What HEIDES MCP server does
The HEIDES MCP server gives coding agents a persistent, local representation of a repository and checks changes against facts found in that repository. It is designed for situations where an agent may edit code without having read every caller, import, route, configuration file, or database relationship.
The command-line binary can scan a codebase, run its guards, judge a patch, or start the MCP interface. The regular check command acts as a gate: it returns a non-zero exit status for blockers or critical findings, while a clean workspace returns zero. Threshold and exit behavior can be adjusted with the documented command-line options.
Analysis is deliberately offline and deterministic. Findings identify the guard, severity, message, file, and line. The project does not use a model, cloud service, account, network lookup, or vulnerability database cache for these checks.
How it works
A scan walks the repository and stores its code map in one embedded SQLite database. The map includes files, symbols and captured documentation comments, call relationships, import relationships, and full-text indexes for names, documentation, literals, and comments. Later questions use those indexes instead of requiring an agent to reread the entire tree.
The analyzer can describe workspace structure, including entry points, high-connectivity files, and documentation coverage by language. It also recognizes several framework route-registration patterns, including Express, Flask, Django, and Go, so registered handlers are not treated as unused solely because ordinary call-site analysis cannot find them.
The local guards inspect taint flows, secrets, edge cases, schemas, and configuration. Taint analysis follows request data and environment reads across supported function and module boundaries, with a hop limit. Reported sinks include SQL, SSRF, NoSQL, shell commands, filesystem operations, prompts, evaluation, and Django's mark_safe. The analyzer uses receiver context for ambiguous method names to avoid treating unrelated calls as database operations.
Over MCP, harmony.check and harmony.report return structured findings. Reports include the guard, severity, message, file, and line, while the report response also provides security_gate, security_posture, and a coverage receipt. These fields let an agent use the verdict and understand inspected coverage without parsing prose.
Setup and configuration
Run the standalone binary locally, on a server, in CI, or under Termux. The available entry points are heides scan, heides check, heides staged patch.diff, and heides mcp. The material does not specify an installation package, release download procedure, required environment variables, or MCP client-specific configuration file.
No network service or account is required for the analysis described here. The embedded database is generated from the workspace, and the same repository should produce the same local result across supported environments.
Tools and capabilities
The HEIDES MCP server supports:
- Querying indexed repository structure, symbols, calls, imports, names, and documentation.
- Returning structured checks and reports through
harmony.check and harmony.report.
- Reviewing staged patches before they are applied.
- Detecting selected taint flows into security-sensitive sinks.
- Finding credentials by value shape in source and configuration.
- Checking foreign-key cycles, missing primary keys, and PII on read paths.
- Inspecting credentials in
.env files, Dockerfiles, Terraform, and manifests.
Indexing is supported for JavaScript, TypeScript, TSX, Python, PHP, Go, Java, C#, C, C++, Ruby, HTML, CSS, and Rust. Taint scanning is supported for JavaScript, TypeScript, TSX, Python, PHP, Go, Java, C#, and Ruby; C, C++, HTML, CSS, and Rust are indexed but not taint-scanned.
Limitations and notes
HEIDES reports only evidence available in files it reads. It does not provide continuously updated dependency or CVE intelligence. Dependency, secret, and exposure intelligence that requires an external feed is identified in the material as belonging to GRIM; the retained heides deps commands and deps.* tools indicate that distinction rather than supplying those answers themselves.
Unsupported or unscanned languages can still appear in the code map while producing no taint findings. Taint tracking also stops after its hop cap, so silence is not proof that a flow is absent beyond that limit. The MCP implementation scopes behavior-changing settings to individual calls, preventing one client's request from changing later requests handled by the same process.