Development Tools MCP Server

Instructions

Implementation Reference

• src/tools/code-analysis.ts:6-20 (registration)

  Registers the 'scan_security_issues' tool with name, description, and input schema requiring an array of file paths.
  { name: 'scan_security_issues', description: 'Scan code for security issues including secrets, vulnerabilities, and insecure patterns', inputSchema: { type: 'object', properties: { files: { type: 'array', items: { type: 'string' }, description: 'File paths to scan', }, }, required: ['files'], }, },
• src/tools/code-analysis.ts:9-19 (schema)

  Input schema for the tool: object with 'files' array of strings.
  inputSchema: { type: 'object', properties: { files: { type: 'array', items: { type: 'string' }, description: 'File paths to scan', }, }, required: ['files'], },
• src/tools/code-analysis.ts:79-91 (handler)

  Tool handler case: reads files using FileReader, scans with SecurityAnalyzer.scanSecurityIssues, returns aggregated issue counts and full list.
  case 'scan_security_issues': { const files = params.files as string[]; const codeFiles = await FileReader.readFiles(files.join(',')); const issues = await securityAnalyzer.scanSecurityIssues(codeFiles); return { total: issues.length, critical: issues.filter((i) => i.severity === 'critical').length, high: issues.filter((i) => i.severity === 'high').length, medium: issues.filter((i) => i.severity === 'medium').length, low: issues.filter((i) => i.severity === 'low').length, issues, }; }
• src/analyzers/security-analyzer.ts:8-25 (handler)

  Core handler implementation: orchestrates scanning of code files by calling helper methods for secrets, weak auth, and permission issues.
  async scanSecurityIssues(files: CodeFile[] | string[]): Promise<SecurityIssue[]> { const codeFiles = await this.getCodeFiles(files); const issues: SecurityIssue[] = []; for (const file of codeFiles) { // Detect hardcoded secrets issues.push(...this.detectSecrets(file)); // Detect weak authentication issues.push(...this.detectWeakAuth(file)); // Detect insecure dependencies (would check package.json in real implementation) // Detect permission issues issues.push(...this.detectPermissionIssues(file)); } return issues; }
• src/analyzers/security-analyzer.ts:30-80 (helper)

  Helper method to detect hardcoded secrets using regex patterns for passwords, API keys, etc.
  private detectSecrets(file: CodeFile): SecurityIssue[] { const issues: SecurityIssue[] = []; const lines = file.content.split('\n'); // Common secret patterns const secretPatterns = [ { pattern: /(?:password|passwd|pwd)\s*[=:]\s*["']([^"']+)["']/gi, type: 'password' as const, severity: 'critical' as const, }, { pattern: /(?:api[_-]?key|apikey)\s*[=:]\s*["']([^"']+)["']/gi, type: 'api_key' as const, severity: 'critical' as const, }, { pattern: /(?:secret|token)\s*[=:]\s*["']([^"']+)["']/gi, type: 'secret' as const, severity: 'high' as const, }, { pattern: /(?:aws[_-]?access[_-]?key|aws[_-]?secret)\s*[=:]\s*["']([^"']+)["']/gi, type: 'aws_credentials' as const, severity: 'critical' as const, }, { pattern: /(?:private[_-]?key|ssh[_-]?key)\s*[=:]\s*["']([^"']+)["']/gi, type: 'private_key' as const, severity: 'critical' as const, }, ]; for (let i = 0; i < lines.length; i++) { const line = lines[i]; for (const { pattern, type, severity } of secretPatterns) { if (pattern.test(line)) { issues.push({ type: 'secret', severity, location: `${file.path}:${i + 1}`, description: `Potential hardcoded ${type} detected`, recommendation: 'Move secrets to environment variables or secure configuration', detectedAt: new Date(), }); } } } return issues; }