# mobb-dev/mobb-vibe-shield-mcp [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/mobb-dev/bugsy?tab=readme-ov-file#model-context-protocol-mcp-server  
**GitHub Stars:** 68  
**npm Downloads (last month):** 23923  
**Views:** 2  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/mobb-dev-mobb-vibe-shield-mcp

## Description
Mobb Vibe Shield identifies and remediates vulnerabilities in both human and AI-written code, ensuring your applications remain secure without slowing development.

## Tools
Capabilities this server exposes over MCP:

- **Parameter** — `path` (string) - The path to the local git repository
- **Returns** — Detailed vulnerability fixes with code patches and explanations

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "mobb-vibe-shield-mcp": {
    "command": "npx",
    "args": ["-y","mobbdev"],
    "env": {
      "API_KEY": "",
      "API_URL": "",
      "MVS_AUTO_FIX": ""
    }
  }
}
```

**Requires environment variables:** `API_KEY`, `API_URL`, `MVS_AUTO_FIX` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What mobb-dev/mobb-vibe-shield-mcp MCP server does

The mobb-dev/mobb-vibe-shield-mcp MCP server lets an MCP-compatible assistant send changes from a local Git repository to Mobb for vulnerability analysis. Its main capability is the `fix_vulnerabilities` tool, which accepts a repository path and returns detailed remediation results, including code patches and explanations.

The repository must contain modified, added, or staged files. The server validates the path, checks that it is a Git repository, finds the changes, and uploads the relevant files for analysis. The assistant can then present the returned fixes to the developer for review.

Bugsy, the underlying CLI project, also supports separate scan and analyze workflows for SAST results. Those workflows can use Checkmarx, CodeQL, Fortify, or Snyk reports, while the MCP usage described here works against local repository changes.

## How it works

After the assistant invokes `fix_vulnerabilities`, the server verifies the supplied path and checks for Git changes. It sends the changed files to Mobb's service, which analyzes the submitted code and generates fixes for supported vulnerabilities. Results include remediation details rather than an automatic commit to the repository.

The MCP server requires access to Mobb through an API key. By default, it uses `https://app.mobb.ai`; a different service endpoint can be selected with `API_URL`. The `mobb-dev/mobb-vibe-shield-mcp MCP server` is intended for an MCP client that can launch a command-based server such as `npx mobbdev mcp`.

## Setup and configuration

Install and launch the server with:

```shell
npx mobbdev mcp
```

Configure the command in an MCP client and provide these environment variables:

- `API_KEY` is required and contains the Mobb API key.
- `API_URL` is optional and replaces the default Mobb endpoint.
- `MVS_AUTO_FIX` is optional. Set it to `true` or `false` to override the automatic-fix setting stored in the user's Mobb account.

The API key can be obtained by signing up through Mobb's application. Before invoking the tool, place the target code in a local Git repository and make, stage, or otherwise retain changes for the server to inspect.

## Tools and capabilities

- `fix_vulnerabilities`: analyzes changes in a local Git repository.
- Accepts a `path` string pointing to the repository.
- Returns vulnerability fixes, code patches, and explanations.
- Checks repository validity and whether changed files are available.
- Supports an optional automatic-fix override through `MVS_AUTO_FIX`.

## Limitations and notes

The community edition analyzes public GitHub repositories. Private repository analysis is available only for a limited period, according to the project documentation. The broader Bugsy workflow relies on findings from supported SAST tools rather than independently detecting every vulnerability.

A missing `API_KEY` prevents the MCP server from running. An invalid Git path or a repository with no modified, added, or staged files prevents the requested analysis. The provided MCP documentation describes one tool and does not document automatic commits, support for arbitrary remote repositories, or a separate vulnerability database exposed directly through MCP.

_Full upstream README: https://allmcps.com/mcp/mobb-dev-mobb-vibe-shield-mcp/readme_