@repomend/mcp

Security scanner that hands Claude a fix prompt and opens the PR.

16 scanners → one normalised graph → MCP resource. Claude reads your findings with full codebase context and drafts surgical patches. Your job: review and merge.

What This Is

This is the official MCP (Model Context Protocol) server for RepoMend. It connects Claude Desktop, Claude Code, Cursor, Windsurf, or any MCP-compatible client to your RepoMend security findings.

When you run this server, Claude can:

• List and filter your security findings by severity, status, or scanner

• Read full finding details including vulnerable code snippets

• Get AI-optimized remediation prompts for any finding

• Update finding status (resolve, accept, mark false positive)

• View your scan history, monitored repos, and network targets

Quick Start

1. Get your API token

Sign in at repomend.com/dashboard/settings and generate an MCP token.

2. Configure Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "repomend": {
      "command": "npx",
      "args": ["-y", "@repomend/mcp"],
      "env": {
        "REPOMEND_TOKEN": "your-token-here"
      }
    }
  }
}

3. Ask Claude about your security posture

"Show me the critical findings in my API repo and draft fixes for anything safely patchable."

That's it. Claude will call RepoMend's tools, read your findings, and start drafting patches.

Configuration

Claude Code

claude mcp add repomend -- npx -y @repomend/mcp

Then set REPOMEND_TOKEN in your shell environment.

Cursor

Add to your Cursor MCP settings:

{
  "repomend": {
    "command": "npx",
    "args": ["-y", "@repomend/mcp"],
    "env": {
      "REPOMEND_TOKEN": "your-token-here"
    }
  }
}

Available Tools

list_findings

List security findings for your team, filtered by severity, status, or scanner.

Parameters:

Example prompt: "List all critical open findings from trivy"

get_finding

Get full details of a specific finding by ID, including code snippets and remediation guidance.

Parameters:

Example prompt: "Show me finding #42 in detail"

update_finding_status

Update a finding's status. Requires developer or admin role.

Parameters:

Example prompt: "Mark finding #42 as resolved with note 'patched in PR #891'"

get_remediation_prompt

Get an AI-optimized remediation prompt for a finding. Returns a structured markdown document with vulnerability details, vulnerable code, and fix instructions that Claude can act on.

Parameters:

Example prompt: "Get the remediation prompt for finding #42 and draft the fix"

list_scans

List recent scans for your team.

Parameters:

Example prompt: "Show me recent scan results"

list_repos

List all monitored repositories for your team.

Parameters: None

Example prompt: "Which repos are we currently scanning?"

list_targets

List all network targets configured for your team.

Parameters: None

Example prompt: "Show me our network scan targets"

Architecture & Security Model

┌─────────────────────────────────────────────────────────┐
│  Your Machine                                           │
│                                                         │
│  ┌───────────┐       ┌──────────────────┐              │
│  │  Claude   │──MCP──│  @repomend/mcp   │              │
│  │  Desktop  │ stdio │  (this package)  │              │
│  └───────────┘       └────────┬─────────┘              │
│                               │                         │
└───────────────────────────────┼─────────────────────────┘
                                │ HTTPS + Bearer token
                                ▼
                   ┌────────────────────────┐
                   │  mcp.repomend.ai       │
                   │  (RepoMend Platform)   │
                   │                        │
                   │  • Token validation    │
                   │  • Team isolation      │
                   │  • RBAC enforcement    │
                   │  • Subscription check  │
                   │  • Findings database   │
                   └────────────────────────┘

What this package does

• Reads REPOMEND_TOKEN from your environment

• Starts an MCP stdio server that Claude connects to

• Forwards tool calls as JSON-RPC over HTTPS to mcp.repomend.ai

• Returns responses back to Claude

What this package does NOT do

• Store tokens on disk or in memory beyond the session

• Log tokens, findings, or response bodies

• Contact any host other than mcp.repomend.ai

• Execute code from server responses

• Access your filesystem (beyond reading the env var)

• Send telemetry or analytics

Multi-tenant isolation

Your token is scoped to your team. The server enforces tenant isolation — you can only access findings, repos, and targets belonging to your team. Cross-team access is impossible regardless of what tool parameters are sent.

Role-based access

Supported Scanners

RepoMend runs 16 scanners across four categories. All findings are normalized into a single schema and accessible through this MCP server:

Core: Nuclei, Trivy, Semgrep, ZAP Baseline
API Security: ZAP API Scan, Nuclei API
Network & Infrastructure: Nmap Quick, Nmap Full, Nmap Vuln, SSL/TLS Scan
Custom Protection: Endpoint Patrol, Semgrep Protections, Coverage Diff

Development

git clone https://github.com/RepoMend-dev/mcp.git
cd mcp
npm install
npm run build

To test locally with Claude Desktop, point the config at your built version:

{
  "mcpServers": {
    "repomend": {
      "command": "node",
      "args": ["/path/to/mcp/dist/index.js"],
      "env": {
        "REPOMEND_TOKEN": "your-token-here"
      }
    }
  }
}

Troubleshooting

"Unauthorized" error

Your token is invalid or revoked. Generate a new one at repomend.com/dashboard/settings.

"Subscription expired" error

Your team's subscription has lapsed. Renew at repomend.com.

"Forbidden: your role cannot update findings"

Your token belongs to a viewer-role account. Ask your team admin to upgrade your role to developer or admin.

Claude doesn't see the tools

Restart Claude Desktop after editing claude_desktop_config.json. Ensure the REPOMEND_TOKEN environment variable is set.

Links

• Website: repomend.com

• Dashboard: repomend.com/dashboard

• Security Policy: SECURITY.md

• Issues: github.com/RepoMend-dev/mcp/issues

• Email: hello@repomend.com

License

MIT — see LICENSE