agentic-sdlc-mcp

Governance and evidence controls for AI coding agents working in real GitHub repositories.

Let Claude Code, Cursor, and other Model Context Protocol (MCP) clients work with repository context, review gates, security evidence, and human approval points.

中文 · npm · MCP Registry · Roadmap

agentic-sdlc-mcp is a software development lifecycle (SDLC) governance layer for teams that already let AI coding agents change production repositories. It turns GitHub context, policy, checks, reviews, security alerts, and release signals into 13 workflow-level MCP tools. Twelve tools are read-only. The only GitHub write tool previews changes by default.

What changes with this MCP

AI coding agents can create code and pull requests without understanding every repository rule. This server gives the agent bounded context and gives reviewers explicit evidence gaps instead of another free-form summary.

This server does not write code, merge pull requests, force-push, create releases, deploy software, or replace human security review.

How it fits into a production agent workflow

The MCP sits between an AI coding agent and GitHub evidence. Repository changes still happen through the agent's normal development environment, and high-impact decisions remain with your team.

flowchart LR
    Policy["Engineering policy<br>and repository rules"] --> MCP["agentic-sdlc-mcp"]
    Agent["AI coding agent<br>Claude Code · Cursor · MCP client"] --> MCP
    MCP --> GitHub["GitHub API evidence"]
    GitHub --> MCP
    MCP --> Reports["Briefs · plans · gates<br>reviews · release reports"]
    Reports --> Agent
    Reports --> Human["Human review and approval"]
    Agent -. "Code · commits · pull requests" .-> GitHub
    Human -. "Merge · release · deploy" .-> GitHub

Where it helps

Use the tools as decision support at the points where an autonomous agent would otherwise guess or rely on stale prose.

Install from npm

You need Node.js 22 or newer. Node 22 and 24 are tested in GitHub Actions. Run the published package directly from npm:

npx -y agentic-sdlc-mcp

For a global CLI installation:

npm install -g agentic-sdlc-mcp
agentic-sdlc-mcp

The default transport is stdio. Most MCP clients should start the package for you instead of running it in a separate terminal.

Let a coding agent set it up

Paste this prompt into Codex, Claude Code, or another coding agent:

Use npm install -g agentic-sdlc-mcp to install and configure this MCP globally. Repository: https://github.com/SakuraCianna/agentic-sdlc-mcp
Configure GITHUB_TOKEN and optional repository defaults through the MCP client's secret or environment configuration. On a trusted single-user machine, you may instead run agentic-sdlc-mcp configure or write them to ~/.agentic-sdlc-mcp.json. Never expose the token in chat, logs, or repository files; ask me for missing non-secret details.
Then verify the connection with the read-only repo_context tool and summarize its capabilities, required GitHub permissions, and safety boundaries.

Review every command and configuration change before approving it. Node.js 22 or newer is required.

Connect an MCP client

Add the server to Claude Desktop, Cursor, Windsurf, or another MCP client. Inject the GitHub token through the client's secret or environment configuration.

{
  "mcpServers": {
    "agentic-sdlc": {
      "command": "npx",
      "args": ["-y", "agentic-sdlc-mcp"],
      "env": {
        "GITHUB_TOKEN": "your_github_token_here",
        "GITHUB_OWNER": "your_organization",
        "GITHUB_REPO": "your_repository"
      }
    }
  }
}

Some Windows MCP clients require npx through cmd:

{
  "command": "cmd",
  "args": ["/c", "npx", "-y", "agentic-sdlc-mcp"]
}

GITHUB_OWNER and GITHUB_REPO are optional defaults. Tool calls can provide repository coordinates explicitly. Use the GitHub permission matrix to grant only the capabilities you enable.

npx -y agentic-sdlc-mcp configure

Verify the connection

Start with a read-only call so you can inspect the repository boundary before granting write access:

Use agentic-sdlc-mcp to run repo_context for the configured repository. Include package scripts, workflows, governance, and repository policy. Do not create issues or modify GitHub.

Then validate the write boundary without creating anything:

Generate a feature plan and pass its issue drafts to create_issue_set with dryRun: true. Show the target repository, titles, labels, body summaries, and warnings. Do not write to GitHub.

See the client-neutral smoke test for a five-minute verification path.

Tools

The server registers 13 workflow-level tools. MCP clients receive the full input and output schemas at runtime; this catalog explains when to use each tool and how to interpret its result.