M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
B

Bugsy MCP Server

Community
Automatically analyze and remediate code vulnerabilities
How to install ↓ Compare GitHub source repository ↗
Category
Dev Tools #280 of 438
Stars
★ 68 Popular
Transport
stdio (local process)
Runtime
Node.js
Credentials
API key / credential required
License
MIT
Last commit
Tools
1
48FMRS · D

The source clearly documents the MCP startup command, environment variables, single tool, and parameter. It does not provide a complete tool response schema, version information, or broader client compatibility details, so clients are marked as partial.

Strongest · Documentation 14/20 Weakest · Reliability 7/20

Reliability
7/20
Security and permissions
7/20
Maintenance
8/20
Documentation
14/20
Setup experience
12/20
Why each score
Reliability 7/20
The README gives a plausible MCP launch command, one declared tool, and basic failure cases, but no cached manifest, initialization/tool-list handshake evidence, source, tests, or CI evidence is provided. Actual behavior, dependency control, and edge-case handling cannot be verified statically, so the score remains conservative.
Security and permissions 7/20
API_KEY is configured through an environment variable, and the example does not require putting a real secret in configuration. However, changed local repository files are uploaded to an external Mobb service, and MVS_AUTO_FIX can force automatic fixing. Data boundaries, transport protection, least privilege, user confirmation, and automatic modification behavior lack source evidence, so points are deducted. No red-line behavior from the prompt is evidenced.
Maintenance 8/20
The project is MIT-licensed, not archived, and has an identifiable organizational owner. The supplied material provides no release history, commit activity, dependency-update evidence, maintenance process, or security-response channel; stars and the issue count do not add points. This supports only a modest score.
Documentation 14/20
The README covers CLI and MCP installation, authentication, configuration, tool parameters, examples, environment variables, limitations, polling mode, and troubleshooting. It lacks source or manifest verification of the claims, platform/version requirements, cost and retention disclosures, and clear confirmation details for automatic fixes, so it does not merit full marks.
Setup experience 12/20
The README provides an npx launch path, API_KEY, optional API_URL, a mainstream-client JSON configuration, and local Git prerequisites. The path still depends on Node/npx, a Mobb API key, network access, and a local Git repository with changes; platform compatibility, version pinning, and actual connection evidence are absent, so points are deducted.

Static review · not runListed 2026-08-14

Read the FMRS scoring method →

Fit and risk

What it can accessReads local filesUses the network

Best for

  • Developers using local Git repositories and AI coding assistants
  • Teams that want rapid review of modified, added, or staged files
  • Users seeking automated remediation suggestions through Mobb

Not for

  • Users needing standalone vulnerability detection
  • Users without a Mobb API key or local Git repository
  • Users needing unrestricted, long-term analysis of private repositories

Required permissions

  • Requires a Mobb API_KEY
  • Requires access to the specified local Git repository and changed files
  • Uploads changed files for analysis
  • Can use API_URL to target a custom Mobb service URL

Risks and side effects

  • Code changes are uploaded to Mobb for analysis
  • When automatic fixing is enabled, fixes may be applied automatically and should be reviewed before committing
  • The community edition primarily analyzes public GitHub repositories, with private repository access limited in time
  • Results depend on upstream SAST findings; Bugsy does not detect vulnerabilities itself

Setup

Before you start

Runtime：Node.js

API_KEY requiredsecret Your Mobb API key, required; sign up at https://app.mobb.ai to get one.
Other optional settings (2)
API_URL optional Optional custom Mobb API URL; defaults to https://app.mobb.ai when unset.
MVS_AUTO_FIX optional Optional; set to "true" or "false" to force enable/disable automatic fix application regardless of the user's database setting.

Set the API_KEY environment variable locally and ensure the target code is in a Git repository with uncommitted, added, or staged changes. Start the server with npx mobbdev mcp and add the mobb-mcp configuration from the README to the MCP client. API_URL and MVS_AUTO_FIX are optional.

.cursor/mcp.json 
{"mcpServers":{"mobb-mcp":{"command":"npx","args":["mobbdev","mcp"],"env":{"API_KEY":"your_mobb_api_key_here","API_URL":"optional__your_mobb_api_url_here","MVS_AUTO_FIX":"true"}}}}

Shown for Cursor. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json
{
  "servers": {
    "mobb-mcp": {
      "command": "npx",
      "args": [
        "mobbdev",
        "mcp"
      ],
      "env": {
        "API_KEY": "your_mobb_api_key_here",
        "API_URL": "optional__your_mobb_api_url_here",
        "MVS_AUTO_FIX": "true"
      }
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal
claude mcp add mobb-mcp -e API_KEY=your_mobb_api_key_here -e API_URL=optional__your_mobb_api_url_here -e MVS_AUTO_FIX=true -- npx mobbdev mcp

Run it in a terminal; replace any <…> placeholders with your own values first.

Generate and validate client config

Check that it works

After starting the client, confirm that fix_vulnerabilities (with a `path` parameter) appears in the tool list; then modify and stage some files in a local git repo and say "run a scan with mobb-mcp" — receiving fix recommendations proves the connection works.

Troubleshooting

  1. For API_KEY environment variable is not set, verify that API_KEY is configured
  2. For Path is not a valid git repository, confirm that path points to a valid Git repository
  3. For No changed files found, confirm that files are modified, added, or staged
  4. If WebSocket connections are blocked, use the CLI's --polling option for HTTP polling
  5. Confirm that npx mobbdev mcp starts successfully and that client environment variables are valid

Things to try

Once connected, you can ask your AI assistant things like:

  • run a scan with mobb-mcp
  • run fix_vulnerabilities mcp tool on my current project
  • Can you check my code for security vulnerabilities?
  • Analyze the uncommitted changes in my local git repo and suggest vulnerability fixes

Tools 1

fix_vulnerabilities read-only
Scans current changes in a local Git repository and returns potential vulnerability fixes, code patches, and explanations. The path parameter is the local Git repository path.

Use cases

Ask an AI assistant to check current code changes for security vulnerabilities
Receive automated remediation patches and explanations
Support security review of SAST-related findings during development

Supported clients

ClaudePartial support
CursorPartial support

Listed from the project's documentation, not tested by this site.

Overview

Bugsy is the community edition of Mobb's command-line tool and can also run as an MCP server. It analyzes changed files in a local Git repository and returns potential vulnerability fixes, code patches, and explanations. Bugsy does not detect vulnerabilities itself; it uses SAST findings or Mobb's analysis workflow.

Similar servers

Context7 80 · B

Upstash's official server providing up-to-date third-party library docs for AI coding assistants

★ 63.3k · Tools 2 Compare with this →
Compare with other MCP servers

Source revision cf8b379c053c Data synced 2026-10-19 Read the FMRS scoring method