Security Review MCP

MCP server for security-oriented code review (vulnerabilities and misconfigurations), usable from VS Code / Copilot, Claude or a CI/CD agent. It provides review prompts, checklists, a pattern scan with focused Tree-sitter checks for request-to-SQL flows (Python, Java, Go, C#, Rust, Node.js), Angular DOM flows and unchecked message origins, an offline dependency analysis and a report database (SQLite or PostgreSQL) usable in pipelines.

📖 Full documentation: https://cyr-ius.github.io/security-review/

🇫🇷 Version française

Capabilities

Details: how a review works (rules, checklists, standards, AGENTS.md), prompts and tools, whole codebase analysis, dependencies, gate, SARIF, trends.

Quick start

The product runs as two services sharing one database: the MCP server (security-review-mcp), used by the agents and the CI, and the Controller server (security-review-controller), used by people: web interface, REST API, tokens and accounts. See two services, two roles.

uv venv && source .venv/bin/activate
uv pip install security-review         # Python ≥ 3.14; [postgres] extra for PostgreSQL

# from the same directory (shared SQLite file)
security-review-controller db upgrade                              # schema (Alembic)
security-review-controller user create admin --role admin --all-projects   # web interface account
security-review-controller token create --label alice              # token of the agent
security-review-controller serve --port 8080                       # /ui interface and REST API
security-review-mcp serve --port 8000                              # /mcp endpoint (streamable HTTP)

security-review-ci gate --url http://localhost:8080 --project portal  # block a pipeline (ci token: SECREVIEW_CI_TOKEN)

Host configuration (VS Code with a token, .vscode/mcp.json; Claude and .mcp.json: see connecting the host):

{
  "servers": {
    "security-review": {
      "type": "http",
      "url": "http://127.0.0.1:8000/mcp",
      "headers": { "Authorization": "Bearer ${input:secreview-token}" }
    }
  },
  "inputs": [
    { "id": "secreview-token", "type": "promptString", "description": "Token", "password": true }
  ]
}

Step by step: deploying the server, connecting the host (VS Code, Claude, enrollment). Other cases: offline installation, local mode (stdio), Bearer tokens, TLS, Docker images (ghcr.io/cyr-ius/security-review, docker.io/cyrius44/security-review) and Docker Compose with PostgreSQL, architecture and Kubernetes, SECREVIEW_* variables.

Limits

The scan produces leads, with false positives. Its Tree-sitter checks cover only simple local flows inside one file. It replaces neither a full SAST or SCA analysis, nor a human review. See security and limits.

Contributing

uv sync --extra dev && uv run pytest && uv run ruff check .

Development happens on dev, and a version is released by pushing a vX.Y.Z tag on master. See the contribution guide and AGENTS.md (instructions for AI agents).

Security and license

Report a vulnerability privately, as described in SECURITY.md. The project is distributed under the Apache 2.0 license.