
  • Streamable HTTP - HTTP with /mcp endpoint
bash
# STDIO (default)node build/index.js
# HTTP server on port 9593SERVER_PORT=9593 node build/index.js

Authentication

The server requires a valid Symbiotic Security API token. Configuration is done via MCP environment variables.

Minimal required configuration:

json
"env": {  "SYMBIOTIC_API_TOKEN": "your_token_here"}

How It Works

  1. Receives code files via MCP
  2. Creates temporary files
  3. Executes symbiotic-cli
  4. Automatic cleanup of temporary files
  5. Returns formatted results

Source: README.md at commit 3f65883

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts