Sheriff

io.github.ryansmith4Published by GitHub account ryansmith4v1.0.2Updated Oct 24, 2026

MCP server for fixing static analysis issues from SARIF reports with AI agents

VerifiedSTDIODesktop onlyDeveloper Tools Security & Monitoring

Server details

Identifier: io.github.ryansmith4/sheriff-mcp
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account ryansmith4 for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.ryansmith4%2Fsheriff-mcp.svg)](https://sourceweft.com/mcp/io.github.ryansmith4%2Fsheriff-mcp?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Sheriff lets an AI assistant work through static analysis issues from SARIF reports as a batched, resumable fix queue.

What you can do: Sheriff exposes a single tool with seven actions: load, next, done, progress, summary, reopen, and export. It loads a SARIF report produced by tools such as Qodana, Semgrep, ESLint, CodeQL, SpotBugs, Bandit, Checkov, Trivy, or SonarQube, groups issues by file, and hands the assistant one file's issues at a time with code snippets. Progress is stored so it survives context compaction, restarts, and agent switches, and scope filters narrow work to specific rules, severities, or file patterns.
When to use it: Use it when an assistant is asked to fix a large static analysis report and the raw issue list would overwhelm the context window. It suits iterative fix-and-mark-done loops across many files, and cases where progress must persist between sessions.
Requirements: Runs locally over stdio. Either Java 21 or newer to run the all-in-one JAR, or Docker to run the published container image. A SARIF report file must exist and be reachable from the process. No accounts, API keys, or environment variables are declared.

Before you install

The tool reads SARIF report files and tracks fix status; the assistant still edits source code itself, so review those edits. Release artifacts are signed with Sigstore and can be verified before use. No credentials or payments are requested.

Installation

In SourceWeft

Open Sheriff in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Sheriff-MCP

[CI] [OpenSSF Scorecard] [OpenSSF Best Practices] [License] [Java 21+] [GitHub release]

Sheriff is an MCP server that helps AI agents efficiently fix static analysis issues from SARIF reports.

Documentation | Installation | Tool Reference

Why Sheriff?

AI agents struggle with large static analysis reports:

Context overload - 100+ issues overwhelm context windows
Lost progress - Work is lost on context compaction or session restart
Inefficient navigation - No batching means jumping between files repeatedly

Sheriff solves this by acting as a work queue manager:

Intelligent batching - Issues grouped by file for efficient fixing
Persistent progress - State survives compaction, restarts, and agent switches
Scope filtering - Focus on specific rules, severities, or file patterns
Compact responses - Minimal context usage with abbreviated field names

Supported Static Analysis Tools

Sheriff works with any tool that produces SARIF output:

Tool	Language	SARIF Command
Qodana	Java/Kotlin/JS/Python	`qodana scan`
Semgrep	Multi-language	`semgrep --sarif -o results.sarif`
ESLint	JavaScript/TypeScript	`eslint --format @microsoft/sarif`
CodeQL	Multi-language	Built-in SARIF output
SpotBugs	Java	`spotbugs -sarif`
Bandit	Python	`bandit -f sarif`
Checkov	IaC	`checkov -o sarif`
Trivy	Container/IaC	`trivy --format sarif`
SonarQube	Multi-language	Built-in SARIF export

Quick Start

1. Install

JAR (All Platforms) — Requires Java 21+

Download sheriff-mcp-1.0.2-all.jar from Releases.

Docker

MCP Registry

Clients that support the MCP Registry can install directly by name: io.github.ryansmith4/sheriff-mcp

See the Installation Guide for full details.

2. Configure Your MCP Client

Add Sheriff to your MCP client (Claude Code, Cursor, ChatGPT Desktop, etc.):

json

{  "mcpServers": {    "sheriff": {      "command": "java",      "args": ["-jar", "/path/to/sheriff-mcp-1.0.2-all.jar", "start"]    }  }}

{  "mcpServers": {    "sheriff": {      "command": "java",      "args": ["-jar", "/path/to/sheriff-mcp-1.0.2-all.jar", "start"]    }  }}

Or with Docker:

json

{  "mcpServers": {    "sheriff": {      "command": "docker",      "args": ["run", "-i", "--rm", "-v", ".:/data", "ghcr.io/ryansmith4/sheriff-mcp:latest"]    }  }}

{  "mcpServers": {    "sheriff": {      "command": "docker",      "args": ["run", "-i", "--rm", "-v", ".:/data", "ghcr.io/ryansmith4/sheriff-mcp:latest"]    }  }}

See the Agent Setup Guide for client-specific instructions and recommended agent instructions.

3. Use It

1. Run static analysis     →  qodana scan2. Load into Sheriff       →  sheriff load target="results.sarif"3. Get next file's issues  →  sheriff next4. Fix all issues in file  →  [edit the code]5. Mark as done            →  sheriff done fps=[...] status="fixed"6. Repeat 3-5              →  until remaining = 0

1. Run static analysis     →  qodana scan2. Load into Sheriff       →  sheriff load target="results.sarif"3. Get next file's issues  →  sheriff next4. Fix all issues in file  →  [edit the code]5. Mark as done            →  sheriff done fps=[...] status="fixed"6. Repeat 3-5              →  until remaining = 0

Sheriff exposes a single sheriff tool with 7 actions: load, next, done, progress, summary, reopen, and export. See the Tool Reference for full documentation.

Example Session

User: "Fix all ConstantValue issues in my codebase"
Agent: sheriff load target="build/qodana/qodana.sarif.json"       → 136 total issues, 22 ConstantValue, 15 unused...
Agent: sheriff next scope={rule: "ConstantValue"}       → 3 issues in Service.java with code snippets
Agent: [reads Service.java, fixes all 3 issues]
Agent: sheriff done fps=["88d32cab35478753", "ab1c2d3e12345678", "f9e8d7c6a1b2c3d4"] status="fixed"       → 3 marked fixed, 19 remaining
       ... continues until remaining = 0

User: "Fix all ConstantValue issues in my codebase"
Agent: sheriff load target="build/qodana/qodana.sarif.json"       → 136 total issues, 22 ConstantValue, 15 unused...
Agent: sheriff next scope={rule: "ConstantValue"}       → 3 issues in Service.java with code snippets
Agent: [reads Service.java, fixes all 3 issues]
Agent: sheriff done fps=["88d32cab35478753", "ab1c2d3e12345678", "f9e8d7c6a1b2c3d4"] status="fixed"       → 3 marked fixed, 19 remaining
       ... continues until remaining = 0

Security

All release artifacts are signed with Sigstore for supply chain security.

Verify JAR:

bash

VERSION=1.0.2cosign verify-blob \  --signature sheriff-mcp-${VERSION}-all.jar.sig \  --certificate sheriff-mcp-${VERSION}-all.jar.pem \  --certificate-identity-regexp "https://github.com/ryansmith4/sheriff-mcp" \  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \  sheriff-mcp-${VERSION}-all.jar

VERSION=1.0.2cosign verify-blob \  --signature sheriff-mcp-${VERSION}-all.jar.sig \  --certificate sheriff-mcp-${VERSION}-all.jar.pem \  --certificate-identity-regexp "https://github.com/ryansmith4/sheriff-mcp" \  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \  sheriff-mcp-${VERSION}-all.jar

Verify Docker image:

bash

cosign verify ghcr.io/ryansmith4/sheriff-mcp:latest \  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \  --certificate-identity-regexp="github.com/ryansmith4/sheriff-mcp"

cosign verify ghcr.io/ryansmith4/sheriff-mcp:latest \  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \  --certificate-identity-regexp="github.com/ryansmith4/sheriff-mcp"

See SECURITY.md for our security policy.

Contributing

Contributions welcome! See CONTRIBUTING.md for guidelines.

License

Apache License 2.0 - see LICENSE

Source: README.md at commit d57af51

Tools

SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

v1.0.2LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts