Best for
- Developers using local Git repositories and AI coding assistants
- Teams that want rapid review of modified, added, or staged files
- Users seeking automated remediation suggestions through Mobb
B
Bugsy MCP Server
Community
Automatically analyze and remediate code vulnerabilities
GitHub source repository ↗
48FMRS · D
The source clearly documents the MCP startup command, environment variables, single tool, and parameter. It does not provide a complete tool response schema, version information, or broader client compatibility details, so clients are marked as partial.
Bugsy is the community edition of Mobb's command-line tool and can also run as an MCP server. It analyzes changed files in a local Git repository and returns potential vulnerability fixes, code patches, and explanations. Bugsy does not detect vulnerabilities itself; it uses SAST findings or Mobb's analysis workflow.
Tools
fix_vulnerabilities
Scans current changes in a local Git repository and returns potential vulnerability fixes, code patches, and explanations. The path parameter is the local Git repository path.
Setup
Set the API_KEY environment variable locally and ensure the target code is in a Git repository with uncommitted, added, or staged changes. Start the server with npx mobbdev mcp and add the mobb-mcp configuration from the README to the MCP client. API_URL and MVS_AUTO_FIX are optional.
claude_desktop_config.json
{"mcpServers":{"mobb-mcp":{"command":"npx","args":["mobbdev","mcp"],"env":{"API_KEY":"your_mobb_api_key_here","API_URL":"optional__your_mobb_api_url_here","MVS_AUTO_FIX":"true"}}}}
Fit and risk
Not for
- Users needing standalone vulnerability detection
- Users without a Mobb API key or local Git repository
- Users needing unrestricted, long-term analysis of private repositories
Required permissions
- Requires a Mobb API_KEY
- Requires access to the specified local Git repository and changed files
- Uploads changed files for analysis
- Can use API_URL to target a custom Mobb service URL
Risks and side effects
- Code changes are uploaded to Mobb for analysis
- When automatic fixing is enabled, fixes may be applied automatically and should be reviewed before committing
- The community edition primarily analyzes public GitHub repositories, with private repository access limited in time
- Results depend on upstream SAST findings; Bugsy does not detect vulnerabilities itself
Troubleshooting
- For API_KEY environment variable is not set, verify that API_KEY is configured
- For Path is not a valid git repository, confirm that path points to a valid Git repository
- For No changed files found, confirm that files are modified, added, or staged
- If WebSocket connections are blocked, use the CLI's --polling option for HTTP polling
- Confirm that npx mobbdev mcp starts successfully and that client environment variables are valid
Use cases
Ask an AI assistant to check current code changes for security vulnerabilities
Receive automated remediation patches and explanations
Support security review of SAST-related findings during development
Supported clients
ClaudePartial support
CursorPartial support