# sourcery [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/abyssbugg-labs/sourcery-agent-bundle  
**GitHub Stars:** 0  
**npm Downloads (last month):** 32  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/sourcery

## Description
Sourcery security findings: MCP server, CLI, and fix-prompt builder over the Sourcery API.

## Tools
Capabilities this server exposes over MCP:

- **sourcery_security_snapshot** — counts by status/severity plus the first page of active issues — start here for a triage overview.
- **sourcery_list_findings** — list issues with `repository_ids`, `issue_types`, `statuses`, `search`, `limit`, `cursor`.
- **sourcery_get_finding** — fetch one issue (full record incl. source snippet and dependency graph).
- **sourcery_get_security_counts** — aggregate counts by status and severity.
- **sourcery_bulk_update_findings** — bulk status/severity changes (≤100 ids; `SOLVED` is scanner-owned and rejected).
- **sourcery_build_fix_prompt** — builds the Sourcery-style minimal-change agent prompt from a finding; the DEPENDENCY path uses `fixed_versions` + `manifest_file_path` and renders the dependency chain.
- **sourcery_capabilities** — describes the verified surface, spec pin, and enum values.
- **sourcery_api_request** — compatibility bridge restricted to the eight verified operations.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "sourcery": {
    "command": "npx",
    "args": ["-y","@abyssbugg/sourcery@latest"],
    "env": {
      "SOURCERY_API_KEY": ""
    }
  }
}
```

**Requires environment variables:** `SOURCERY_API_KEY` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What sourcery does

The sourcery MCP server exposes Sourcery security findings and issue groups to MCP-compatible agents. It supports finding-level and group-level workflows: an agent can inspect active issues, filter results, retrieve complete records, review aggregate counts, and apply bulk status or severity updates.

The bundle also includes a CLI and two agent skills for triage and remediation. The CLI provides snapshot, list, get, and fix-prompt commands, with JSON output available for query commands. The MCP server and CLI are distributed through the npm package `@abyssbugg/sourcery`.

Sourcery's public API is documented as a Team-plan REST API for security findings. The bundle does not expose Sourcery's documented pull-request review commands through REST. Commands such as review, summary, guide, title, resolve, dismiss, and create issue remain GitHub or GitLab comment and label actions and require a separate Git provider connector.

## How it works

The sourcery MCP server uses `https://api.sourcery.ai/api` and sends the configured bearer token with API requests. Its implementation is generated and checked against a committed OpenAPI snapshot, so the supported API surface is deliberately limited to eight verified operations:

- Listing findings and issue groups with filters and cursor pagination
- Reading statistics by status and severity
- Fetching an individual finding or group
- Bulk-updating findings or groups

The MCP layer presents these operations through named tools. `sourcery_security_snapshot` combines counts with the first page of active findings for an initial triage view. `sourcery_build_fix_prompt` creates a Sourcery-style minimal-change prompt from a finding; dependency findings use fixed versions and the manifest path to render the dependency chain. `sourcery_capabilities` reports the verified surface, specification pin, and enum values, while `sourcery_api_request` provides a compatibility bridge restricted to the same eight operations.

## Setup and configuration

The sourcery MCP server requires Node.js 20 or later and the `SOURCERY_API_KEY` environment variable. Run the package without arguments for a stdio MCP server:

```bash
export SOURCERY_API_KEY='...'
npx -y @abyssbugg/sourcery@latest
```

For Streamable HTTP, use:

```bash
npx -y @abyssbugg/sourcery@latest http
```

That mode listens on `127.0.0.1:8765/mcp`. Remote clients need an HTTPS deployment when required by the host. The repository also provides plugin wiring, skills, and host-specific installers for supported environments.

## Tools and capabilities

The sourcery MCP server includes tools for:

- Snapshot views, filtered finding lists, individual finding retrieval, and finding counts
- Bulk finding updates, limited to 100 IDs per request; `SOLVED` is scanner-owned and rejected
- Group listing, retrieval, counts, and bulk updates
- Fix-prompt generation for security remediation
- Reporting the pinned capabilities and forwarding only verified API operations

Finding records may include source snippets and dependency graphs. List filters include repository IDs, issue types, statuses, search text, result limits, and cursors.

## Limitations and notes

The API specification is pinned in the repository, including its recorded hash and fetch date. Changes to Sourcery's live specification require regenerating the snapshot and updating the related constants and tests. The server therefore should not be treated as a general-purpose interface to undocumented Sourcery features.

Bulk updates accept at most 100 IDs. Scanner-owned `SOLVED` status changes are rejected. Pull-request review controls are not part of the verified REST API, so use a GitHub or GitLab connector for those operations.

_Full upstream README: https://allmcps.com/mcp/sourcery/readme_