statica-mcp
OfficialClick on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@statica-mcp Analyze what I just changed with STATIC."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
STATICA — AI Agent for STATIC Static Analysis
한국어: README.ko.md
STATICA (STATIC AI Agent) is an AI agent that lets you use STATIC static analysis in coding agents such as Claude Code, Codex CLI, Cursor, and GitHub Copilot. Whenever code changes during a coding session, STATICA re-analyzes only the changed files and reports the result, so your STATIC workspace stays current without a full rebuild. It also connects new projects to STATIC, manages the STATIC server project, and corrects C/C++ analysis configuration when STATIC can't analyze a file.
STATIC is a static analysis tool that detects coding rule violations, runtime errors, and potential security vulnerabilities without executing the source code. It also provides domain-specific coding rule sets and software quality metrics.
STATICA does not replace STATIC's analysis results. STATIC performs the analysis and produces the findings; STATICA prepares, runs, and reports that analysis from inside the coding session. STATICA reports the state of the analysis, such as defect counts by rule, and does not edit source code to fix defects.
What STATIC and STATICA add
Need | STATIC and STATICA workflow |
Keep analysis current while coding | Analyzes only the changed files and posts a one-line |
Check on demand |
|
Share results with the team |
|
Connect a new project | A guided bootstrap identifies the build environment and compiler, captures the build, and registers the project on the server. |
Correct analysis errors | For C/C++ files STATIC couldn't analyze, verifies a parser configuration fix on copies, then applies it to the STATIC wrapper. |
Manage the server project | View and change rulesets, code metrics, exclusions, and report generation; generate and download reports. |
Related MCP server: Spotter-SAST
Workflow at a glance
Run
/statica:pre-analyzein a project. If it isn't connected to STATIC yet, the coding agent explains the bootstrap and asks for your approval before starting.Work as usual. After each response that changed analyzable sources, the Stop hook analyzes them within a time budget and reports defect counts by rule.
When the team should see the result, run
/statica:upload.Adjust rulesets, metrics, exclusions, and reports with the setting skills, or check
/statica:status.
The skills in this repository work with a STATIC installation. They are not a replacement for STATIC.
Install
Add STATICA from Anthropic's plugin directory on claude.ai (Customize > Plugins). It loads in Claude Code through account sync. To try a local copy without installing, load it for one session from the folder that contains your checkout:
claude --plugin-dir ./statica-pluginStart a new session after installing, and approve the Stop hook in /hooks if asked; automatic analysis needs it.
Its scripts and Stop hook run on your machine against a local STATIC installation. Without STATIC, or when its settings are missing, a command stops at its setup check and says what is missing, and the Stop hook stays silent. Run /statica:status to see the connection, automatic-analysis switch, and server state at once.
Example requests
Responses can vary with the AI model and the conversation. If the result isn't what you expected, rephrase the request with more detail.
Request | Skill |
|
|
|
|
|
|
|
|
|
|
|
|
Skills
All skills need a STATIC installation for their product-backed actions.
Skill | Workflow stage |
| Explain the plugin's scope, entry points, and prerequisites. |
| Connect a project to a STATIC workspace for the first time. |
| Analyze changed sources and summarize, without uploading. |
| Analyze the whole project and upload it to the STATIC server. |
| Show the project's STATIC state at a glance. |
| Turn automatic analysis after each response on or off for the project. |
| Change the project's ruleset and rule display language. |
| Exclude files, directories, or build modules from analysis. |
| Turn individual code metrics on or off. |
| Generate and download reports; set automatic report generation. |
| Verify and apply C/C++ parser configuration fixes. |
Ruleset, metric, exclusion, and report settings belong to the server project, so changes apply to everyone who uses that project.
MCP server
STATICA also ships an MCP server that exposes the same actions to any MCP client — Claude Desktop, Cursor, VS Code, and others — not only to agents that load the skills. A client with no skills still gets the full flow: connect a project, analyze, upload, and manage the server project. The procedure the skills follow is served back through a tool (statica_get_guide), so a skill-less client has the same guidance to work from.
It is listed in the official MCP registry as io.github.SuresoftTechnologies/statica-mcp.
Three ways to run it:
With the plugin. Installing STATICA registers the server automatically (
.mcp.json), so in Claude Code the tools are available alongside the skills.As a bundle. Download
statica-mcp.mcpbfrom this repository's releases and open it with a client that installs MCP bundles. It resolves its own Python, so nothing has to be installed first.Point a client at the interpreter. Run
scripts/mcp_server.pywith Python 3.10 or later. The launcherscripts/statica-mcp.cmdpicks a working interpreter on Windows and Linux.
The tools mirror the skills:
Group | Tools |
Read-only |
|
Analyze and report |
|
Server-project settings |
|
Connect a project |
|
Two prompts, connect-project and upload-analysis, start the guided flows. Connecting a project and uploading a full analysis change project files or the shared server, so they carry consent hints and ask for your approval first; read statica_get_guide before connecting. Without STATIC the server still starts and statica_doctor reports what is missing, so it is safe to leave configured on any machine.
The bundle reads the STATIC installation from ARACHNE_INSTALL_PATH. When that is not already set on the machine, supply the path through the bundle's STATICA_INSTALL_PATH configuration; an empty value leaves the machine's own setting untouched.
Product-backed workflow
This repository contains the skills, a Stop hook, an MCP server, and Python scripts that drive a local STATIC installation. It does not include STATIC itself. What runs on your machine:
Stop hook. Runs at the end of every response. It exits within a fraction of a second unless the project is connected to STATIC, automatic analysis is on, and analyzable files changed. It never uploads, never blocks your turn, and always exits successfully.
Analysis. Runs STATIC's own analyzers and stores results in the STATIC workspace.
Project files. Connecting a C/C++ project changes its build settings so STATIC can capture the build, only after you approve. Originals are backed up first and the change can be reverted. Java, Kotlin, Python, and C# projects are not modified.
Network. Connects only to the STATIC server configured in your STATIC installation, over HTTPS with your AccessKey. Certificate verification is disabled for this connection because STATIC servers commonly use self-signed certificates on internal networks. Analysis results leave your machine only when you run
/statica:uploador finish bootstrap.Credentials. Reads the server URL and AccessKey from STATIC's own settings (
conf/server.setting.json). Never asks for or stores the AccessKey.Local state. The automatic-analysis switch is stored in
~/.suresoft/data/plugins/static/state.json.
Requirements
STATIC installed and licensed, with
ARACHNE_INSTALL_PATHpointing to the installationThe STATIC server URL and AccessKey registered in STATIC's settings
Python 3.10 or later as
python3orpythononPATHWindows or Linux
For a product demo, purchase, or deployment consultation, contact bizcenter@suresofttech.com.
Privacy Policy
STATICA sends nothing to Suresoft Technologies and has no telemetry. The MCP server has none of its own either; it forwards each call to the local runtime and makes no network call of its own.
It sends requests only to the STATIC server configured in your STATIC installation, and uploads analysis results only when you ask.
Its output, such as defect counts and file paths, appears in your coding agent session and is sent to the AI model provider by your coding agent client.
The full policy is in PRIVACY.md. For support and questions, contact bizcenter@suresofttech.com.
License and trademarks
This repository is licensed under the MIT License. The license covers everything in this repository: the documentation, the skill files, the hook, and the scripts. It does not cover STATIC itself. STATIC and STATICA are Suresoft Technologies products, and no product functionality or product license is granted by this repository.
Claude and Claude Code are trademarks of Anthropic. Other product names may be trademarks of their respective owners.
Available Tools
24 toolsstatica_bootstrap_abortCancel an unfinished connectionADestructive
Undo an unfinished connection: restore files kept by statica_bootstrap_guard, then delete the wrapper and workspace. Refuses ready workspaces. For IDE/GUI substitution it cannot undo the IDE settings - walk the user through the guide's revert steps too. If ok is false the project is still modified: relay restore.failed and snapshotDir verbatim. Confirm with the user first.
Inputs: projectDir (required), reason.
statica_bootstrap_beginCreate STATIC workspace and wrapperADestructive
Start connecting a project: verify the compiler by running it, then create the STATIC workspace and (C/C++) the compiler wrapper whose wrapperDir the build must be pointed at. Java and Kotlin also create the server project here. Does not edit project files. BEFORE CALLING: read statica_get_guide topic=bootstrap and get the user's approval for the whole connection - it later edits project build settings, runs a full build and creates a project on the shared server. C/C++ needs ide, compiler and compilerPath; other languages pass language and none of those. stage=existing-workspace means a workspace already exists: resume it (bootstrapping) or stop (ready), never start a second one.
Inputs: name (required), projectDir (required), ide, input, +6 more.
statica_bootstrap_detectGather bootstrap evidenceARead-only
Step 1 of connecting a project to STATIC: collect build-system clues (artifacts: C/C++; languageArtifacts: Java, Kotlin, Python, C#) and the existing toolchain detector's view. Changes nothing. Choosing the language, environment and compiler from it is your judgement; follow statica_get_guide topic=bootstrap, and ask the user when clues point to more than one environment.
Inputs: projectDir (required).
statica_bootstrap_finishRegister project and run first analysisADestructive
Last step of connecting a project: re-check the capture, create the server project, mark the workspace ready, then run the full analysis and UPLOAD it (fullAnalysis). Deletes the backups taken by statica_bootstrap_guard once it succeeds. Covered by the user's approval of the connection; no separate upload question. stage=project means only server registration failed: fix the cause and call again, do not abort. Do not run pre-analyze afterwards. Pass on buildCommandWarning verbatim.
Inputs: projectDir (required).
statica_bootstrap_guardBack up project files before editingA
C/C++ only, and only when the substitution edits project files (guide type B: a hard-coded Makefile, Vitis CMakeLists.txt): keep the originals so statica_bootstrap_abort can restore them. Call right before editing. Do NOT call for command-line (A) or IDE/GUI (C) substitution, and never invent a file to satisfy the argument: a guarded file that did not exist is deleted on abort.
Inputs: files (required), projectDir (required).
statica_bootstrap_verifyCheck the build was capturedARead-only
After substituting the compiler and building (C/C++), or preparing the build descriptor (Java/Kotlin), check that STATIC has something to analyze. A successful build is not proof it went through the wrapper; ok=false means it did not. What to do next depends on the substitution type - see the guide (do not abort a GUI substitution). Also returns the workspace when resuming. Can be called any number of times.
Inputs: projectDir (required).
statica_doctorCheck STATIC environmentARead-only
Check that the local STATIC installation, analyzers, server URL and AccessKey are usable, and report which Python this MCP server runs on. Needs no project. Run this first when other STATICA tools fail with setup errors.
Inputs: no named parameters.
statica_get_guideRead a STATICA procedureARead-only
Return the procedure STATICA's own skills follow, adapted for MCP: which tool runs each step, what to ask the user and where to stop. Read topic=bootstrap before connecting a project and follow it; it points to bootstrap-environments (C/C++ environments, compiler paths, substitution and revert steps) and bootstrap-other-languages (Java, Kotlin, Python, C#). upload explains when to upload; overview explains the plugin's scope.
Inputs: topic (required).
statica_metric_setTurn code metrics on or offADestructiveIdempotent
Turn individual code metrics on or off by key (for example FUCYC). Metrics not named keep their state. Applies to everyone using the server project; confirm with the user first.
Inputs: projectDir (required), on, off.
statica_metric_showShow code metricsARead-only
Show which code metrics the server project enables. Changes nothing.
Inputs: projectDir (required).
statica_pre_analyzeAnalyze changed filesAIdempotent
Run STATIC on the files that changed since the last analysis and summarize defects by rule. Never uploads. For C/C++ only changed translation units run; Java, Kotlin, Python and C# are analyzed in full and the summary is narrowed to changed files. Counts cover this run's scope, not the project total - say so when reporting, and do not list defects file by file. reason=NO_CHANGES usually means the Stop hook already analyzed the edit; do not suggest a rebuild or upload for it. code=NEEDS_BOOTSTRAP means the project is not connected: offer to connect it (statica_get_guide topic=bootstrap) and start only after the user agrees. reason=BOOTSTRAP_IN_PROGRESS means a connection was started earlier: resume it per the guide, never start over.
Inputs: projectDir (required), force, parallel.
statica_reportGenerate and download a reportA
Ask the server to generate a report from the latest revision, wait for it, and download it (default /.static/reports/). Can take minutes. Kinds: 1 project summary, 2 remaining defects, 3 suppressed defects, 4 by rule, 5 by ruleset, 6 by severity, 7 by file, 8 module metrics, 9 file metrics, 10 class metrics, 11 function metrics, 12 suppressed metrics. On failure 'stage' tells how far it got.
Inputs: kinds (required), format (required), projectDir (required), out, +1 more.
statica_report_generator_setSet automatic report generationADestructiveIdempotent
Turn automatic report generation after each analysis on or off. Turning it on needs a format and at least one kind (1-12). Applies to everyone using the server project; confirm with the user first.
Inputs: enabled (required), projectDir (required), kinds, format.
statica_report_generator_showShow automatic report settingsARead-only
Show whether the server generates a report after each analysis, and in which format and kinds. Changes nothing.
Inputs: projectDir (required).
statica_ruleset_setReplace project rulesetsADestructiveIdempotent
Replace the server project's ruleset selection. FULL REPLACEMENT: every ruleset not listed is turned off, so call statica_ruleset_show first and build on its current selection. At least one id is required. Applies to everyone using the server project; confirm the final list with the user before calling.
Inputs: projectDir (required), rulesetIds (required), localeLanguage.
statica_ruleset_showShow project rulesetsBRead-only
Show which rulesets the server project enables and the rule display language. Changes nothing.
Inputs: projectDir (required).
statica_scope_excludeExclude paths from analysisAIdempotent
Exclude files or directories from analysis. Adds to the current list. Real paths only (no globs); if any path is missing nothing is written (NO_SUCH_PATH). Headers cannot be excluded (NOT_ANALYZABLE). Defects already on the server stay until the next full analysis; when reporting later counts, say they changed because the scope changed, not the code. Confirm the exact paths with the user first.
Inputs: paths (required), projectDir (required).
statica_scope_includeRe-include paths in analysisAIdempotent
Return files or directories to analysis, or re-include an exception inside an excluded directory. Real paths only; if any path is missing nothing is written.
Inputs: paths (required), projectDir (required).
statica_scope_showShow analysis scopeARead-only
List the files and directories excluded from analysis, the exceptions re-included inside excluded directories, and (C/C++ only) the build modules with their skip state. Changes nothing. Read this before changing the scope.
Inputs: projectDir (required).
statica_scope_skip_moduleSkip C/C++ build modulesAIdempotent
C/C++ only: skip whole build modules. Pass modules[].output from statica_scope_show. Unknown values are rejected (NO_SUCH_MODULE) with knownModules listed. Which modules are noise is the user's call; show the list and confirm first.
Inputs: paths (required), projectDir (required).
statica_scope_unskip_moduleUn-skip C/C++ build modulesAIdempotent
C/C++ only: return skipped build modules to analysis.
Inputs: paths (required), projectDir (required).
statica_set_auto_analysisTurn automatic analysis on or offAIdempotent
Turn the Stop-hook analysis after each response on or off, for this project or globally. Commands such as statica_pre_analyze keep working either way. Local setting only.
Inputs: enabled (required), global, projectDir.
statica_statusShow project STATIC statusARead-only
Show how this project relates to STATIC in one call: link state, bootstrap status, automatic-analysis switch (per project and global), scope exclusions, and the server's ruleset, metric, report-generator and last-analysis state. Changes nothing. project.linked=false is a valid answer (not connected), not a failure. Server sections carry their own 'error'; one failing does not invalidate the rest.
Inputs: projectDir (required), local.
statica_uploadAnalyze and upload to the serverA
Analyze the whole project and upload the result to the STATIC server as a new revision the whole team sees. Holds a licence slot and takes time. Call ONLY when the user explicitly asks to upload or publish results to the server; never as a follow-up to pre-analyze, a scope change or NO_CHANGES. returncode 113: the project is already being analyzed; 114: licence limit reached - ask the user to retry later. If ok is false, do not say the upload happened.
Inputs: projectDir (required), parallel.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
TDQS
Scored across 24 tools
Most tools target a clearly distinct resource+action (scope include/exclude vs skip_module/unskip_module, pre_analyze vs upload), and descriptions explicitly fence off risky confusions such as 'never uploads' or 'call ONLY when the user asks'. The main overlap is statica_status, which already reports ruleset, metric, report-generator and last-analysis state that statica_ruleset_show, statica_metric_show and statica_report_generator_show expose individually; statica_bootstrap_detect vs statica_doctor vs statica_status also require reading descriptions to choose correctly.
All 24 tools share the statica_ prefix and snake_case, with coherent families (ruleset_show/set, metric_show/set, scope_show/exclude/include/skip_module, bootstrap_detect/begin/guard/verify/finish/abort). There is a minor ordering inconsistency: most follow noun_verb (ruleset_show, report_generator_set) while a few follow verb_noun (set_auto_analysis, get_guide, pre_analyze), though each pair is internally consistent.
24 tools is on the heavy side of the range, spread across eight areas (bootstrap, scope, rulesets, metrics, reports, analysis, status, guide). Each tool does map to a distinct operation and the show/set and skip/unskip pairs are justified, but the surface is large enough that an agent must plan across multiple families before acting.
Core lifecycle is well covered: detection, bootstrap with guard/verify/finish/abort, scope management, configuration, analysis, upload and reporting. Notable gaps remain around defect handling — reports can list suppressed defects (kinds 3, 12) but there is no tool to suppress or annotate an individual defect — and there is no way to unlink/disconnect an already-linked project or inspect historical revisions, both of which agents will likely need.
Maintenance
Related MCP Connectors
MCP server for static security analysis of Android source code
Authenticated MCP server for ClearPolicy policy and compliance workflows.
Read project context and manage tasks in MCPBinder, with access you control.
Governed data discovery, exact queries, decisions, simulations, and runtime utilities over MCP.
Related MCP Servers
- -licenseNot gradedqualityNot gradedmaintenanceMCP server for Blackduck Coverity Static Analysis Software.-
- AlicenseCqualityDmaintenanceEnterprise-grade MCP server for static application security testing with multi-tool integration, compliance verification, AI-powered remediation, and multi-tenant management.2310MIT
- FlicenseNot gradedqualityDmaintenanceMCP server for static security analysis of Android application source code.3-
- FlicenseNot gradedqualityCmaintenanceEnables querying SAST code quality and security data from SonarQube and Coverity Connect via MCP, including quality gates, issues, projects, streams, and defects.194 npm1-