plexicus-mcp

MCP (Model Context Protocol) server for Plexicus, the AI-powered Application Security Posture Management (ASPM) platform. It brings your security findings, scans and AI-generated remediations directly into Claude Code, Cursor, VS Code, Windsurf or any MCP-compatible client — so your coding agent can find, understand and fix vulnerabilities without leaving the IDE.

Unlike the rest of this monorepo, this directory is not a Docker service: it is a standalone Python package published to PyPI that runs on the developer's machine and talks to the Plexicus REST API.

Quick start

1. Generate an API token in the Plexicus console: Settings → API Tokens.
2. Add the server to your client:

Claude Code

claude mcp add plexicus \
  -e PLEXICUS_API_TOKEN=<your-token> \
  -e PLEXICUS_API_URL=https://api.app.plexicus.ai \
  -- uvx plexicus-mcp

Cursor / VS Code / Windsurf (JSON config)

{
  "mcpServers": {
    "plexicus": {
      "command": "uvx",
      "args": ["plexicus-mcp"],
      "env": {
        "PLEXICUS_API_TOKEN": "<your-token>",
        "PLEXICUS_API_URL": "https://api.app.plexicus.ai"
      }
    }
  }
}

No uv? Use pipx run plexicus-mcp or pip install plexicus-mcp + command plexicus-mcp.

Configuration

What it exposes

Tools

Prompts — fix_finding, triage_findings, security_review: guided workflows the agent can follow end-to-end (read finding → generate remediation → apply diff → verify).

Resources — plexicus://repositories and plexicus://repositories/{id}/findings as JSON.

Every tool returns {"markdown": ..., "data": ...}: a human-readable digest plus the raw API payload for follow-up automation.

Example session

"What critical security issues does this repo have?" — the agent calls get_current_repository, then list_findings(severity="critical").

"Fix the SQL injection one" — the agent uses the fix_finding prompt: reads the finding, requests an AI remediation, applies the diff to your workspace and runs the tests.

Development

cd mcp
pip install -e ".[dev]"
pytest
ruff check .

Releasing

Releases are published to PyPI by the Forgejo workflow .forgejo/workflows/publish-mcp.yml when a mcp-v* tag is pushed (e.g. mcp-v0.1.0). Bump version in pyproject.toml and __version__ in src/plexicus_mcp/__init__.py first.