Sourcery

What sourcery does

The sourcery MCP server exposes Sourcery security findings and issue groups to MCP-compatible agents. It supports finding-level and group-level workflows: an agent can inspect active issues, filter results, retrieve complete records, review aggregate counts, and apply bulk status or severity updates.

The bundle also includes a CLI and two agent skills for triage and remediation. The CLI provides snapshot, list, get, and fix-prompt commands, with JSON output available for query commands. The MCP server and CLI are distributed through the npm package @abyssbugg/sourcery.

Sourcery's public API is documented as a Team-plan REST API for security findings. The bundle does not expose Sourcery's documented pull-request review commands through REST. Commands such as review, summary, guide, title, resolve, dismiss, and create issue remain GitHub or GitLab comment and label actions and require a separate Git provider connector.

How it works

The sourcery MCP server uses https://api.sourcery.ai/api and sends the configured bearer token with API requests. Its implementation is generated and checked against a committed OpenAPI snapshot, so the supported API surface is deliberately limited to eight verified operations:

• Listing findings and issue groups with filters and cursor pagination
• Reading statistics by status and severity
• Fetching an individual finding or group
• Bulk-updating findings or groups

The MCP layer presents these operations through named tools. sourcery_security_snapshot combines counts with the first page of active findings for an initial triage view. sourcery_build_fix_prompt creates a Sourcery-style minimal-change prompt from a finding; dependency findings use fixed versions and the manifest path to render the dependency chain. sourcery_capabilities reports the verified surface, specification pin, and enum values, while sourcery_api_request provides a compatibility bridge restricted to the same eight operations.

Setup and configuration

The sourcery MCP server requires Node.js 20 or later and the SOURCERY_API_KEY environment variable. Run the package without arguments for a stdio MCP server:

export SOURCERY_API_KEY='...'
npx -y @abyssbugg/sourcery@latest

For Streamable HTTP, use:

npx -y @abyssbugg/sourcery@latest http

That mode listens on 127.0.0.1:8765/mcp. Remote clients need an HTTPS deployment when required by the host. The repository also provides plugin wiring, skills, and host-specific installers for supported environments.

Tools and capabilities

The sourcery MCP server includes tools for:

• Snapshot views, filtered finding lists, individual finding retrieval, and finding counts
• Bulk finding updates, limited to 100 IDs per request; SOLVED is scanner-owned and rejected
• Group listing, retrieval, counts, and bulk updates
• Fix-prompt generation for security remediation
• Reporting the pinned capabilities and forwarding only verified API operations

Finding records may include source snippets and dependency graphs. List filters include repository IDs, issue types, statuses, search text, result limits, and cursors.

Limitations and notes

The API specification is pinned in the repository, including its recorded hash and fetch date. Changes to Sourcery's live specification require regenerating the snapshot and updating the related constants and tests. The server therefore should not be treated as a general-purpose interface to undocumented Sourcery features.

Bulk updates accept at most 100 IDs. Scanner-owned SOLVED status changes are rejected. Pull-request review controls are not part of the verified REST API, so use a GitHub or GitLab connector for those operations.