Symbiotic MCP Server

What Symbiotic MCP Server MCP server does

Symbiotic MCP Server MCP server connects MCP clients to the Symbiotic CLI for security analysis. It provides separate operations for static code analysis, infrastructure security scanning, and a combined scan covering both areas. A language lookup operation reports which programming languages are supported.

The server is intended for workflows where an MCP client supplies files for analysis. The README states that scanning does not affect the workspace. Cursor users can also add a security-review command that accepts file paths or glob patterns and requests a broader review of selected files or the full workspace. That workflow is described as including finding triage, false-positive filtering, severity levels, remediation suggestions, and optional automatic fixes.

How it works

The MCP client sends file content to the server. The server creates temporary files, invokes symbiotic-cli, collects the result, formats it for the client, and removes the temporary files afterward. This design allows the CLI to analyze received files without directly changing the project workspace.

The available MCP operations are:

• code_scan_files for static analysis of code files
• infra_scan_files for infrastructure security checks
• security_scan_files for combined code and infrastructure scanning
• get_supported_languages for listing supported programming languages

STDIO is the default transport. The project also documents SSE and streamable HTTP modes. In HTTP mode, the server can listen on a configured port, with /mcp identified as the streamable HTTP endpoint.

Setup and configuration

Install the Symbiotic CLI from the release location referenced by the project, then create a Symbiotic Security account and obtain an API token. Clone this MCP server repository, install its Node.js dependencies with npm install, and compile it with npm run build. The resulting server is started with node build/index.js.

Configure the MCP client to launch that Node entry point and pass the token through the SYMBIOTIC_API_TOKEN environment variable. The token is required. Client configuration filenames and locations differ, so the exact JSON placement depends on the MCP client being used.

For an HTTP launch, set SERVER_PORT before starting the built entry point, such as SERVER_PORT=9593 node build/index.js. The README does not specify separate authentication settings for SSE or streamable HTTP beyond the required Symbiotic token.

Tools and capabilities

The server supports three scanning scopes: code-only, infrastructure-only, and combined security analysis. This makes it suitable for agents that need to inspect application source files, infrastructure definitions, or both in one request. The language query can help an agent determine whether a target programming language is supported before requesting a code scan.

Cursor integration adds a project command named /security-review. That command can target paths or glob patterns and is documented to produce a detailed report with severity and remediation information. The command setup requires a .cursor/commands/security-review.md file based on the repository’s supplied command definition.

Limitations and notes

Symbiotic MCP Server MCP server depends on the external Symbiotic CLI and a valid Symbiotic Security API token. The provided material does not identify the token’s pricing, rate limits, supported infrastructure formats, or the complete language list. It also does not state a software license.

The README describes local build and launch steps but does not provide a published package name or a one-command package-manager installation. Client configuration may need adjustment for the selected transport and host application. Automatic fixes are documented for the Cursor security-review workflow, not as a separately listed MCP tool.