mobb-dev/mobb-vibe-shield-mcp

Bugsy is a command-line interface (CLI) tool that provides automatic security vulnerability remediation for your code. It is the community edition version of Mobb, the first vendor-agnostic automated security vulnerability remediation tool. Bugsy is designed to help developers quickly identify and fix security vulnerabilities in their code.
What is Mobb?
Mobb is the first vendor-agnostic automatic security vulnerability remediation tool. It ingests SAST results from Checkmarx, CodeQL (GitHub Advanced Security), OpenText Fortify, and Snyk and produces code fixes for developers to review and commit to their code.
What does Bugsy do?
Bugsy has two modes - Scan (no SAST report needed) & Analyze (the user needs to provide a pre-generated SAST report from one of the supported SAST tools).
Scan
- Uses Checkmarx or Snyk CLI tools to run a SAST scan on a given open-source GitHub/GitLab/ADO repo
- Analyzes the vulnerability report to identify issues that can be remediated automatically
- Produces the code fixes and redirects the user to the fix report page on the Mobb platform
Analyze
- Analyzes the a Checkmarx/CodeQL/Fortify/Snyk vulnerability report to identify issues that can be remediated automatically
- Produces the code fixes and redirects the user to the fix report page on the Mobb platform
Disclaimer
This is a community edition version that only analyzes public GitHub repositories. Analyzing private repositories is allowed for a limited amount of time.
Bugsy does not detect any vulnerabilities in your code, it uses findings detected by the SAST tools mentioned above.
Usage
Command Line Interface
You can simply run Bugsy from the command line, using npx:
This will show you Bugsy's usage help:
To run a new SAST scan on a repo and get fixes, run the **Bugsy Scan** command. Example:
To get fixes for a pre-generated SAST report, run the **Bugsy Analyze** command. Example:
npx mobbdev analyze --scan-file sast_results.json --repo https://github.com/mobb-dev/simple-vulnerable-java-project
Bugsy will automatically generate a fix for each supported vulnerability identified in the results, and refer the developer to review and commit the fixes to their code.
To see all the options Bugsy allows, use the Scan or Analyze commands with the -h option:
Model Context Protocol (MCP) Server
Bugsy can also be used as an MCP server, allowing AI assistants like Claude to automatically scan and fix vulnerabilities in your code repositories.
Prerequisites
1. **API Key**: You need a Mobb API key to use the MCP server functionality
- Sign up at mobb.ai to get your API key
- Set the API_KEY environment variable: export API_KEY=your_api_key_here
2. **Local Git Repository**: The MCP server analyzes git repositories with uncommitted changes
- Make sure your code is in a local git repository
- Have some modified, added, or staged files to analyze
Installation
Run mobb-mcp from command line:
Configuration
Add Mobb MCP to your Cursor MCP client configuration:
API_URL is only required if you are not using https://app.mobb.ai
**Environment Variables:**
- API_KEY: Your Mobb API key (required)
- API_URL: Custom Mobb API URL (optional, defaults to https://app.mobb.ai)