Arthor Agent

What arthurpanhku/Arthor-Agent MCP server does

arthurpanhku/Arthor-Agent MCP server is presented in the repository as the MCP and agent gateway for DocSentinel, an AI-assisted secure software development lifecycle platform. It is intended for security teams and agent workflows that need to review security-related documents, questionnaires, forms, and reports.

Assessments span six lifecycle areas: requirements, design, development, testing, deployment, and operations. Depending on the selected stage and skill, the platform can extract security requirements, identify compliance obligations, review architecture, generate threat-model material, assess secure coding concerns, triage SAST or DAST findings, examine deployment configuration, and assist with vulnerability or incident-related reviews.

The result is a structured assessment rather than an unstructured chat response. Reports can include risk items, compliance gaps, and recommended remediation, with JSON and Markdown described as supported output formats.

How it works

The repository describes a React console and FastAPI service behind three access paths: REST APIs, MCP tools, and A2A JSON-RPC. MCP clients connect through the agent gateway, while the assessment logic is shared with console and CI-oriented REST access. The gateway does not grant external agents approval authority; human review remains part of the workflow.

Uploaded material is parsed into a common representation. Supported input types include PDF, Word, Excel, PowerPoint, and plain text. A knowledge base can contain policies, standards, and other reference documents. Retrieval-augmented generation uses that material during assessment so findings can be evaluated against organizational guidance and compliance references.

LangGraph orchestrates stateful assessment flows with stage-specific branching, and LangChain provides the model integration layer. The documented provider choices include OpenAI, Anthropic Claude, Qwen, DeepSeek, and local Ollama deployments. The available provider set may depend on the surrounding DocSentinel configuration.

Tools and capabilities

arthurpanhku/Arthor-Agent MCP server is suitable for agent-driven access to workflows that include:

• Reviewing security documents and assessment submissions.
• Comparing material with policy and compliance references in a RAG knowledge base.
• Producing risk, gap, and remediation findings.
• Supporting SSDLC-specific reviews from requirements through operations.
• Exposing governed MCP tools alongside REST and A2A entry points.
• Sending work through a human-review lifecycle before approval decisions.

The broader platform also describes governance functions such as projects, framework overlays, controls, evidence submissions, audit trails, and readiness scoring. The excerpt does not provide a complete MCP tool list or individual tool schemas, so those capabilities should not be assumed to map one-to-one to callable MCP methods.

Limitations and notes

The repository material identifies the product as DocSentinel even though the listed repository name is arthurpanhku/Arthor-Agent. Confirm the package, entry point, and current deployment instructions in the repository before automating installation.

No exact installation command, package name, MCP client configuration, environment-variable list, or authentication setup is included in the supplied material. Provider credentials may be entered locally and shown as masked previews, but the excerpt does not establish which credentials are mandatory for every deployment.

Generated assessments are not a substitute for security approval. The repository explicitly describes human review as required and says external agents do not receive approval authority. Findings also depend on the supplied documents, selected SSDLC phase or skill, available policy knowledge, and configured language model.