Sourcery

io.github.abyssbugg-labsPublished by GitHub account abyssbugg-labsv0.2.4Updated Oct 24, 2026

Sourcery security findings: MCP server, CLI, and fix-prompt builder over the Sourcery API.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Local MCP server and CLI that lets an assistant read, summarize and bulk-update Sourcery security findings and issue groups via the Sourcery API.

What you can do
  • Get a triage snapshot of counts by status and severity plus the first page of active issues
  • List, filter and fetch individual findings, including source snippets and dependency graphs
  • Read aggregate counts and list or fetch issue groups with their findings
  • Bulk-change status or severity on up to 100 findings or groups at a time
  • Build a minimal-change fix prompt from a finding, including the dependency chain
  • Describe the verified API surface and send requests limited to the eight verified operations
When to use it
Useful when a team already runs Sourcery security scanning on a Team plan and wants an assistant to triage findings, summarize severity counts, or draft remediation prompts without leaving the chat.
Requirements
Node 20 or later and a local stdio process (npm package run via npx). A Sourcery Team-plan API key with security scanning enabled, supplied as the SOURCERY_API_KEY environment variable. Network access to the Sourcery API.
Before you install
Requires a Sourcery Team-plan API key (SOURCERY_API_KEY) that grants access to your organization's security findings. Bulk update tools change status and severity on up to 100 findings or groups per call, so writes should be reviewed before running. Finding records can include source snippets and dependency data sent to the model. PR review commands are not covered and must go through your Git provider.

Installation

In SourceWeft

  1. Open Sourcery in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Sourcery Agent Bundle

A hybrid plugin bundle for agent-driven Sourcery security workflows: an MCP server (12 tools over Sourcery's public security API, pinned OpenAPI snapshot), two Agent Skills, and adapters for Claude Code, Cursor, Codex/ChatGPT, VS Code, Devin, Grok (CLI + Bot), Amp, Hermes, OpenClaw, and Rovo Dev CLI. The server ships as the npm package @abyssbugg/sourcery — most hosts just register npx -y @abyssbugg/sourcery@latest. See docs/COMPATIBILITY.md for per-host install steps.

What is confirmed

Sourcery's current docs say the only public API is a Team-plan REST API for security findings. The documented API base is https://api.sourcery.ai/api, and the first documented request is:

bash
curl https://api.sourcery.ai/api/v1/security-issues \  -H "Authorization: Bearer $SOURCERY_API_KEY"

Verified and pinned. The live OpenAPI document (https://api.sourcery.ai/api/openapi.json) is committed as a snapshot at openapi/sourcery-openapi.json:

  • Info: Sourcery API 0.1.0 (OpenAPI 3.1.0)
  • Fetched: 2026-09-10
  • SHA-256: 9fdb45e657a6406c86ea0d0def2963d534e20bec1a9c88f7d62dbc2e6807f877

Every tool and the client allow-list are wired from that snapshot. The verified surface is exactly eight operations:

MethodPathPurpose
GET/v1/security-issuesList issues (filters + cursor pagination)
GET/v1/security-issues/statsCounts by status and severity
GET/v1/security-issues/{id}Fetch one issue
PATCH/v1/security-issuesBulk update (max 100 ids)
GET/v1/security-issue-groupsList groups (same filters)
GET/v1/security-issue-groups/statsCounts by status and severity
GET/v1/security-issue-groups/{id}Fetch one group including its issues
PATCH/v1/security-issue-groupsBulk update groups (max 100 ids)

Why the Sourcery API + Git connector split

Sourcery's PR review controls are currently documented as GitHub/GitLab comment or label commands (review, summary, guide, title, resolve, dismiss, create issue) rather than public REST endpoints. Those actions are therefore best implemented through your GitHub/GitLab connector, while Sourcery is used for security findings.

Bundle shape

Repo root = plugin root. The portable core (plugin.json + skills/ + mcp.json) follows the Agent Plugins 1.0.0 standard, which Cursor and OpenAI (Codex, ChatGPT desktop) load natively; the other files are thin per-host adapters.

text
sourcery-agent-bundle/  plugin.json                      # Agent Plugins core manifest  mcp.json                         # portable stdio wiring -> bin/sourcery  skills/    sourcery-triage/SKILL.md       # findings triage workflow    sourcery-remediate/SKILL.md    # minimal-change fix workflow  bin/    sourcery                       # launcher: dist/cli.js when built, else npx @abyssbugg/sourcery  agents/    sourcery-triager.md            # read-only triage sub-agent (Claude format)  .claude-plugin/plugin.json       # Claude Code manifest + userConfig API key  .mcp.json                        # Claude Code MCP wiring (npx)  .agents/plugins/marketplace.json # Codex/ChatGPT local marketplace entry  scripts/    install-rovodev.sh             # Rovo Dev CLI wiring (mcp.json + skills)    install-local-hosts.sh         # grok, amp, hermes, openclaw, VS Code, Devin  examples/    mcp.http.json                  # remote deployment template    hooks/                         # optional hooks example (SessionStart echo; not enabled)  docs/    COMPATIBILITY.md               # per-host setup matrix    grok-bot-skill.md              # paste-in skill for Grok Bot  openapi/    sourcery-openapi.json          # pinned spec snapshot (SHA-256 above)  src/                             # TypeScript: MCP server + findings CLI (@abyssbugg/sourcery)    constants.ts                   # pinned facts: operations, enums, spec hash  tests/                           # TypeScript tests (constants drift pin, tools, client)  python/                          # Python reference implementation (server, client, prompts)    src/sourcery_agent/    tests/  package.json                     # npm package manifest (@abyssbugg/sourcery)  .env.example  README.md

Tools

  • sourcery_security_snapshot: counts by status/severity plus the first page of active issues — start here for a triage overview.
  • sourcery_list_findings: list issues with repository_ids, issue_types, statuses, search, limit, cursor.
  • sourcery_get_finding: fetch one issue (full record incl. source snippet and dependency graph).
  • sourcery_get_security_counts: aggregate counts by status and severity.
  • sourcery_bulk_update_findings: bulk status/severity changes (≤100 ids; SOLVED is scanner-owned and rejected).
  • sourcery_list_groups, sourcery_get_group, sourcery_get_group_counts, sourcery_bulk_update_groups: the same capabilities for issue groups.
  • sourcery_build_fix_prompt: builds the Sourcery-style minimal-change agent prompt from a finding; the DEPENDENCY path uses fixed_versions + manifest_file_path and renders the dependency chain.
  • sourcery_capabilities: describes the verified surface, spec pin, and enum values.
  • sourcery_api_request: compatibility bridge restricted to the eight verified operations.

CLI

bash
npx -y @abyssbugg/sourcery@latest snapshot                          # counts + first page of active findingsnpx -y @abyssbugg/sourcery@latest list --status ACTIVE --limit 50   # filterable listnpx -y @abyssbugg/sourcery@latest get 1234                          # one finding in fullnpx -y @abyssbugg/sourcery@latest fix-prompt 1234                   # minimal-change agent prompt

Inside an enabled plugin host, bin/sourcery runs the same CLI (it prefers a locally built dist/cli.js and otherwise falls back to npx). Add --json to any query command for scripting.

Setup

Requirements: Node 20+. Most hosts register the MCP server directly:

bash
export SOURCERY_API_KEY='...'npx -y @abyssbugg/sourcery@latest        # stdio MCP server (no args)npx -y @abyssbugg/sourcery@latest http   # Streamable HTTP (127.0.0.1:8765/mcp)

Or install it as a plugin bundle — one step per host (details in docs/COMPATIBILITY.md):

HostQuick start
Claude Codeclaude --plugin-dir . — prompts for the API key on enable
Cursorsymlink the repo into ~/.cursor/plugins/local/, reload
Codex CLI / ChatGPT desktopcodex plugin marketplace add ./
ChatGPT webrun npx -y @abyssbugg/sourcery@latest http behind HTTPS, add via developer mode
VS Code / Grok / Amp / Hermes / OpenClawscripts/install-local-hosts.sh (idempotent; registers plugin, MCP, and skills)
Devinskill links via the installer; devin plugins install --local . for the full plugin
Grok Botpaste-in skill from docs/grok-bot-skill.md
Rovo Dev CLIscripts/install-rovodev.sh

For development and tests, see the Python reference implementation (its suite doubles as the bundle-packaging checker) and run npm test for the TypeScript suite. The server is built on the official MCP TypeScript SDK (@modelcontextprotocol/sdk).

Regenerating the pinned snapshot

When Sourcery publishes a spec change:

bash
curl -sS --fail -o openapi/sourcery-openapi.json https://api.sourcery.ai/api/openapi.jsonshasum -a 256 openapi/sourcery-openapi.json   # update SPEC_SHA256 in src/constants.ts (+ python/src/sourcery_agent/constants.py, README/docs)npm test                                      # tests/constants.spec.ts fails on drift

Sourcery's PR review commands (review, summary, guide, title, resolve, dismiss, create issue) remain GitHub/GitLab comment or label commands — implement those through your Git provider connector, not the Sourcery REST API.

Source: README.md at commit 8cd4d56

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

2
  1. v0.2.4LatestSep 30, 2026
  2. v0.2.3Sep 30, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts