# sourcery [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/abyssbugg/sourcery-agent-bundle  
**GitHub Stars:** 0  
**npm Downloads (last month):** 32  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/sourcery-2

## Description
Sourcery security findings: MCP server, CLI, and fix-prompt builder over the Sourcery API.

## Tools
Capabilities this server exposes over MCP:

- **sourcery_security_snapshot** — counts by status/severity plus the first page of active issues — start here for a triage overview.
- **sourcery_list_findings** — list issues with `repository_ids`, `issue_types`, `statuses`, `search`, `limit`, `cursor`.
- **sourcery_get_finding** — fetch one issue (full record incl. source snippet and dependency graph).
- **sourcery_get_security_counts** — aggregate counts by status and severity.
- **sourcery_bulk_update_findings** — bulk status/severity changes (≤100 ids; `SOLVED` is scanner-owned and rejected).
- **sourcery_build_fix_prompt** — builds the Sourcery-style minimal-change agent prompt from a finding; the DEPENDENCY path uses `fixed_versions` + `manifest_file_path` and renders the dependency chain.
- **sourcery_capabilities** — describes the verified surface, spec pin, and enum values.
- **sourcery_api_request** — compatibility bridge restricted to the eight verified operations.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "sourcery": {
    "command": "npx",
    "args": ["-y","@abyssbugg/sourcery@latest"],
    "env": {
      "SOURCERY_API_KEY": ""
    }
  }
}
```

**Requires environment variables:** `SOURCERY_API_KEY` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What the sourcery MCP server does

The sourcery MCP server exposes Sourcery’s documented Team-plan REST API for security findings to MCP-compatible agents. Its scope is security issue and issue-group data rather than Sourcery’s pull-request review controls. The bundle also includes a command-line interface and skills for triage and remediation workflows.

The package is published as `@abyssbugg/sourcery`. It can be used directly as an MCP process or installed as a plugin bundle for supported agent hosts. A Python implementation is included as a reference, while the production server is built with the official MCP TypeScript SDK.

## How it works

The server uses Sourcery’s API at `https://api.sourcery.ai/api` and authenticates with a bearer token supplied through `SOURCERY_API_KEY`. Its implementation is pinned to a committed OpenAPI snapshot. The snapshot defines eight verified API operations covering issue and issue-group listing, statistics, retrieval, and bulk updates.

The MCP layer presents those operations as focused tools. A snapshot tool combines status and severity totals with the first page of active issues, making it a starting point for triage. List operations accept filters such as repository IDs, issue types, statuses, search text, limits, and cursors. The fix-prompt tool creates a minimal-change prompt from a finding; dependency findings use fixed versions and the manifest path to render the dependency chain.

## Setup and configuration

Node.js 20 or newer is required. For the default stdio mode, set the API key and start the package without arguments:

```bash
export SOURCERY_API_KEY='...'
npx -y @abyssbugg/sourcery@latest
```

Streamable HTTP mode is available with `http` and listens on `127.0.0.1:8765/mcp`:

```bash
npx -y @abyssbugg/sourcery@latest http
```

The repository contains host-specific setup instructions for Claude Code, Cursor, Codex or ChatGPT desktop, VS Code, Devin, Grok, Amp, Hermes, OpenClaw, and Rovo Dev CLI. ChatGPT web requires the HTTP server to be exposed behind HTTPS and added through developer mode. The bundle can also be run from a local plugin directory.

## Tools and capabilities

The sourcery MCP server provides tools for both individual findings and issue groups:

- Inspect snapshots, security counts, findings, and groups.
- Filter and paginate findings or groups.
- Retrieve a complete finding, including source snippets and dependency graphs.
- Apply status or severity changes in bulk, up to 100 IDs per request.
- Build Sourcery-style remediation prompts.
- Report the pinned API surface, enum values, and specification details.
- Send compatibility requests through a bridge limited to the eight verified operations.

The command-line interface offers equivalent workflows such as `snapshot`, `list`, `get`, and `fix-prompt`. Query commands accept `--json` for scripting. `SOLVED` is scanner-owned and rejected by bulk finding updates.

## Limitations and notes

Sourcery’s public API is documented as a security-findings API. Review actions such as review, summary, guide, title, resolve, dismiss, and create issue remain GitHub or GitLab comment and label commands, so they are outside this server’s REST surface and should be handled through a Git provider connector.

The OpenAPI snapshot is pinned in the repository and includes a recorded fetch date and SHA-256 value. If Sourcery changes its specification, the snapshot and corresponding constants must be regenerated before relying on the new operations or enum values. The HTTP mode also requires suitable HTTPS exposure when used by ChatGPT web.

_Full upstream README: https://allmcps.com/mcp/sourcery-2/readme_