Sashiko MCP

MCP server that lets an AI agent query Sashiko — an AI kernel-patch review service — and hunt for critical/high severity vulnerabilities in the reviewed patches (LPE, UAF, OOB, refcount, race conditions, etc.), including AI reviews that may have gone unnoticed.

Install / config

cd ~/MCP/Sashiko && npm install

Register in opencode (~/.config/opencode/opencode.jsonc). Use the absolute path to your copy of the repo on that machine (replace <PATH-TO-SASHIKO> with the actual location):

"sashiko": {
  "type": "local",
  "command": ["node", "<PATH-TO-Sashiko>/src/index.js"],
  "enabled": true
}

Optional env: SASHIKO_BASE_URL (default http://34.149.213.196), SASHIKO_TIMEOUT_MS (default 30000).

Related MCP server: patchwork-mcp-server

Tools

Example queries

• "Find LPE-type vulnerability reviews in applied patches" → sashiko_find with class_keyword="lpe", severity="high"

• "Show me critical findings no one noticed" → sashiko_find_critical severity="critical", then compare against patchset status

• "What AI reviews mention use-after-free?" → sashiko_find with keywords="use-after-free"

Notes

• Reviews are public by design; findings are parsed from review.output.

• The findings_critical/findings_high counts on the patchset list serve as a cheap pre-filter before fetching detail per patchset.

• See docs/api-map.md for the full API and finding schema.