English Français العربية

io.github.Toraastrta/sphior-code-mcp

Official registry Developer tools

Deterministic SAST/SCA findings + fix guidance for your AI agent. Runs locally, no account needed.

Source code Website Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

NPM package sphior-code-mcp
Claude Code 
claude mcp add sphior-code-mcp -e 'SPHIOR_API_KEY=<your sphior_api_key>' -e 'SPHIOR_WORKSPACE=<SPHIOR_WORKSPACE>' -e 'SPHIOR_API_BASE=<SPHIOR_API_BASE>' -- npx -y sphior-code-mcp@1.1.6
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "sphior-code-mcp": {
            "command": "npx",
            "args": [
                "-y",
                "sphior-code-mcp@1.1.6"
            ],
            "env": {
                "SPHIOR_API_KEY": "<your sphior_api_key>",
                "SPHIOR_WORKSPACE": "<SPHIOR_WORKSPACE>",
                "SPHIOR_API_BASE": "<SPHIOR_API_BASE>"
            }
        }
    }
}

Environment variables

  • SPHIOR_API_KEY secret Optional. Without it the server runs in local mode: it scans your workspace with the bundled deterministic engine and returns fix guidance. Set it to also get tamper-evident evidence, history and GRC integrations. Create one at https://sphior.com/account/code.
  • SPHIOR_WORKSPACE Optional. Directory to scan in local mode. Defaults to the directory your client launches the server in.
  • SPHIOR_API_BASE Override the API base URL for self-hosted / regional deployments. Default: https://sphior.com/api/v1

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. SPHIOR CODE
  2. Why this exists
  3. What it finds
  4. Repository layout
  5. Build from source
  6. Privacy
  7. Evidence records
  8. Related
  9. License

SPHIOR CODE

Deterministic secrets and insecure-pattern (CWE) detection for VS Code, JetBrains IDEs, the command line, and CI — running entirely on your machine.

No AI. No source upload. No telemetry. The same input always produces the same findings.

Why this exists

Most code scanners either ship your source to a server, or ask a language model what it thinks. Both make results hard to trust: you cannot reproduce them, and you cannot explain them to an auditor.

This one is deterministic. Every finding comes from a rule with a stable id, a CWE mapping, and a fingerprint derived from the code itself. Run it twice, get the same answer. Run it on someone else's machine, get the same answer.

What it finds

  • Hard-coded secrets — provider signatures plus entropy checks, across 36 rules (AWS, GCP, GitHub, Stripe, Slack, OpenAI, Anthropic, …). Only masked previews are ever emitted; raw values never leave the process.
  • Insecure code patterns mapped to CWE — 83 rules covering command injection, eval, XSS sinks, disabled TLS verification, weak crypto, unsafe deserialization, path traversal, SSRF, and more.
  • Data-flow (taint) analysis for JavaScript/TypeScript — tracks untrusted input from source to sink, so db.query("… " + req.query.id) is reported as SQL injection rather than a generic string-concatenation warning.
Languages

JavaScript, TypeScript (+ JSX/TSX), Python, Go, PHP, Ruby, Java, C#, Rust, Kotlin, C, C++, Scala, Swift — 14 languages, parsed with real grammars (tree-sitter), not regex alone.

Regex rules are used only where a parser adds nothing. When a language has an AST backend, the parser-based results take precedence and the regex equivalents are suppressed, which keeps false positives down.

Repository layout

packages/
├── sphior-scan/       Detection engine + language server + CLI  (@sphior/scan)
│   ├── src/engine/      rules, taint analysis, evidence records, SARIF output
│   ├── src/*-ast.ts     tree-sitter backends, registered at runtime per language
│   └── src/lsp/         Language Server Protocol implementation
├── sphior-vscode/     VS Code extension  (bundles the language server)
├── sphior-jetbrains/  JetBrains plugin   (LSP4IJ + the same language server)
└── code-mcp/          MCP server, surfaces findings to AI coding assistants

One engine, many surfaces. The editor, the CLI and CI all execute the identical detection code — there is no "editor version" that behaves differently from the CI version.

Build from source

Requires Node.js 18+.

# 1. engine + language server + CLI
cd packages/sphior-scan && npm install && npm run build

# 2a. VS Code extension (bundles the server produced above)
cd ../sphior-vscode && npm install && npm run build

# 2b. JetBrains plugin (requires JDK 21)
cd ../sphior-jetbrains && ./gradlew buildPlugin

The Gradle build syncs the language server produced in step 1 before packaging, so there is no copy step to remember — it fails rather than bundling a stale server.

Try the CLI
node packages/sphior-scan/dist/cli.js run ./your-project --json findings.json
SPHIOR CODE: 4 findings (critical=1 high=3 medium=0 low=0) engine=0.1.0 ruleset=2026.07.12-22

SARIF output (--sarif out.sarif) is accepted by GitHub code scanning and most CI dashboards.

Privacy

The extensions bundle the language server and start it as a local process. There is no network client in the shipped engine — no telemetry, no analytics, no phone-home. You can verify this: search this repository for fetch(, or inspect the bundled server.cjs in a published artifact.

Secret values are never stored or transmitted. Findings carry a masked preview (AKI…TY) and a SHA-256 of the surrounding snippet, never the secret itself.

Evidence records

packages/sphior-scan/src/engine/evidence implements the tamper-evident side: canonical JSON (RFC 8785), SHA-256 fingerprints, a per-tenant hash chain, and Merkle roots for batch anchoring. This is what lets a scan result be verified later by someone who does not trust the party that produced it.

The verification logic is here in the open on purpose — evidence that only its author can check is not evidence.

License

MIT — see LICENSE.

Frequently asked questions

What is io.github.Toraastrta/sphior-code-mcp?

Deterministic SAST/SCA findings + fix guidance for your AI agent. Runs locally, no account needed.

How do I install io.github.Toraastrta/sphior-code-mcp?

It runs on your machine. In Claude Code: claude mcp add sphior-code-mcp -e 'SPHIOR_API_KEY=<your sphior_api_key>' -e 'SPHIOR_WORKSPACE=<SPHIOR_WORKSPACE>' -e 'SPHIOR_API_BASE=<SPHIOR_API_BASE>' -- npx -y sphior-code-mcp@1.1.6. For other clients, paste the JSON configuration from this page into their MCP settings.

Does io.github.Toraastrta/sphior-code-mcp need an API key?

Yes. It expects SPHIOR_API_KEY, which you set in its configuration.

Is io.github.Toraastrta/sphior-code-mcp open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains io.github.Toraastrta/sphior-code-mcp?

It is published by Toraastrta. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.