How do I install the sourcery MCP server?

Install it by running `npx -y @abyssbugg/sourcery@latest` with Node.js 20 or newer and `SOURCERY_API_KEY` set. The command starts the stdio MCP server; append `http` to start Streamable HTTP on `127.0.0.1:8765/mcp`.

How do I configure the Sourcery API key?

Set the `SOURCERY_API_KEY` environment variable before starting the server. The value is sent as a bearer token to Sourcery’s documented API at `https://api.sourcery.ai/api`.

Does sourcery work with Cursor?

Yes, sourcery works with Cursor through the repository’s plugin bundle. The README instructs users to symlink the repository into `~/.cursor/plugins/local/` and reload Cursor.

Can sourcery manage GitHub or GitLab review commands?

No, the Sourcery REST surface exposed here is for security findings and issue groups. Review, summary, guide, title, resolve, dismiss, and create-issue actions remain GitHub or GitLab comment and label commands and require a separate provider connector.

Sourcery

sourcerysecuritydeveloper-toolsfindings

Queries Sourcery security findings, updates issues, and builds remediation prompts through MCP or CLI.

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Not yet automatically verified

We haven't yet run this listing's install command through our automated sandbox check. This isn't a red flag — we're steadily working through the catalog.

Manual Client & Custom JSON ConfigExpand JSON ▾

Client Config & Setup

Configure Environment Variables (API Keys, Tokens, Options):

Add required secrets below — values are included directly in the generated snippet so you can copy and paste with confidence.

Quick Add:

Choose your client or environment

Target File:~/Library/Application Support/Claude/claude_desktop_config.json

claude_desktop_config.json

{
  "mcpServers": {
    "sourcery-2": {
      "command": "npx",
      "args": [
        "-y",
        "@abyssbugg/sourcery@latest"
      ],
      "env": {
        "SOURCERY_API_KEY": "YOUR_VALUE_HERE"
      }
    }
  }
}

💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.

Overview

The sourcery MCP server connects AI agents to Sourcery’s public security findings API. It provides triage, filtering, detailed issue retrieval, aggregate counts, bulk updates, and fix-prompt generation through a TypeScript MCP server distributed as an npm package. Run it over stdio or Streamable HTTP with a Sourcery API key, or use the included CLI for scripted workflows. Reach for it when an agent needs to inspect and manage Sourcery security findings; GitHub and GitLab review commands require a separate connector.

Use cases

Triage active Sourcery security findings

Filter findings by repository, type, status, or search term

Retrieve source snippets and dependency graphs

Apply bulk status or severity changes

Generate minimal-change remediation prompts

Key features

Security finding and issue-group queries

Status and severity aggregation

Cursor-based filtering and pagination

Bulk updates for up to 100 IDs

Dependency-aware fix-prompt generation

Stdio and Streamable HTTP modes

Capabilities & Tool Schemas (8)Self-reported

Inspect callable tools, capabilities, and parameters exposed to AI agents by Sourcery.

sourcery_security_snapshot

counts by status/severity plus the first page of active issues — start here for a triage overview.

sourcery_list_findings

list issues with `repository_ids`, `issue_types`, `statuses`, `search`, `limit`, `cursor`.

sourcery_get_finding

fetch one issue (full record incl. source snippet and dependency graph).

sourcery_get_security_counts

aggregate counts by status and severity.

sourcery_bulk_update_findings

bulk status/severity changes (≤100 ids; `SOLVED` is scanner-owned and rejected).

sourcery_build_fix_prompt

builds the Sourcery-style minimal-change agent prompt from a finding; the DEPENDENCY path uses `fixed_versions` + `manifest_file_path` and renders the dependency chain.

How Sourcery works

What the sourcery MCP server does

The sourcery MCP server exposes Sourcery’s documented Team-plan REST API for security findings to MCP-compatible agents. Its scope is security issue and issue-group data rather than Sourcery’s pull-request review controls. The bundle also includes a command-line interface and skills for triage and remediation workflows.

The package is published as @abyssbugg/sourcery. It can be used directly as an MCP process or installed as a plugin bundle for supported agent hosts. A Python implementation is included as a reference, while the production server is built with the official MCP TypeScript SDK.

How it works

The server uses Sourcery’s API at https://api.sourcery.ai/api and authenticates with a bearer token supplied through SOURCERY_API_KEY. Its implementation is pinned to a committed OpenAPI snapshot. The snapshot defines eight verified API operations covering issue and issue-group listing, statistics, retrieval, and bulk updates.

The MCP layer presents those operations as focused tools. A snapshot tool combines status and severity totals with the first page of active issues, making it a starting point for triage. List operations accept filters such as repository IDs, issue types, statuses, search text, limits, and cursors. The fix-prompt tool creates a minimal-change prompt from a finding; dependency findings use fixed versions and the manifest path to render the dependency chain.

Setup and configuration

Node.js 20 or newer is required. For the default stdio mode, set the API key and start the package without arguments:

server.ts

export SOURCERY_API_KEY='...'
npx -y @abyssbugg/sourcery@latest

Streamable HTTP mode is available with http and listens on 127.0.0.1:8765/mcp:

Terminal

npx -y @abyssbugg/sourcery@latest http

The repository contains host-specific setup instructions for Claude Code, Cursor, Codex or ChatGPT desktop, VS Code, Devin, Grok, Amp, Hermes, OpenClaw, and Rovo Dev CLI. ChatGPT web requires the HTTP server to be exposed behind HTTPS and added through developer mode. The bundle can also be run from a local plugin directory.

Tools and capabilities

The sourcery MCP server provides tools for both individual findings and issue groups:

Inspect snapshots, security counts, findings, and groups.
Filter and paginate findings or groups.
Retrieve a complete finding, including source snippets and dependency graphs.
Apply status or severity changes in bulk, up to 100 IDs per request.
Build Sourcery-style remediation prompts.
Report the pinned API surface, enum values, and specification details.
Send compatibility requests through a bridge limited to the eight verified operations.

The command-line interface offers equivalent workflows such as snapshot, list, get, and fix-prompt. Query commands accept --json for scripting. SOLVED is scanner-owned and rejected by bulk finding updates.

Limitations and notes

Sourcery’s public API is documented as a security-findings API. Review actions such as review, summary, guide, title, resolve, dismiss, and create issue remain GitHub or GitLab comment and label commands, so they are outside this server’s REST surface and should be handled through a Git provider connector.

The OpenAPI snapshot is pinned in the repository and includes a recorded fetch date and SHA-256 value. If Sourcery changes its specification, the snapshot and corresponding constants must be regenerated before relying on the new operations or enum values. The HTTP mode also requires suitable HTTPS exposure when used by ChatGPT web.

Read the full README →View source on GitHub →

Related MCP Servers

View all in Developer Tools View all alternatives

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

npm downloads

Package downloads in the last 30 days.

Last commit

13d ago

Most recent push to the default branch.

Tools exposed

Callable tools this server registers over MCP.

Reviews

No reviews yet — be the first to share how this listing worked for you.

Frequently Asked Questions about Sourcery

sourcery is an MCP server that connects AI agents to Sourcery’s public security findings API. Its main tools provide security snapshots, filtered finding and group lists, detailed issue records, aggregate counts, bulk updates, and minimal-change fix prompts. It runs through npm over stdio or Streamable HTTP and requires a Sourcery API key.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/sourcery-2?style=directory)](https://allmcps.com/mcp/sourcery-2)

HTML Embed

<a href="https://allmcps.com/mcp/sourcery-2"><img src="https://allmcps.com/api/badge/sourcery-2?style=directory" alt="Sourcery on AllMCPs" /></a>

Technical Specs & Signals

CategoryDeveloper Tools

53Quality signal: Good · 53/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership10/20

Documentation & tools25/30

Adoption & activity5/15

Community engagement0/10

A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.

★ Featured

Moxie Docs MCP

MCP & Agent Skills for Automated Documentation, and codebase conventions + context

Explore Server →

Own this project?

This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to unlock edit access and the Official badge and attach your website — proof is checked automatically, then reviewed by our team.

Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in 💻 Developer Tools →Best MCP servers for Developers →Alternatives to Sourcery →Install in Claude Desktop Install in Cursor Install in VS Code Setup guides for all 13 MCP clients