Mobb Vibe Shield MCP Server Code Vulnerability Remediation

Overview

The Mobb Vibe Shield MCP server is a lightweight Model Context Protocol (MCP) implementation that inspects code (both human-authored and AI-generated) and returns vulnerability findings plus suggested remediations. It acts as a contextual middleware between code editors, CI systems, code-assistants, or LLM-based tools and a vulnerability detection/remediation engine, enabling automated scanning and suggested fixes without blocking developer workflows.

The server is designed to be easy to deploy in development and CI environments. It exposes simple HTTP endpoints that follow MCP conventions so model-driven tools can request context-aware analysis and receive structured responses (findings, confidence scores, remediation patches). This lets teams integrate security checks into pull requests, pre-commit hooks, or live code assistants while minimizing friction.

Features

• MCP-compliant endpoints for model-assisted analysis and remediation
• Static analysis + heuristics to identify common vulnerabilities in code snippets and files
• Structured findings with severity, confidence, and remediation suggestions
• Optional automated remediation patches (suggested or auto-applied)
• Webhook and CI-friendly responses for pull request gating
• Lightweight, configurable via environment variables and config files
• CLI for local scans and dev-time testing
• Extensible plugin architecture for adding custom checks or integrations

Installation / Configuration

Install the MCP server as an npm package and run it locally or in a container.

Install via npm:

# Install locally
npm install --save mobb-vibe-shield-mcp

# Or run with npx
npx mobb-vibe-shield-mcp

Start the server:

# start with default config
npx mobb-vibe-shield-mcp start

# start on a specific port
PORT=8085 npx mobb-vibe-shield-mcp start

Example environment configuration:

# Required/Recommended env vars
PORT=8085                    # port to listen on
MCP_SECRET="s3cr3t-token"    # shared secret for MCP auth
REPO_TOKEN="ghp_..."         # token to fetch repo files (optional)
ENABLE_AUTO_REMEDIATION=false # whether to auto-apply patches
LOG_LEVEL=info

Config file (config.yml) example:

mcp_version: "1.0"
max_file_size_kb: 512
auto_remediation: false
allowed_languages:
  - javascript
  - typescript
  - python
plugins:
  - sql-injection-check
  - secret-scanner

Available Tools

The server ships with several built-in tools and can be extended with plugins:

• CLI scanner: quick local scan for files or directories
• HTTP MCP API: endpoints for analysis, remediation, and health checks
• Webhook adapter: send results to CI or PR systems
• Plugins: add language-specific checks, secret scanning, dependency scanning

Example endpoints:

• POST /mcp/analyze — analyze a code snippet or file
• POST /mcp/remediate — request suggested fixes or apply patches
• GET /health — basic health check

Example analyze request (curl):

curl -X POST http://localhost:8085/mcp/analyze \
  -H "Authorization: Bearer ${MCP_SECRET}" \
  -H "Content-Type: application/json" \
  -d '{
    "mcp_version": "1.0",
    "session_id": "sess-123",
    "context": {
      "files": [
        { "path": "src/index.js", "content": "const exec = require(\"child_process\").exec; exec(req.query.cmd);" }
      ]
    }
  }'

Example analyze response (JSON):

{
  "findings": [
    {
      "id": "F-001",
      "path": "src/index.js",
      "range": { "start": 1, "end": 1 },
      "severity": "high",
      "message": "Untrusted command execution (potential RCE)",
      "confidence": 0.93,
      "remediation": "Validate and sanitize user input or use a whitelist. Avoid direct shell execution."
    }
  ],
  "meta": { "analyzed_at": "2026-04-01T12:00:00Z" }
}

Use Cases

• Pull Request Security Checks: Add MCP analysis to CI so each PR receives a findings report and suggested patches. Optionally block merges on high-severity findings.
• Live Code Assistant Integration: When a code assistant (LLM) requests context, the MCP server provides annotated findings and recommended edits so the assistant can generate secure code suggestions.
• Pre-commit / Git Hooks: Run the CLI scan in pre-commit to surface obvious vulnerabilities before code reaches the remote repository.
• Automated Remediation Pipelines: For low-risk issues, enable auto-remediation to apply safe patches (with audit logs) and create PRs for developer review.
• Compliance Reporting: Aggregate findings over time to generate security posture reports across repositories and teams.

Configuration Reference

Notes for Developers

• Treat MCP_SECRET like any other secret; rotate regularly and store in vaults/envars.
• Review suggested remediations before enabling automatic application in production.
• The plugin system allows integrating third-party scanners; keep plugin permissions limited to necessary scopes.
• The server is intended to augment, not replace, standard secure coding practices and code reviews.

For full source, configuration examples, and plugin development guidance, see the project repository on GitHub.