security-review-mcp 1.0.0__tar.gz

security_review_mcp-1.0.0/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

security_review_mcp-1.0.0/PKG-INFO

@@ -0,0 +1,156 @@
+Metadata-Version: 2.4
+Name: security-review-mcp
+Version: 1.0.0
+Summary: MCP server for security code review: prompts, checklists, quick scans and persistent security reports
+License-Expression: Apache-2.0
+Project-URL: Homepage, https://github.com/cyr-ius/security-review-mcp
+Project-URL: Documentation, https://cyr-ius.github.io/security-review-mcp/
+Project-URL: Repository, https://github.com/cyr-ius/security-review-mcp
+Project-URL: Issues, https://github.com/cyr-ius/security-review-mcp/issues
+Requires-Python: >=3.14
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: mcp<3,>=2
+Requires-Dist: sqlmodel>=0.0.22
+Requires-Dist: pydantic-settings>=2.2
+Requires-Dist: fastapi>=0.135
+Requires-Dist: tomlkit>=0.13
+Requires-Dist: alembic>=1.13
+Requires-Dist: pyjwt[crypto]>=2.10
+Requires-Dist: tree-sitter<0.27,>=0.25
+Requires-Dist: tree-sitter-python<0.26,>=0.25
+Requires-Dist: tree-sitter-typescript<0.24,>=0.23
+Requires-Dist: tree-sitter-javascript<0.26,>=0.25
+Requires-Dist: tree-sitter-java<0.24,>=0.23.5
+Provides-Extra: postgres
+Requires-Dist: psycopg2-binary>=2.9; extra == "postgres"
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Requires-Dist: ruff>=0.5; extra == "dev"
+Requires-Dist: debugpy>=1.8; extra == "dev"
+Provides-Extra: docs
+Requires-Dist: mkdocs<2,>=1.6; extra == "docs"
+Requires-Dist: mkdocs-material>=9.5; extra == "docs"
+Requires-Dist: mkdocs-static-i18n>=1.2; extra == "docs"
+Dynamic: license-file
+
+![Security Review MCP: a finding reported in the code](https://raw.githubusercontent.com/cyr-ius/security-review-mcp/master/docs/assets/banner.svg)
+
+# Security Review MCP
+
+![licence] ![Python] ![Angular] [![ci::status]][ci::github] [![pypi::version]][pypi::web] [![docker::pulls]][docker::hub] [![documentation::badge]][documentation::web]
+
+[licence]: https://img.shields.io/github/license/cyr-ius/security-review-mcp?label=Licence&color=blue
+[python]: https://img.shields.io/badge/Python-3.14%2B-blue?logo=python
+[angular]: https://img.shields.io/badge/Angular-22-blue?logo=angular
+[ci::status]: https://img.shields.io/github/actions/workflow/status/cyr-ius/security-review-mcp/tests.yml?branch=dev&label=Tests&color=blue&logo=github
+[ci::github]: https://github.com/cyr-ius/security-review-mcp/actions
+[pypi::version]: https://img.shields.io/pypi/v/security-review-mcp?color=blue&logo=pypi&logoColor=white
+[pypi::web]: https://pypi.org/project/security-review-mcp/
+[docker::pulls]: https://img.shields.io/docker/pulls/cyrius44/security-review-mcp.svg?logo=docker
+[docker::hub]: https://hub.docker.com/r/cyrius44/security-review-mcp
+[documentation::badge]: https://img.shields.io/badge/Documentation-MkDocs-green?logo=materialformkdocs
+[documentation::web]: https://cyr-ius.github.io/security-review-mcp/
+
+MCP server for **security-oriented code review** (vulnerabilities and misconfigurations), usable
+from VS Code / Copilot, Claude or a CI/CD agent. It provides review prompts, checklists, a
+pattern scan with focused Tree-sitter checks for unsafe Python SQL, Angular DOM flows and unchecked message origins, an offline dependency analysis
+and a report database (SQLite or PostgreSQL) usable in pipelines.
+
+📖 **Full documentation: <https://cyr-ius.github.io/security-review-mcp/>**
+
+🇫🇷 [Version française](README.fr.md)
+
+## Capabilities
+
+| | |
+|---|---|
+| **Prompts** | `security-review`, `api-security-review`, `configuration-review`, `codebase-review`, `dependency-review`, `triage-report`, `development-standards` |
+| **Tools** | checklists, `scan_code`, `scan_dependencies`, saving and reading of reports with their [checklist coverage](https://cyr-ius.github.io/security-review-mcp/usage/prompts-tools/#review-coverage) (grouped by a [normalized project name](https://cyr-ius.github.io/security-review-mcp/usage/prompts-tools/#project-name)), [status proposals](https://cyr-ius.github.io/security-review-mcp/usage/prompts-tools/#status-of-a-finding) (`propose_finding_status`: an agent never closes a finding), project posture and gate, SARIF export, trends, rule management |
+| **CLI** | `security-review-mcp` (MCP server, `enroll`, [`scan-deps`](https://cyr-ius.github.io/security-review-mcp/advanced/dependencies/#scan-with-a-shared-server-commit-hook) for a commit hook) and `security-review-controller` (`serve`, `db`, `advisories`, `rules`, `token`, `user`, `audit`), exit codes 0 / 1 / 2 |
+| **Pipelines** | [`security-review-ci`](https://cyr-ius.github.io/security-review-mcp/usage/gate/#pipeline-client-security-review-ci) (`gate`, `sarif`, `trend`, [`scan-code`](https://cyr-ius.github.io/security-review-mcp/advanced/code-scan/), [`scan-deps`](https://cyr-ius.github.io/security-review-mcp/advanced/dependencies/#scan-in-a-pipeline-security-review-ci-scan-deps), which store their reports through the API): lightweight client of the REST API for Jenkins, GitLab or GitHub, with a `ci` token restricted to the selected projects, no database driver |
+| **Rules** | More than 140 rules and more than 80 checklist items: Python, Java, Angular / Node.js, Docker, Kubernetes, configuration, GitLab CI, Jenkins, Spring, FastAPI, copied into the database at first start, plus your [internal rules](https://cyr-ius.github.io/security-review-mcp/advanced/rules/) (TOML import/export from the CLI or the web interface) |
+| **Development standards** | [conventions by technology](https://cyr-ius.github.io/security-review-mcp/advanced/standards/) managed in the web interface (TOML import/export) and handed to the AI assistant before it codes (prompt, `get_development_standards` / `list_development_standards` tools, resources) |
+| **Vulnerabilities** | manifests, lockfiles and [CycloneDX SBOMs](https://cyr-ius.github.io/security-review-mcp/advanced/dependencies/#cyclonedx-sbom-transitive-dependencies) checked against an OSV database (PyPI, npm, Maven) imported offline or [updated every day by the controller](https://cyr-ius.github.io/security-review-mcp/advanced/dependencies/#automatic-update-by-the-controller), optional proxy |
+| **Transport** | HTTP (shared server) or stdio (local mode), with optional Bearer tokens stored in the database (`token` CLI) with [expiry and rotation](https://cyr-ius.github.io/security-review-mcp/advanced/http/#expiry-and-rotation-of-tokens), and TLS (optionally mutual) |
+| **Audit and metrics** | [audit log](https://cyr-ius.github.io/security-review-mcp/advanced/audit-metrics/#audit-log) of triage decisions, tokens and enrollments, and [Prometheus metrics](https://cyr-ius.github.io/security-review-mcp/advanced/audit-metrics/#prometheus-metrics) on `/metrics` (`metrics` token) |
+| **Ticketing** | [findings sent to Jira or ServiceNow](https://cyr-ius.github.io/security-review-mcp/advanced/ticketing/) by hand or automatically above a severity threshold, one ticket per issue; [third-party connectors](https://cyr-ius.github.io/security-review-mcp/advanced/ticketing/#writing-a-connector) for other tools |
+| **Deployment** | MCP server and controller (REST API, web interface) [separated](https://cyr-ius.github.io/security-review-mcp/advanced/architecture/) on a shared database, Alembic migrations, Docker Compose and Kubernetes examples |
+| **Enrollment** | an MCP client without a token [requests its project](https://cyr-ius.github.io/security-review-mcp/advanced/http/#enrollment-request-the-project) (`request_enrollment` MCP tool or `enroll` CLI), an administrator approves it, then the user creates a personal MCP token in the web interface; a refused token gets a `401` that says how to get a new one |
+| **Web interface** | in English, French or Spanish: dashboard, [triage by a person](https://cyr-ius.github.io/security-review-mcp/usage/web-interface/#triage-of-findings) (reason, approver and expiry of the accepted risks and false positives), [risk acceptances](https://cyr-ius.github.io/security-review-mcp/usage/web-interface/#risk-acceptances) to renew or remove, with append-only comments, [per-project list of open findings](https://cyr-ius.github.io/security-review-mcp/usage/web-interface/#screens) for an expert review, management of [rules, checklists, tokens (per project or for all projects), report language, outgoing proxy (OSV and OIDC) and OSV updates](https://cyr-ius.github.io/security-review-mcp/usage/web-interface/), local or OIDC [user accounts](https://cyr-ius.github.io/security-review-mcp/usage/web-interface/#user-accounts), the only ones to open the interface (tokens are for machines: MCP agents, pipelines, scripts; personal or role [API tokens](https://cyr-ius.github.io/security-review-mcp/usage/web-interface/#api-tokens) for the REST API and Swagger, [personal MCP tokens](https://cyr-ius.github.io/security-review-mcp/usage/web-interface/#personal-mcp-tokens) on the projects of the user, with the `mcp-user` role; initial `admin` account in the logs), optional [OpenID Connect OIDC login](https://cyr-ius.github.io/security-review-mcp/advanced/sso/), [configurable in the interface](https://cyr-ius.github.io/security-review-mcp/advanced/sso/#configuring-sso-in-the-interface), with accounts created on the fly, and [roles, groups and permissions](https://cyr-ius.github.io/security-review-mcp/advanced/access-control/) (groups matched by name with the OIDC groups claim, roles per project given to groups, never directly to accounts) |
+
+Details: [how a review works](https://cyr-ius.github.io/security-review-mcp/usage/how-it-works/) (rules, checklists, standards, `AGENTS.md`),
+[prompts and tools](https://cyr-ius.github.io/security-review-mcp/usage/prompts-tools/),
+[whole codebase scan](https://cyr-ius.github.io/security-review-mcp/advanced/code-scan/),
+[dependencies](https://cyr-ius.github.io/security-review-mcp/advanced/dependencies/),
+[gate](https://cyr-ius.github.io/security-review-mcp/usage/gate/),
+[SARIF](https://cyr-ius.github.io/security-review-mcp/advanced/sarif/),
+[trends](https://cyr-ius.github.io/security-review-mcp/advanced/trends/).
+
+## Quick start
+
+The product runs as **two services** sharing one database: the **MCP server**
+(`security-review-mcp`), used by the agents and the CI, and the **controller**
+(`security-review-controller`), used by people: web interface, REST API, tokens and accounts.
+See [two services, two roles](https://cyr-ius.github.io/security-review-mcp/#two-services-two-roles).
+
+```bash
+pip install security-review-mcp        # Python ≥ 3.14; [postgres] extra for PostgreSQL
+
+# from the same directory (shared SQLite file)
+security-review-controller db upgrade                              # schema (Alembic)
+security-review-controller user create admin --group administrators   # web interface account
+security-review-controller token create --label alice              # token of the agent
+security-review-controller serve --port 8080                       # /ui interface and REST API
+security-review-mcp serve --transport streamable-http --port 8000  # /mcp endpoint
+
+security-review-ci gate --url http://localhost:8080 --project portal  # block a pipeline (ci token: SECREVIEW_TOKEN)
+```
+
+Host configuration (VS Code with a token, `.vscode/mcp.json`; Claude and `.mcp.json`: see
+[connecting the host](https://cyr-ius.github.io/security-review-mcp/getting-started/host/)):
+
+```json
+{
+  "servers": {
+    "security-review": {
+      "type": "http",
+      "url": "http://127.0.0.1:8000/mcp",
+      "headers": { "Authorization": "Bearer ${input:secreview-token}" }
+    }
+  },
+  "inputs": [
+    { "id": "secreview-token", "type": "promptString", "description": "Token", "password": true }
+  ]
+}
+```
+
+Step by step: [deploying the server](https://cyr-ius.github.io/security-review-mcp/getting-started/deploy/),
+[connecting the host](https://cyr-ius.github.io/security-review-mcp/getting-started/host/) (VS Code, Claude, enrollment).
+Other cases: [offline installation](https://cyr-ius.github.io/security-review-mcp/advanced/installation/),
+[local stdio mode](https://cyr-ius.github.io/security-review-mcp/advanced/stdio/),
+[HTTP, authentication and TLS](https://cyr-ius.github.io/security-review-mcp/advanced/http/),
+[Docker images](https://cyr-ius.github.io/security-review-mcp/advanced/docker/#published-images) (`ghcr.io/cyr-ius/security-review-mcp`, `docker.io/cyrius44/security-review-mcp`) and [Docker Compose with PostgreSQL](https://cyr-ius.github.io/security-review-mcp/advanced/docker/#docker-compose-with-postgresql),
+[architecture and Kubernetes](https://cyr-ius.github.io/security-review-mcp/advanced/architecture/),
+[`SECREVIEW_*` variables](https://cyr-ius.github.io/security-review-mcp/reference/configuration/).
+
+## Limits
+
+The scan produces leads, with false positives. Its Python Tree-sitter check covers only simple local SQL
+flows. It replaces neither a full SAST or SCA analysis, nor a human review. See
+[security and limits](https://cyr-ius.github.io/security-review-mcp/reference/security/).
+
+## Contributing
+
+```bash
+uv sync --extra dev && uv run pytest && uv run ruff check .
+```
+
+Development happens on `dev`, and a version is released by pushing a `vX.Y.Z` tag on `master`.
+See the [contribution guide](https://cyr-ius.github.io/security-review-mcp/contributing/) and
+[`AGENTS.md`](AGENTS.md) (instructions for AI agents).
+
+## Security and license
+
+Report a vulnerability privately, as described in [`SECURITY.md`](SECURITY.md). The project is
+distributed under the [Apache 2.0 license](LICENSE).

security_review_mcp-1.0.0/README.md

@@ -0,0 +1,120 @@
+![Security Review MCP: a finding reported in the code](https://raw.githubusercontent.com/cyr-ius/security-review-mcp/master/docs/assets/banner.svg)
+
+# Security Review MCP
+
+![licence] ![Python] ![Angular] [![ci::status]][ci::github] [![pypi::version]][pypi::web] [![docker::pulls]][docker::hub] [![documentation::badge]][documentation::web]
+
+[licence]: https://img.shields.io/github/license/cyr-ius/security-review-mcp?label=Licence&color=blue
+[python]: https://img.shields.io/badge/Python-3.14%2B-blue?logo=python
+[angular]: https://img.shields.io/badge/Angular-22-blue?logo=angular
+[ci::status]: https://img.shields.io/github/actions/workflow/status/cyr-ius/security-review-mcp/tests.yml?branch=dev&label=Tests&color=blue&logo=github
+[ci::github]: https://github.com/cyr-ius/security-review-mcp/actions
+[pypi::version]: https://img.shields.io/pypi/v/security-review-mcp?color=blue&logo=pypi&logoColor=white
+[pypi::web]: https://pypi.org/project/security-review-mcp/
+[docker::pulls]: https://img.shields.io/docker/pulls/cyrius44/security-review-mcp.svg?logo=docker
+[docker::hub]: https://hub.docker.com/r/cyrius44/security-review-mcp
+[documentation::badge]: https://img.shields.io/badge/Documentation-MkDocs-green?logo=materialformkdocs
+[documentation::web]: https://cyr-ius.github.io/security-review-mcp/
+
+MCP server for **security-oriented code review** (vulnerabilities and misconfigurations), usable
+from VS Code / Copilot, Claude or a CI/CD agent. It provides review prompts, checklists, a
+pattern scan with focused Tree-sitter checks for unsafe Python SQL, Angular DOM flows and unchecked message origins, an offline dependency analysis
+and a report database (SQLite or PostgreSQL) usable in pipelines.
+
+📖 **Full documentation: <https://cyr-ius.github.io/security-review-mcp/>**
+
+🇫🇷 [Version française](README.fr.md)
+
+## Capabilities
+
+| | |
+|---|---|
+| **Prompts** | `security-review`, `api-security-review`, `configuration-review`, `codebase-review`, `dependency-review`, `triage-report`, `development-standards` |
+| **Tools** | checklists, `scan_code`, `scan_dependencies`, saving and reading of reports with their [checklist coverage](https://cyr-ius.github.io/security-review-mcp/usage/prompts-tools/#review-coverage) (grouped by a [normalized project name](https://cyr-ius.github.io/security-review-mcp/usage/prompts-tools/#project-name)), [status proposals](https://cyr-ius.github.io/security-review-mcp/usage/prompts-tools/#status-of-a-finding) (`propose_finding_status`: an agent never closes a finding), project posture and gate, SARIF export, trends, rule management |
+| **CLI** | `security-review-mcp` (MCP server, `enroll`, [`scan-deps`](https://cyr-ius.github.io/security-review-mcp/advanced/dependencies/#scan-with-a-shared-server-commit-hook) for a commit hook) and `security-review-controller` (`serve`, `db`, `advisories`, `rules`, `token`, `user`, `audit`), exit codes 0 / 1 / 2 |
+| **Pipelines** | [`security-review-ci`](https://cyr-ius.github.io/security-review-mcp/usage/gate/#pipeline-client-security-review-ci) (`gate`, `sarif`, `trend`, [`scan-code`](https://cyr-ius.github.io/security-review-mcp/advanced/code-scan/), [`scan-deps`](https://cyr-ius.github.io/security-review-mcp/advanced/dependencies/#scan-in-a-pipeline-security-review-ci-scan-deps), which store their reports through the API): lightweight client of the REST API for Jenkins, GitLab or GitHub, with a `ci` token restricted to the selected projects, no database driver |
+| **Rules** | More than 140 rules and more than 80 checklist items: Python, Java, Angular / Node.js, Docker, Kubernetes, configuration, GitLab CI, Jenkins, Spring, FastAPI, copied into the database at first start, plus your [internal rules](https://cyr-ius.github.io/security-review-mcp/advanced/rules/) (TOML import/export from the CLI or the web interface) |
+| **Development standards** | [conventions by technology](https://cyr-ius.github.io/security-review-mcp/advanced/standards/) managed in the web interface (TOML import/export) and handed to the AI assistant before it codes (prompt, `get_development_standards` / `list_development_standards` tools, resources) |
+| **Vulnerabilities** | manifests, lockfiles and [CycloneDX SBOMs](https://cyr-ius.github.io/security-review-mcp/advanced/dependencies/#cyclonedx-sbom-transitive-dependencies) checked against an OSV database (PyPI, npm, Maven) imported offline or [updated every day by the controller](https://cyr-ius.github.io/security-review-mcp/advanced/dependencies/#automatic-update-by-the-controller), optional proxy |
+| **Transport** | HTTP (shared server) or stdio (local mode), with optional Bearer tokens stored in the database (`token` CLI) with [expiry and rotation](https://cyr-ius.github.io/security-review-mcp/advanced/http/#expiry-and-rotation-of-tokens), and TLS (optionally mutual) |
+| **Audit and metrics** | [audit log](https://cyr-ius.github.io/security-review-mcp/advanced/audit-metrics/#audit-log) of triage decisions, tokens and enrollments, and [Prometheus metrics](https://cyr-ius.github.io/security-review-mcp/advanced/audit-metrics/#prometheus-metrics) on `/metrics` (`metrics` token) |
+| **Ticketing** | [findings sent to Jira or ServiceNow](https://cyr-ius.github.io/security-review-mcp/advanced/ticketing/) by hand or automatically above a severity threshold, one ticket per issue; [third-party connectors](https://cyr-ius.github.io/security-review-mcp/advanced/ticketing/#writing-a-connector) for other tools |
+| **Deployment** | MCP server and controller (REST API, web interface) [separated](https://cyr-ius.github.io/security-review-mcp/advanced/architecture/) on a shared database, Alembic migrations, Docker Compose and Kubernetes examples |
+| **Enrollment** | an MCP client without a token [requests its project](https://cyr-ius.github.io/security-review-mcp/advanced/http/#enrollment-request-the-project) (`request_enrollment` MCP tool or `enroll` CLI), an administrator approves it, then the user creates a personal MCP token in the web interface; a refused token gets a `401` that says how to get a new one |
+| **Web interface** | in English, French or Spanish: dashboard, [triage by a person](https://cyr-ius.github.io/security-review-mcp/usage/web-interface/#triage-of-findings) (reason, approver and expiry of the accepted risks and false positives), [risk acceptances](https://cyr-ius.github.io/security-review-mcp/usage/web-interface/#risk-acceptances) to renew or remove, with append-only comments, [per-project list of open findings](https://cyr-ius.github.io/security-review-mcp/usage/web-interface/#screens) for an expert review, management of [rules, checklists, tokens (per project or for all projects), report language, outgoing proxy (OSV and OIDC) and OSV updates](https://cyr-ius.github.io/security-review-mcp/usage/web-interface/), local or OIDC [user accounts](https://cyr-ius.github.io/security-review-mcp/usage/web-interface/#user-accounts), the only ones to open the interface (tokens are for machines: MCP agents, pipelines, scripts; personal or role [API tokens](https://cyr-ius.github.io/security-review-mcp/usage/web-interface/#api-tokens) for the REST API and Swagger, [personal MCP tokens](https://cyr-ius.github.io/security-review-mcp/usage/web-interface/#personal-mcp-tokens) on the projects of the user, with the `mcp-user` role; initial `admin` account in the logs), optional [OpenID Connect OIDC login](https://cyr-ius.github.io/security-review-mcp/advanced/sso/), [configurable in the interface](https://cyr-ius.github.io/security-review-mcp/advanced/sso/#configuring-sso-in-the-interface), with accounts created on the fly, and [roles, groups and permissions](https://cyr-ius.github.io/security-review-mcp/advanced/access-control/) (groups matched by name with the OIDC groups claim, roles per project given to groups, never directly to accounts) |
+
+Details: [how a review works](https://cyr-ius.github.io/security-review-mcp/usage/how-it-works/) (rules, checklists, standards, `AGENTS.md`),
+[prompts and tools](https://cyr-ius.github.io/security-review-mcp/usage/prompts-tools/),
+[whole codebase scan](https://cyr-ius.github.io/security-review-mcp/advanced/code-scan/),
+[dependencies](https://cyr-ius.github.io/security-review-mcp/advanced/dependencies/),
+[gate](https://cyr-ius.github.io/security-review-mcp/usage/gate/),
+[SARIF](https://cyr-ius.github.io/security-review-mcp/advanced/sarif/),
+[trends](https://cyr-ius.github.io/security-review-mcp/advanced/trends/).
+
+## Quick start
+
+The product runs as **two services** sharing one database: the **MCP server**
+(`security-review-mcp`), used by the agents and the CI, and the **controller**
+(`security-review-controller`), used by people: web interface, REST API, tokens and accounts.
+See [two services, two roles](https://cyr-ius.github.io/security-review-mcp/#two-services-two-roles).
+
+```bash
+pip install security-review-mcp        # Python ≥ 3.14; [postgres] extra for PostgreSQL
+
+# from the same directory (shared SQLite file)
+security-review-controller db upgrade                              # schema (Alembic)
+security-review-controller user create admin --group administrators   # web interface account
+security-review-controller token create --label alice              # token of the agent
+security-review-controller serve --port 8080                       # /ui interface and REST API
+security-review-mcp serve --transport streamable-http --port 8000  # /mcp endpoint
+
+security-review-ci gate --url http://localhost:8080 --project portal  # block a pipeline (ci token: SECREVIEW_TOKEN)
+```
+
+Host configuration (VS Code with a token, `.vscode/mcp.json`; Claude and `.mcp.json`: see
+[connecting the host](https://cyr-ius.github.io/security-review-mcp/getting-started/host/)):
+
+```json
+{
+  "servers": {
+    "security-review": {
+      "type": "http",
+      "url": "http://127.0.0.1:8000/mcp",
+      "headers": { "Authorization": "Bearer ${input:secreview-token}" }
+    }
+  },
+  "inputs": [
+    { "id": "secreview-token", "type": "promptString", "description": "Token", "password": true }
+  ]
+}
+```
+
+Step by step: [deploying the server](https://cyr-ius.github.io/security-review-mcp/getting-started/deploy/),
+[connecting the host](https://cyr-ius.github.io/security-review-mcp/getting-started/host/) (VS Code, Claude, enrollment).
+Other cases: [offline installation](https://cyr-ius.github.io/security-review-mcp/advanced/installation/),
+[local stdio mode](https://cyr-ius.github.io/security-review-mcp/advanced/stdio/),
+[HTTP, authentication and TLS](https://cyr-ius.github.io/security-review-mcp/advanced/http/),
+[Docker images](https://cyr-ius.github.io/security-review-mcp/advanced/docker/#published-images) (`ghcr.io/cyr-ius/security-review-mcp`, `docker.io/cyrius44/security-review-mcp`) and [Docker Compose with PostgreSQL](https://cyr-ius.github.io/security-review-mcp/advanced/docker/#docker-compose-with-postgresql),
+[architecture and Kubernetes](https://cyr-ius.github.io/security-review-mcp/advanced/architecture/),
+[`SECREVIEW_*` variables](https://cyr-ius.github.io/security-review-mcp/reference/configuration/).
+
+## Limits
+
+The scan produces leads, with false positives. Its Python Tree-sitter check covers only simple local SQL
+flows. It replaces neither a full SAST or SCA analysis, nor a human review. See
+[security and limits](https://cyr-ius.github.io/security-review-mcp/reference/security/).
+
+## Contributing
+
+```bash
+uv sync --extra dev && uv run pytest && uv run ruff check .
+```
+
+Development happens on `dev`, and a version is released by pushing a `vX.Y.Z` tag on `master`.
+See the [contribution guide](https://cyr-ius.github.io/security-review-mcp/contributing/) and
+[`AGENTS.md`](AGENTS.md) (instructions for AI agents).
+
+## Security and license
+
+Report a vulnerability privately, as described in [`SECURITY.md`](SECURITY.md). The project is
+distributed under the [Apache 2.0 license](LICENSE).

security_review_mcp-1.0.0/pyproject.toml

@@ -0,0 +1,64 @@
+[build-system]
+# 77: license expression (PEP 639)
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "security-review-mcp"
+version = "1.0.0"
+description = "MCP server for security code review: prompts, checklists, quick scans and persistent security reports"
+readme = "README.md"
+license = "Apache-2.0"
+license-files = ["LICENSE"]
+requires-python = ">=3.14"
+dependencies = [
+    "mcp>=2,<3",
+    "sqlmodel>=0.0.22",
+    "pydantic-settings>=2.2",
+    "fastapi>=0.135",
+    "tomlkit>=0.13",
+    "alembic>=1.13",
+    "pyjwt[crypto]>=2.10",
+    "tree-sitter>=0.25,<0.27",
+    "tree-sitter-python>=0.25,<0.26",
+    "tree-sitter-typescript>=0.23,<0.24",
+    "tree-sitter-javascript>=0.25,<0.26",
+    "tree-sitter-java>=0.23.5,<0.24",
+]
+
+[project.urls]
+Homepage = "https://github.com/cyr-ius/security-review-mcp"
+Documentation = "https://cyr-ius.github.io/security-review-mcp/"
+Repository = "https://github.com/cyr-ius/security-review-mcp"
+Issues = "https://github.com/cyr-ius/security-review-mcp/issues"
+
+[project.optional-dependencies]
+postgres = ["psycopg2-binary>=2.9"]
+dev = ["pytest>=8", "ruff>=0.5", "debugpy>=1.8"]
+docs = [
+    "mkdocs>=1.6,<2",
+    "mkdocs-material>=9.5",
+    "mkdocs-static-i18n>=1.2",
+]
+
+[project.scripts]
+security-review-mcp = "security_review_mcp.server:main"
+security-review-controller = "security_review_mcp.controller:main"
+security-review-ci = "security_review_mcp.ci_client:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+security_review_mcp = ["default_rules.toml", "favicon.svg", "migrations/script.py.mako", "webui/*", "webui/**/*"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["src"]
+
+[tool.ruff]
+line-length = 100
+target-version = "py314"
+
+[tool.ruff.lint]
+select = ["E", "F", "W", "I", "B", "C4", "UP"]

security_review_mcp-1.0.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

security_review_mcp-1.0.0/src/security_review_mcp/__init__.py

@@ -0,0 +1,3 @@
+"""Security review MCP server."""
+
+__version__ = "1.0.0"

security_review_mcp-1.0.0/src/security_review_mcp/__main__.py

@@ -0,0 +1,5 @@
+"""Allow `python -m security_review_mcp`."""
+
+from .server import main
+
+main()