The full upstream README, mirrored here for reference. Install config, tool schemas, adoption signals, and an original overview live on the Sourcery listing page.
A hybrid plugin bundle for agent-driven Sourcery security workflows: an MCP server (12 tools over Sourcery's public security API, pinned OpenAPI snapshot), two Agent Skills, and adapters for Claude Code, Cursor, Codex/ChatGPT, VS Code, Devin, Grok (CLI + Bot), Amp, Hermes, OpenClaw, and Rovo Dev CLI. The server ships as the npm package @abyssbugg/sourcery — most hosts just register npx -y @abyssbugg/sourcery@latest. See docs/COMPATIBILITY.md for per-host install steps.
Sourcery's current docs say the only public API is a Team-plan REST API for security findings. The documented API base is https://api.sourcery.ai/api, and the first documented request is:
Verified and pinned. The live OpenAPI document (https://api.sourcery.ai/api/openapi.json) is committed as a snapshot at openapi/sourcery-openapi.json:
Sourcery API 0.1.0 (OpenAPI 3.1.0)9fdb45e657a6406c86ea0d0def2963d534e20bec1a9c88f7d62dbc2e6807f877Every tool and the client allow-list are wired from that snapshot. The verified surface is exactly eight operations:
| Method | Path | Purpose |
|---|---|---|
| GET | /v1/security-issues | List issues (filters + cursor pagination) |
| GET | /v1/security-issues/stats | Counts by status and severity |
| GET | /v1/security-issues/{id} | Fetch one issue |
| PATCH | /v1/security-issues | Bulk update (max 100 ids) |
| GET | /v1/security-issue-groups | List groups (same filters) |
| GET | /v1/security-issue-groups/stats | Counts by status and severity |
| GET | /v1/security-issue-groups/{id} | Fetch one group including its issues |
| PATCH | /v1/security-issue-groups | Bulk update groups (max 100 ids) |
Sourcery's PR review controls are currently documented as GitHub/GitLab comment or label commands (review, summary, guide, title, resolve, dismiss, create issue) rather than public REST endpoints. Those actions are therefore best implemented through your GitHub/GitLab connector, while Sourcery is used for security findings.
Repo root = plugin root. The portable core (plugin.json + skills/ + mcp.json) follows the Agent Plugins 1.0.0 standard, which Cursor and OpenAI (Codex, ChatGPT desktop) load natively; the other files are thin per-host adapters.
sourcery_security_snapshot: counts by status/severity plus the first page of active issues — start here for a triage overview.sourcery_list_findings: list issues with repository_ids, issue_types, statuses, search, limit, cursor.sourcery_get_finding: fetch one issue (full record incl. source snippet and dependency graph).sourcery_get_security_counts: aggregate counts by status and severity.sourcery_bulk_update_findings: bulk status/severity changes (≤100 ids; SOLVED is scanner-owned and rejected).sourcery_list_groups, sourcery_get_group, sourcery_get_group_counts, sourcery_bulk_update_groups: the same capabilities for issue groups.sourcery_build_fix_prompt: builds the Sourcery-style minimal-change agent prompt from a finding; the DEPENDENCY path uses fixed_versions + manifest_file_path and renders the dependency chain.sourcery_capabilities: describes the verified surface, spec pin, and enum values.sourcery_api_request: compatibility bridge restricted to the eight verified operations.Inside an enabled plugin host, bin/sourcery runs the same CLI (it prefers a locally built dist/cli.js and otherwise falls back to npx). Add --json to any query command for scripting.
Requirements: Node 20+. Most hosts register the MCP server directly:
Or install it as a plugin bundle — one step per host (details in docs/COMPATIBILITY.md):
| Host | Quick start |
|---|---|
| Claude Code | claude --plugin-dir . — prompts for the API key on enable |
| Cursor | symlink the repo into ~/.cursor/plugins/local/, reload |
| Codex CLI / ChatGPT desktop | codex plugin marketplace add ./ |
| ChatGPT web | run npx -y @abyssbugg/sourcery@latest http behind HTTPS, add via developer mode |
| VS Code / Grok / Amp / Hermes / OpenClaw | scripts/install-local-hosts.sh (idempotent; registers plugin, MCP, and skills) |
| Devin | skill links via the installer; devin plugins install --local . for the full plugin |
| Grok Bot | paste-in skill from docs/grok-bot-skill.md |
| Rovo Dev CLI | scripts/install-rovodev.sh |
For development and tests, see the Python reference implementation (its suite doubles as the bundle-packaging checker) and run npm test for the TypeScript suite. The server is built on the official MCP TypeScript SDK (@modelcontextprotocol/sdk).
When Sourcery publishes a spec change:
Sourcery's PR review commands (review, summary, guide, title, resolve, dismiss, create issue) remain GitHub/GitLab comment or label commands — implement those through your Git provider connector, not the Sourcery REST API.