Sourcery MCP server: security findings via a community server
Sourcery reviews pull requests and scans repositories for security issues. Its only public API covers the security findings, and a community server exposes that API to agents.
Checked 3 October 2026 · from Sourcery's documentation and live OpenAPI file, its GitHub issue tracker, npm, the official MCP registry and the community repository
One of 91 guides to monitoring and developer tools. Each covers what an AI coding agent can get out of the tool through MCP, the protocol that lets the agent query the tool directly.
Summary
Sourcery is an AI code reviewer for GitHub and GitLab pull requests, with an IDE extension and repository security scanning. As of 3 October 2026, it has not published an MCP server.
A community server fills part of the gap. @abyssbugg/sourcery wraps Sourcery's public security findings API in 12 tools, and it is listed in the official MCP registry.
The API, and therefore the server, needs a Team-plan account. Sourcery's pull request reviews are not in the API, so an agent reads those comments through the Git host.
How Sourcery works with MCP
Sourcery's documentation describes one public API: a Team-plan REST API for security findings. The GraphQL endpoint the product itself uses stays internal.
The live OpenAPI file at https://api.sourcery.ai/api/openapi.json lists eight operations. Six read issues, issue groups and counts; two update status and severity in bulk.
abyssbugg-labs/sourcery-agent-bundle builds its MCP server from a pinned copy of that file. It adds a snapshot tool, a fix-prompt builder and a restricted pass-through for the eight operations.
Every vendor here gets the same four checks: official, maintained, distributed and usable. Sourcery passes 2 of them.
| Check | Result | Evidence |
|---|---|---|
| Official | Fail | Sourcery has not published an MCP server as of 3 October 2026. Feature request #470, opened on 17 September 2025, is still open; its last activity was on 24 January 2026. |
| Maintained | Pass | The community server abyssbugg-labs/sourcery-agent-bundle was created on 11 September 2026 and last pushed on 1 October 2026. |
| Distributed | Pass | Published to npm as @abyssbugg/sourcery (0.2.4 on 30 September 2026) and listed in the official MCP registry as io.github.abyssbugg-labs/sourcery. |
| Usable | Unknown | Every tool needs a Team-plan Sourcery API key with security scanning, so the tools could not be exercised without a paid account. |
| Part of the work | What Sourcery has here | Can an agent reach it |
|---|---|---|
| Code, tests & review | Security findings from repository scans | Yes, through the community server. Issues, groups, counts and bulk status changes |
| Code, tests & review | Pull request review comments, summaries and reviewer guides | Partial. Not in Sourcery's API; a GitHub or GitLab connector reads them as ordinary comments |
Sourcery reaches an agent in two halves. Security findings come through the community server. Review output lives in the pull request, so the Git host's server is the way in.
What can an AI agent do with Sourcery?
Every Sourcery tool call returns HTTP 403
Any seat holder can create an API key, but the endpoints need security scanning, a Team-plan capability. Sourcery documents that a key on a lower plan returns 403 until the account moves to Team.
Guard: Confirm the account is on the Team plan before connecting, and create the key at app.sourcery.ai/dashboard/api-keys.
An agent changes the status of many findings at once
sourcery_bulk_update_findings and sourcery_bulk_update_groups change status or severity for up to 100 records per call. Those changes are visible to everyone on the account.
The server rejects SOLVED, because Sourcery's scanner owns that status.
Guard: Require approval for both bulk tools, or start with sourcery_security_snapshot and the list tools only.
The agent cannot find Sourcery's pull request review
Reviews, summaries and reviewer guides are posted to the pull request and driven by @sourcery-ai comment commands. None of that is in the REST API.
Guard: Read the review through the GitHub or GitLab server, and post @sourcery-ai review as a comment to request a fresh one.
How to configure Sourcery MCP for agents
- 1
Pin the version
The README suggests
@latest, but the package had five releases between 28 and 30 September 2026. Pin0.2.4or whichever version you reviewed. - 2
Key storage
Sourcery shows a new API key only once. Keep it in a secret store and pass it as
SOURCERY_API_KEY. - 3
Write tools
Two of the 12 tools change data. Decide whether the agent may triage findings or only read them.
Paste this into your agent’s instructions
When you answer from Sourcery findings, state: - The repository, the status filter and the severity of each finding cited. - Whether the list was complete or one page of results. Do not change a finding's status without approval. Say that pull request reviews are not part of this data.
Do you need the MCP server at all?
Call the API directly. An agent with an HTTP tool can send the key as a bearer token to https://api.sourcery.ai/api/v1/security-issues. The OpenAPI file documents every parameter.
GitHub or GitLab. Their servers read Sourcery's review comments and can post @sourcery-ai commands, which is how Sourcery's review features are controlled.
Vendors with first-party servers. Codacy, SonarQube and Semgrep each publish their own MCP server for code quality and security findings.
Use the community server for Sourcery's security findings, and the Git host's server for its reviews.
Sourcery integration setup
The server runs locally over stdio through npx. It needs Node 20 or later and a Team-plan API key.
Claude Code
This pins the version current on 3 October 2026. The key comes from the Sourcery dashboard's API Keys page.
claude mcp add-json "sourcery" '{"command":"npx",
"args":["-y","@abyssbugg/sourcery@0.2.4"],
"env":{"SOURCERY_API_KEY":"<team-plan-key>"}}'Check the key first
This is the first request in Sourcery's own API guide. HTTP 403 means the account is not on the Team plan.
curl https://api.sourcery.ai/api/v1/security-issues \ -H "Authorization: Bearer $SOURCERY_API_KEY"
Every other client
Each block below is the configuration for one client, with the file path and the key that client expects.
Other hosts
The repository also ships plugin manifests and install scripts for Cursor, Codex, VS Code, Devin and others. npx -y @abyssbugg/sourcery@0.2.4 http serves Streamable HTTP on 127.0.0.1:8765 for clients that need a URL.
What engineers report
Issue #470 shows demand for a Sourcery-run server. A second user added "This is what i came here to request too" on 24 January 2026. The community repository is three weeks old and has no stars.
Should you connect an agent to Sourcery?
Yes, if you are on Sourcery's Team plan and want an agent to triage security findings. Best for security teams using Sourcery scanning who want findings and fix prompts inside a coding agent.
- Strongest fit
- Yes, if you are on Sourcery's Team plan and want an agent to triage security findings.
- Main advantage
- The community server is built from Sourcery's own OpenAPI file and limits pass-through calls to its eight operations.
- Main weakness
- Sourcery's main product, pull request review, is outside the API and the server.
- Operational risk
- Two bulk-update tools can change up to 100 findings per call on a shared account.
From Oodle
One platform for agent traces and infrastructure
Agent traces usually sit in a different product from the rest of your telemetry, so when a slow database makes an agent slow the symptom is in one tool and the cause is in another. Oodle keeps both in one query surface.
See agent observabilityFrequently asked questions
Does Sourcery have an MCP server?
Not one of its own, as of 3 October 2026. The community package @abyssbugg/sourcery wraps Sourcery's security findings API and is in the official MCP registry.
Can an agent read Sourcery's findings?
Yes. Security findings are available through the Team-plan REST API, directly or through the community server's 12 tools.
Can an agent read Sourcery's pull request reviews through the API?
No. Reviews live in the pull request, so a GitHub or GitLab connector reads them as comments.
Which Sourcery plan does the API need?
The Team plan. Sourcery's plan table lists the security REST API and API keys for Team only.
