Security Engineer

io.github.GuardBee由 GitHub 帳號 GuardBee 發布v0.1.1更新於 Nov 7, 2026

Fix GuardBee AI Security Engineer findings in your repo with your coding agent, then verify

已驗證STDIO僅桌面開發者工具安全與監控

概覽

AI 產生的概覽

讓編碼代理取得 GuardBee 安全評估的發現項目，在儲存庫中套用可審閱的修正，並在線上網站驗證修正結果。

可以做什麼
  • 列出最近的評估並讀取依優先順序排列的發現項目及其可修正的平台
  • 從儲存庫檔案辨識技術堆疊（Next.js、Express、Nginx、Apache、Cloudflare）並找出可比對的設定檔
  • 為每個發現項目取得可審閱的修正方案，提供 Nginx 或 Apache 設定時可得到精確 diff
  • 以提交 SHA 或 PR 連結為依據記錄修正已套用
  • 部署後對線上網站重新執行原本的檢查以確認問題已解決
適用情境
當團隊使用 GuardBee AI Security Engineer 評估，並希望編碼代理把高優先順序的發現項目轉成自己儲存庫中的具體修改、並在部署後確認修正時使用。
執行需求
透過 npm 套件以 stdio 在本機執行，需要 Node.js 與 npx。需要具備 remediations.read 與 remediations.write 權限的 GuardBee API 金鑰，透過 GUARDBEE_API_KEY 傳入。可選用 GUARDBEE_BASE_URL 與 GUARDBEE_TELEMETRY。需要連線至 GuardBee 及線上網站以進行驗證。
安裝前請注意
此 API 金鑰可讀寫修正資料，應視為機密。伺服器會記錄已套用的修正並對線上網站發出檢查請求。遙測預設關閉，開啟後會傳送工具名稱、成功與否、耗時以及檔案路徑等短參數值。程式碼修改由你的代理執行，需你核准。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Security Engineer，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

@guardbee/mcp-security-engineer

🇬🇧 English | 🇹🇷 Türkçe

[npm version] [npm downloads] [License: MIT]

Fix GuardBee AI Security Engineer findings in your own repository with your coding agent (Claude Code, Cursor, VS Code), then verify the fix on the live site.

GuardBee finds and explains the issue and proposes a fix for your platform. Your coding agent makes the change in your repository, and you approve it. GuardBee never edits your code or servers.

Telemetry is off by default. With GUARDBEE_TELEMETRY=1 it sends the server, tool, success, duration and short parameter values such as a file path; longer strings and fields like content, token or password are replaced with a placeholder. See @guardbee/mcp-telemetry.

Tools

ToolWhat it does
list_assessmentsRecent AI Security Engineer assessments of your workspace
get_assessmentActionable findings, highest priority first, with the platforms each can be fixed on
detect_stackDetects Next.js, Express, Nginx, Apache or Cloudflare from your repository's files, and finds config files to diff against
get_fixA reviewable fix for a finding. If you pass your Nginx or Apache config, you get an exact diff.
report_appliedRecords that the fix was applied, with the commit SHA or PR URL as a reference
verify_fixAfter you deploy, re-runs the check that reported the finding against the live site

Setup

  1. In GuardBee, open Developers → API keys and create a key with the remediations.read and remediations.write scopes.
  2. Add the server to your agent.

Claude Code

bash
claude mcp add guardbee-security-engineer -e GUARDBEE_API_KEY=gb_... -- npx -y @guardbee/mcp-security-engineer

Cursor / VS Code (mcp.json)

json
{  "mcpServers": {    "guardbee-security-engineer": {      "command": "npx",      "args": ["-y", "@guardbee/mcp-security-engineer"],      "env": { "GUARDBEE_API_KEY": "gb_..." }    }  }}

Example

"Fix the top GuardBee findings of my latest assessment in this repo."

The agent:

  1. Calls list_assessments and then get_assessment.
  2. Calls detect_stack. For example, it finds Next.js and deploy/nginx.conf.
  3. Calls get_fix for each finding, edits next.config.js or the Nginx config, and shows you the diff.
  4. After you approve and commit, calls report_applied with the commit SHA.
  5. After you deploy, calls verify_fix, and GuardBee confirms the issue is resolved.

Configuration

VariableDefault
GUARDBEE_API_KEYrequired
GUARDBEE_BASE_URLhttps://app.guardbee.ai
GUARDBEE_TELEMETRYoff; 1 turns on anonymous usage telemetry

Security

  • The server only reads files inside the project root, and only the config file you name. Paths outside the root are rejected.
  • File edits are made by your agent, and you approve them there.
  • All actions are recorded in the GuardBee activity log, marked as coming from an MCP client.

License

MIT

來源：packages/security-engineer/README.md，提交 952a0bf

工具

0
SourceWeft 尚未在沙箱中啟動過該軟體包，因此其工具未知。

版本歷史

1
  1. v0.1.1最新Nov 7, 2026

評分

已滿足適用檢查項的 50%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分

    請保持端點能夠回應 MCP 握手；SourceWeft 每 30 天探測一次。

  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。

  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分