Security Engineer

io.github.GuardBee由 GitHub 账号 GuardBee 发布v0.1.1更新于 Nov 7, 2026

Fix GuardBee AI Security Engineer findings in your repo with your coding agent, then verify

已验证STDIO仅桌面开发者工具安全与监控

概览

AI 生成的概览

让编码代理获取 GuardBee 安全评估发现项，在仓库中应用可审阅的修复，并在线上站点验证修复效果。

可以做什么
  • 列出最近的评估并读取按优先级排序的发现项及其可修复的平台
  • 从仓库文件识别技术栈（Next.js、Express、Nginx、Apache、Cloudflare）并定位可对比的配置文件
  • 为每个发现项获取可审阅的修复方案，提供 Nginx 或 Apache 配置时可得到精确 diff
  • 以提交 SHA 或 PR 链接为凭据记录修复已应用
  • 部署后对线上站点重新执行原检查以确认问题已解决
适用场景
当团队使用 GuardBee AI Security Engineer 评估，并希望编码代理把高优先级发现项转化为自己仓库中的具体改动、并在部署后确认修复时使用。
运行要求
通过 npm 包以 stdio 在本地运行，需要 Node.js 与 npx。需要具备 remediations.read 与 remediations.write 权限的 GuardBee API 密钥，通过 GUARDBEE_API_KEY 传入。可选 GUARDBEE_BASE_URL 与 GUARDBEE_TELEMETRY。需要访问 GuardBee 及线上站点以进行验证。
安装前请注意
该 API 密钥可读写修复数据，应视为机密。服务器会记录已应用的修复并对线上站点发起检查请求。遥测默认关闭，开启后会发送工具名、成功与否、耗时以及文件路径等短参数值。代码改动由你的代理执行，需你确认。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Security Engineer，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

@guardbee/mcp-security-engineer

🇬🇧 English | 🇹🇷 Türkçe

[npm version] [npm downloads] [License: MIT]

Fix GuardBee AI Security Engineer findings in your own repository with your coding agent (Claude Code, Cursor, VS Code), then verify the fix on the live site.

GuardBee finds and explains the issue and proposes a fix for your platform. Your coding agent makes the change in your repository, and you approve it. GuardBee never edits your code or servers.

Telemetry is off by default. With GUARDBEE_TELEMETRY=1 it sends the server, tool, success, duration and short parameter values such as a file path; longer strings and fields like content, token or password are replaced with a placeholder. See @guardbee/mcp-telemetry.

Tools

ToolWhat it does
list_assessmentsRecent AI Security Engineer assessments of your workspace
get_assessmentActionable findings, highest priority first, with the platforms each can be fixed on
detect_stackDetects Next.js, Express, Nginx, Apache or Cloudflare from your repository's files, and finds config files to diff against
get_fixA reviewable fix for a finding. If you pass your Nginx or Apache config, you get an exact diff.
report_appliedRecords that the fix was applied, with the commit SHA or PR URL as a reference
verify_fixAfter you deploy, re-runs the check that reported the finding against the live site

Setup

  1. In GuardBee, open Developers → API keys and create a key with the remediations.read and remediations.write scopes.
  2. Add the server to your agent.

Claude Code

bash
claude mcp add guardbee-security-engineer -e GUARDBEE_API_KEY=gb_... -- npx -y @guardbee/mcp-security-engineer

Cursor / VS Code (mcp.json)

json
{  "mcpServers": {    "guardbee-security-engineer": {      "command": "npx",      "args": ["-y", "@guardbee/mcp-security-engineer"],      "env": { "GUARDBEE_API_KEY": "gb_..." }    }  }}

Example

"Fix the top GuardBee findings of my latest assessment in this repo."

The agent:

  1. Calls list_assessments and then get_assessment.
  2. Calls detect_stack. For example, it finds Next.js and deploy/nginx.conf.
  3. Calls get_fix for each finding, edits next.config.js or the Nginx config, and shows you the diff.
  4. After you approve and commit, calls report_applied with the commit SHA.
  5. After you deploy, calls verify_fix, and GuardBee confirms the issue is resolved.

Configuration

VariableDefault
GUARDBEE_API_KEYrequired
GUARDBEE_BASE_URLhttps://app.guardbee.ai
GUARDBEE_TELEMETRYoff; 1 turns on anonymous usage telemetry

Security

  • The server only reads files inside the project root, and only the config file you name. Paths outside the root are rejected.
  • File edits are made by your agent, and you approve them there.
  • All actions are recorded in the GuardBee activity log, marked as coming from an MCP client.

License

MIT

来源：packages/security-engineer/README.md，提交 952a0bf

工具

0
SourceWeft 尚未在沙箱中启动过该软件包，因此其工具未知。

版本历史

1
  1. v0.1.1最新Nov 7, 2026

评分

已满足适用检查项的 50%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手；SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分