# Sashiko MCP

MCP server that lets an AI agent query **Sashiko** — an AI kernel-patch
review service — and hunt for **critical/high severity vulnerabilities** in the
reviewed patches (LPE, UAF, OOB, refcount, race conditions, etc.), including
AI reviews that may have gone unnoticed.

## Install / config

```bash
cd ~/MCP/Sashiko && npm install
```

Register in opencode (`~/.config/opencode/opencode.jsonc`). Use the **absolute
path to your copy of the repo** on that machine (replace `<PATH-TO-SASHIKO>`
with the actual location):

```jsonc
"sashiko": {
  "type": "local",
  "command": ["node", "<PATH-TO-Sashiko>/src/index.js"],
  "enabled": true
}
```

Optional env: `SASHIKO_BASE_URL` (default `http://34.149.213.196`),
`SASHIKO_TIMEOUT_MS` (default 30000).

## Tools

| Tool | Purpose |
|------|---------|
| `sashiko_config` / `sashiko_lists` / `sashiko_stats` | service metadata |
| `sashiko_stats_reviews` / `sashiko_stats_tools` | review + tool usage stats |
| `sashiko_patchsets` / `sashiko_messages` | paged lists with `q` / `mailing_list` filters |
| `sashiko_patchset` | full patchset detail + AI reviews with parsed findings |
| `sashiko_message` | raw message + diff |
| `sashiko_review` | AI review + model transcript/logs |
| `sashiko_find_critical` | **find critical/high findings** across patchsets (pre-filtered scan) |
| `sashiko_find` | general severity/class scan (e.g. `class_keyword="lpe"`, `severity="high"`) |
| `sashiko_endpoints` | enumerate the whole API surface |

## Example queries

- "Find LPE-type vulnerability reviews in applied patches"
  → `sashiko_find` with `class_keyword="lpe"`, `severity="high"`
- "Show me critical findings no one noticed"
  → `sashiko_find_critical` `severity="critical"`, then compare against patchset status
- "What AI reviews mention use-after-free?"
  → `sashiko_find` with `keywords="use-after-free"`

## Notes

- Reviews are public by design; findings are parsed from `review.output`.
- The `findings_critical`/`findings_high` counts on the patchset list serve as
  a cheap pre-filter before fetching detail per patchset.
- See `docs/api-map.md` for the full API and finding schema.