Sphior Code MCP

Deterministic SAST/SCA findings + fix guidance for your AI agent.

Connector by Toraastrta · GitHub account verified by the MCP Registry

IndexedMITLocal (stdio)★ 1

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/toraastrta-sphior-code-mcp

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

Deterministic SAST/SCA findings + fix guidance for your AI agent. Runs locally, no account needed.

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 26, 2026.

Tools: 6 read · 2 write · 0 delete
Secrets: 1 (API keys, tokens or passwords)
Install scripts: None found
Runs as: Node.js package

Tools by what they do 8

Read from the source code; the running server may list different tools.

Read 6 · Look things up without changing anything.

get_finding
get_fix_context
get_security_summary
health_check
list_findings
verify_evidence

Write 2 · Create, change, send or run things.

mark_false_positive
resolve_finding

Secrets and settings it asks for

Secrets: values you paste in that let it act as you.

SPHIOR_API_KEY

Other settings (environment variables or headers).

SPHIOR_API_BASE
SPHIOR_WORKSPACE

Network hosts it talks to 3

github.com · found in code
opencollective.com · found in code
sphior.com · found in code

Files it touches

Any path the agent passes to its tools

Tools (8)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

get_finding
Fetch full details of a single security finding by ID — includes CVSS score, CWE classification, exact file path and line number, vulnerability message, and fix hint. Use when the user wants to investigate a specific issue from list_findings.
get_fix_context
Scan for security problems and get deterministic remediation guidance so YOU (the AI agent) can fix them. Works with no account: without SPHIOR_API_KEY it scans the local workspace with the bundled engine. SPHIOR does not generate code or transmit source — open the referenced file in your workspace, read the code yourself, and apply the fix. Returns why-it-matters, remediation steps, exact location, and references. Findings at the same line are merged into one entry; `also` lists the others and one fix must satisfy all. A human must review before merge.
get_security_summary
Get the user's overall security posture: counts by severity, last scan time, and number of monitored repos. Use this when the user wants a high-level overview of their security health.
health_check
Report the server's mode and reachability. Works with no account: without SPHIOR_API_KEY it confirms local mode and lists which tools are usable. With a key it also returns the current security summary. Use this to debug connection issues.
list_findings
List security vulnerabilities (SAST + SCA) detected by SPHIOR CODE across the user's GitHub repositories. Use this when the user asks about security issues, vulnerabilities, or CVEs in their code. Returns up to 100 findings ordered by detection date (newest first).
mark_false_positive
Mark a finding as a false positive (the reported vulnerability is not actually exploitable). Use this when the AI's detection is incorrect for a specific code context.
resolve_finding
Mark a finding as resolved (e.g., after applying a fix). Use only when the vulnerability has actually been remediated. For false positives, use mark_false_positive instead.
verify_evidence
Independently verify SPHIOR's tamper-evident code evidence chain (Merkle root + hash-chain + commit anchor). Confirms the deterministic scan records were not altered — for auditors. No source code is returned.

Signals

Stars: 1
Forks: 0
Open issues: 0
Last commit (this folder): Oct 20, 2026 (9 days ago)
Last release: Oct 17, 2026 (11 days ago)

From GitHub (fetched Oct 24, 2026).

Details

Registry name: io.github.Toraastrta/sphior-code-mcp
Version: 1.1.6
Auth: API key
Packages: npm sphior-code-mcp
License: MIT
Repository: github.com/Toraastrta/sphior-code
Website: sphior.com/code
First seen: Oct 24, 2026
Last checked: Oct 24, 2026
Source: Official MCP Registry github-graphql