gmi-security-mcp

A security MCP server for coding agents, backed by GMI Inference. Your agent triages semgrep findings, scans repos, checks lockfiles against OSV, and verifies findings with a runnable PoC, all inside the editor, with the cost shown before every run.

PyPI: https://pypi.org/project/gmi-security-mcp/ — MCP Registry: https://registry.modelcontextprotocol.io/v0/servers?search=gmi-security-mcp — Repo: https://github.com/Jayanng/gmi-security-mcp

Install

Requires Python 3.13 or later and a GMI Inference API key. No GitHub token is needed for local repos.

pip install gmi-security-mcp
export GMI_API_KEY="your-gmi-key"
gmi-security-mcp --list-tools

That prints the 15 tool names. Run the server as a stdio MCP server with gmi-security-mcp, or run the 12 built-in examples with mcp-test, which spends under $0.02 with the default model. pipx install gmi-security-mcp works the same way, in an isolated venv.

Quick start

Add the server to Claude Code with claude mcp add gmi-security-mcp -e GMI_API_KEY="your-gmi-key" -- gmi-security-mcp, or drop this in .mcp.json:

{
  "mcpServers": {
    "gmi-security-mcp": {
      "command": "gmi-security-mcp",
      "env": { "GMI_API_KEY": "your-gmi-key" }
    }
  }
}

Config copies for Claude Code, Codex, and Cursor are in install/. Editor test status: Claude Code and Codex are tested for registration and tools/list only, Cursor is not tested end-to-end. See TUTORIAL.md section 2.

Tools

Cost and safety

Estimate before every run. The default cap is $1.00 per tool call and cannot go above $5.00. A single finding typically costs $0.0001 to $0.001 with Gemini 3.5 Flash Lite. A model verdict alone never confirms a finding: only a deterministic oracle reproducing it does, and a generated PoC never runs on your host until you review and confirm it. Secrets are redacted before anything is sent to GMI, and the key comes from GMI_API_KEY only, never from a file. Drafts are never sent, opened as a PR, forked, pushed, or emailed by this server.

Docs

• TUTORIAL.md: full worked tutorial, every command with real output, plus the reference appendix with tool details, cost records, limitations, and repo structure.
• CHANGELOG.md: version history, including what is new in 0.5.8.
• DECISIONS.md: design decisions and the audit record behind them.
• DATA_SOURCES.md: where the model pricing comes from and when it was last re-checked live.

Development

python3 -m venv .venv
.venv/bin/pip install -e ".[dev]"
python3 -m pytest tests/ -q

Unit tests need no key and no network. 317 tests pass. Live tests are separate and capped: $1.00 per full run, $5.00 total for the whole build.

License

MIT. See LICENSE.