MCP.Market

Sourcery MCP server

by abyssbugg-labs·io.github.abyssbugg-labs/sourcery·v0.2.4
No reviews yet

Sourcery security findings: MCP server, CLI, and fix-prompt builder over the Sourcery API.

B82/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B82/100

full report

Adoption
Growing

0 stars514 downloads/wk

Reviews

Write one

Nobody has reviewed Sourcery yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Sourcery tools

No tool declarations could be read from the package source. They show once the server is installed.

Public scan report

scanner v0.1.10 · 2026-10-01 · same rubric, same numbers if you re-run it

no findings
  • Code scan17 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 0 days ago15/15
  • Maintainer identityregistry namespace matches repository owner7/10
Overall 82/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Sourcery compares

Against every graded AI and agents MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
82/100
higher than 65% of 4,460 AI and agents servers
Downloads a week
514
more than 87% of 1,538 AI and agents servers with a package

Install Sourcery in Claude Code, Cursor or VS Code

Runs npx -y @abyssbugg/sourcery on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add sourcery -- npx -y @abyssbugg/sourcery
Add to Cursor

What the publisher says

From the Sourcery repository's README, as published. We do not edit it. Read it on GitHub

Sourcery Agent Bundle

A hybrid plugin bundle for agent-driven Sourcery security workflows: an MCP server (12 tools over Sourcery's public security API, pinned OpenAPI snapshot), two Agent Skills, and adapters for Claude Code, Cursor, Codex/ChatGPT, VS Code, Devin, Grok (CLI + Bot), Amp, Hermes, OpenClaw, and Rovo Dev CLI. The server ships as the npm package @abyssbugg/sourcery — most hosts just register npx -y @abyssbugg/sourcery@latest. See docs/COMPATIBILITY.md for per-host install steps.

What is confirmed

Sourcery's current docs say the only public API is a Team-plan REST API for security findings. The documented API base is https://api.sourcery.ai/api, and the first documented request is:

curl https://api.sourcery.ai/api/v1/security-issues \
  -H "Authorization: Bearer $SOURCERY_API_KEY"

Verified and pinned. The live OpenAPI document (https://api.sourcery.ai/api/openapi.json) is committed as a snapshot at openapi/sourcery-openapi.json:

  • Info: Sourcery API 0.1.0 (OpenAPI 3.1.0)
  • Fetched: 2026-09-10
  • SHA-256: 9fdb45e657a6406c86ea0d0def2963d534e20bec1a9c88f7d62dbc2e6807f877

Every tool and the client allow-list are wired from that snapshot. The verified surface is exactly eight operations:

Why the Sourcery API + Git connector split

Sourcery's PR review controls are currently documented as GitHub/GitLab comment or label commands (review, summary, guide, title, resolve, dismiss, create issue) rather than public REST endpoints. Those actions are therefore best implemented through your GitHub/GitLab connector, while Sourcery is used for security findings.

Bundle shape

Repo root = plugin root. The portable core (plugin.json + skills/ + mcp.json) follows the Agent Plugins 1.0.0 standard, which Cursor and OpenAI (Codex, ChatGPT desktop) load natively; the other files are thin per-host adapters.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Sourcery: common questions

Is Sourcery MCP server safe?
Mostly: it is graded B (82/100). Read the Sourcery safety report
How do I install Sourcery?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Sourcery need an API key?
Yes. The registry entry asks for SOURCERY_API_KEY.
Is Sourcery maintained?
The last commit was 34 days ago (2026-10-01). The latest release is v0.2.4.
What can I use instead of Sourcery?
Servers from other publishers that do the same job: Agent Security Scanner MCP server, agent-device MCP server and HOL Guard MCP server.
How does Sourcery compare with other AI and agents MCP servers?
safety score 82/100 (higher than 65% of 4,460 AI and agents servers); downloads a week 514 (more than 87% of 1,538 AI and agents servers with a package). Full comparison.

Alternatives to Sourcery

Same job from other publishers: the closest match first, then the best rated.

  • Agent Security Scanner
    Security layer for AI agents: blocks prompt injection, detects fake packages, scans vulnerabilities.
    C
  • agent-device
    Open source device layer for AI agents: control mobile, web, TV, and desktop apps over MCP
    A
  • HOL Guard
    Local-first AI agent security evidence and approval workflows through HOL Guard's stdio MCP server.
    A
  • Pm Claude Skills
    1310 professional Agent Skills + workflow recipes — searchable & fetchable over MCP.
    A
  • Agent-Native Forms
    Agent-Native form builder - create, edit, and manage forms
    More from BuilderIO →
    A