Skip to main content
Glama

STATICA — AI Agent for STATIC Static Analysis

한국어: README.ko.md

STATICA (STATIC AI Agent) is an AI agent that lets you use STATIC static analysis in coding agents such as Claude Code, Codex CLI, Cursor, and GitHub Copilot. Whenever code changes during a coding session, STATICA re-analyzes only the changed files and reports the result, so your STATIC workspace stays current without a full rebuild. It also connects new projects to STATIC, manages the STATIC server project, and corrects C/C++ analysis configuration when STATIC can't analyze a file.

STATIC is a static analysis tool that detects coding rule violations, runtime errors, and potential security vulnerabilities without executing the source code. It also provides domain-specific coding rule sets and software quality metrics.

STATICA does not replace STATIC's analysis results. STATIC performs the analysis and produces the findings; STATICA prepares, runs, and reports that analysis from inside the coding session. STATICA reports the state of the analysis, such as defect counts by rule, and does not edit source code to fix defects.

What STATIC and STATICA add

Need

STATIC and STATICA workflow

Keep analysis current while coding

Analyzes only the changed files and posts a one-line [STATIC] summary with defect counts by rule. A Stop hook runs it automatically.

Check on demand

/statica:pre-analyze analyzes the changed files and summarizes defects without uploading.

Share results with the team

/statica:upload analyzes the whole project and creates a revision on the STATIC server, only when you ask.

Connect a new project

A guided bootstrap identifies the build environment and compiler, captures the build, and registers the project on the server.

Correct analysis errors

For C/C++ files STATIC couldn't analyze, verifies a parser configuration fix on copies, then applies it to the STATIC wrapper.

Manage the server project

View and change rulesets, code metrics, exclusions, and report generation; generate and download reports.

Related MCP server: Spotter-SAST

Workflow at a glance

  1. Run /statica:pre-analyze in a project. If it isn't connected to STATIC yet, the coding agent explains the bootstrap and asks for your approval before starting.

  2. Work as usual. After each response that changed analyzable sources, the Stop hook analyzes them within a time budget and reports defect counts by rule.

  3. When the team should see the result, run /statica:upload.

  4. Adjust rulesets, metrics, exclusions, and reports with the setting skills, or check /statica:status.

The skills in this repository work with a STATIC installation. They are not a replacement for STATIC.

Install

Add STATICA from Anthropic's plugin directory on claude.ai (Customize > Plugins). It loads in Claude Code through account sync. To try a local copy without installing, load it for one session from the folder that contains your checkout:

claude --plugin-dir ./statica-plugin

Start a new session after installing, and approve the Stop hook in /hooks if asked; automatic analysis needs it.

Its scripts and Stop hook run on your machine against a local STATIC installation. Without STATIC, or when its settings are missing, a command stops at its setup check and says what is missing, and the Stop hook stays silent. Run /statica:status to see the connection, automatic-analysis switch, and server state at once.

Example requests

Responses can vary with the AI model and the conversation. If the result isn't what you expected, rephrase the request with more detail.

Request

Skill

Analyze what I just changed with STATIC.

pre-analyze

Connect this project to STATIC.

statica-analyze-bootstrap

Upload the full analysis to the STATIC server.

upload

Exclude the third_party folder from analysis.

scope

Generate a STATIC report and download it.

report

This C file fails to analyze. Fix the toolchain settings.

statica-toolchain-recovery

Skills

All skills need a STATIC installation for their product-backed actions.

Skill

Workflow stage

statica-analyze-overview

Explain the plugin's scope, entry points, and prerequisites.

statica-analyze-bootstrap

Connect a project to a STATIC workspace for the first time.

pre-analyze

Analyze changed sources and summarize, without uploading.

upload

Analyze the whole project and upload it to the STATIC server.

status

Show the project's STATIC state at a glance.

analyze-on / analyze-off

Turn automatic analysis after each response on or off for the project.

ruleset

Change the project's ruleset and rule display language.

scope

Exclude files, directories, or build modules from analysis.

metric

Turn individual code metrics on or off.

report / report-generator

Generate and download reports; set automatic report generation.

statica-toolchain-recovery

Verify and apply C/C++ parser configuration fixes.

Ruleset, metric, exclusion, and report settings belong to the server project, so changes apply to everyone who uses that project.

MCP server

STATICA also ships an MCP server that exposes the same actions to any MCP client — Claude Desktop, Cursor, VS Code, and others — not only to agents that load the skills. A client with no skills still gets the full flow: connect a project, analyze, upload, and manage the server project. The procedure the skills follow is served back through a tool (statica_get_guide), so a skill-less client has the same guidance to work from.

It is listed in the official MCP registry as io.github.SuresoftTechnologies/statica-mcp.

Three ways to run it:

  • With the plugin. Installing STATICA registers the server automatically (.mcp.json), so in Claude Code the tools are available alongside the skills.

  • As a bundle. Download statica-mcp.mcpb from this repository's releases and open it with a client that installs MCP bundles. It resolves its own Python, so nothing has to be installed first.

  • Point a client at the interpreter. Run scripts/mcp_server.py with Python 3.10 or later. The launcher scripts/statica-mcp.cmd picks a working interpreter on Windows and Linux.

The tools mirror the skills:

Group

Tools

Read-only

statica_doctor, statica_status, statica_scope_show, statica_ruleset_show, statica_metric_show, statica_report_generator_show, statica_get_guide

Analyze and report

statica_pre_analyze, statica_report, statica_upload, statica_set_auto_analysis

Server-project settings

statica_scope_exclude / _include / _skip_module / _unskip_module, statica_ruleset_set, statica_metric_set, statica_report_generator_set

Connect a project

statica_bootstrap_detect, _begin, _guard, _verify, _finish, _abort

Two prompts, connect-project and upload-analysis, start the guided flows. Connecting a project and uploading a full analysis change project files or the shared server, so they carry consent hints and ask for your approval first; read statica_get_guide before connecting. Without STATIC the server still starts and statica_doctor reports what is missing, so it is safe to leave configured on any machine.

The bundle reads the STATIC installation from ARACHNE_INSTALL_PATH. When that is not already set on the machine, supply the path through the bundle's STATICA_INSTALL_PATH configuration; an empty value leaves the machine's own setting untouched.

Product-backed workflow

This repository contains the skills, a Stop hook, an MCP server, and Python scripts that drive a local STATIC installation. It does not include STATIC itself. What runs on your machine:

  • Stop hook. Runs at the end of every response. It exits within a fraction of a second unless the project is connected to STATIC, automatic analysis is on, and analyzable files changed. It never uploads, never blocks your turn, and always exits successfully.

  • Analysis. Runs STATIC's own analyzers and stores results in the STATIC workspace.

  • Project files. Connecting a C/C++ project changes its build settings so STATIC can capture the build, only after you approve. Originals are backed up first and the change can be reverted. Java, Kotlin, Python, and C# projects are not modified.

  • Network. Connects only to the STATIC server configured in your STATIC installation, over HTTPS with your AccessKey. Certificate verification is disabled for this connection because STATIC servers commonly use self-signed certificates on internal networks. Analysis results leave your machine only when you run /statica:upload or finish bootstrap.

  • Credentials. Reads the server URL and AccessKey from STATIC's own settings (conf/server.setting.json). Never asks for or stores the AccessKey.

  • Local state. The automatic-analysis switch is stored in ~/.suresoft/data/plugins/static/state.json.

Requirements

  • STATIC installed and licensed, with ARACHNE_INSTALL_PATH pointing to the installation

  • The STATIC server URL and AccessKey registered in STATIC's settings

  • Python 3.10 or later as python3 or python on PATH

  • Windows or Linux

For a product demo, purchase, or deployment consultation, contact bizcenter@suresofttech.com.

Privacy Policy

  • STATICA sends nothing to Suresoft Technologies and has no telemetry. The MCP server has none of its own either; it forwards each call to the local runtime and makes no network call of its own.

  • It sends requests only to the STATIC server configured in your STATIC installation, and uploads analysis results only when you ask.

  • Its output, such as defect counts and file paths, appears in your coding agent session and is sent to the AI model provider by your coding agent client.

The full policy is in PRIVACY.md. For support and questions, contact bizcenter@suresofttech.com.

License and trademarks

This repository is licensed under the MIT License. The license covers everything in this repository: the documentation, the skill files, the hook, and the scripts. It does not cover STATIC itself. STATIC and STATICA are Suresoft Technologies products, and no product functionality or product license is granted by this repository.

Claude and Claude Code are trademarks of Anthropic. Other product names may be trademarks of their respective owners.

Available Tools

24 tools
statica_bootstrap_abortCancel an unfinished connectionA
Destructive

Undo an unfinished connection: restore files kept by statica_bootstrap_guard, then delete the wrapper and workspace. Refuses ready workspaces. For IDE/GUI substitution it cannot undo the IDE settings - walk the user through the guide's revert steps too. If ok is false the project is still modified: relay restore.failed and snapshotDir verbatim. Confirm with the user first.

Inputs: projectDir (required), reason.

statica_bootstrap_beginCreate STATIC workspace and wrapperA
Destructive

Start connecting a project: verify the compiler by running it, then create the STATIC workspace and (C/C++) the compiler wrapper whose wrapperDir the build must be pointed at. Java and Kotlin also create the server project here. Does not edit project files. BEFORE CALLING: read statica_get_guide topic=bootstrap and get the user's approval for the whole connection - it later edits project build settings, runs a full build and creates a project on the shared server. C/C++ needs ide, compiler and compilerPath; other languages pass language and none of those. stage=existing-workspace means a workspace already exists: resume it (bootstrapping) or stop (ready), never start a second one.

Inputs: name (required), projectDir (required), ide, input, +6 more.

statica_bootstrap_detectGather bootstrap evidenceA
Read-only

Step 1 of connecting a project to STATIC: collect build-system clues (artifacts: C/C++; languageArtifacts: Java, Kotlin, Python, C#) and the existing toolchain detector's view. Changes nothing. Choosing the language, environment and compiler from it is your judgement; follow statica_get_guide topic=bootstrap, and ask the user when clues point to more than one environment.

Inputs: projectDir (required).

statica_bootstrap_finishRegister project and run first analysisA
Destructive

Last step of connecting a project: re-check the capture, create the server project, mark the workspace ready, then run the full analysis and UPLOAD it (fullAnalysis). Deletes the backups taken by statica_bootstrap_guard once it succeeds. Covered by the user's approval of the connection; no separate upload question. stage=project means only server registration failed: fix the cause and call again, do not abort. Do not run pre-analyze afterwards. Pass on buildCommandWarning verbatim.

Inputs: projectDir (required).

statica_bootstrap_guardBack up project files before editingA

C/C++ only, and only when the substitution edits project files (guide type B: a hard-coded Makefile, Vitis CMakeLists.txt): keep the originals so statica_bootstrap_abort can restore them. Call right before editing. Do NOT call for command-line (A) or IDE/GUI (C) substitution, and never invent a file to satisfy the argument: a guarded file that did not exist is deleted on abort.

Inputs: files (required), projectDir (required).

statica_bootstrap_verifyCheck the build was capturedA
Read-only

After substituting the compiler and building (C/C++), or preparing the build descriptor (Java/Kotlin), check that STATIC has something to analyze. A successful build is not proof it went through the wrapper; ok=false means it did not. What to do next depends on the substitution type - see the guide (do not abort a GUI substitution). Also returns the workspace when resuming. Can be called any number of times.

Inputs: projectDir (required).

statica_doctorCheck STATIC environmentA
Read-only

Check that the local STATIC installation, analyzers, server URL and AccessKey are usable, and report which Python this MCP server runs on. Needs no project. Run this first when other STATICA tools fail with setup errors.

Inputs: no named parameters.

statica_get_guideRead a STATICA procedureA
Read-only

Return the procedure STATICA's own skills follow, adapted for MCP: which tool runs each step, what to ask the user and where to stop. Read topic=bootstrap before connecting a project and follow it; it points to bootstrap-environments (C/C++ environments, compiler paths, substitution and revert steps) and bootstrap-other-languages (Java, Kotlin, Python, C#). upload explains when to upload; overview explains the plugin's scope.

Inputs: topic (required).

statica_metric_setTurn code metrics on or offA
DestructiveIdempotent

Turn individual code metrics on or off by key (for example FUCYC). Metrics not named keep their state. Applies to everyone using the server project; confirm with the user first.

Inputs: projectDir (required), on, off.

statica_metric_showShow code metricsA
Read-only

Show which code metrics the server project enables. Changes nothing.

Inputs: projectDir (required).

statica_pre_analyzeAnalyze changed filesA
Idempotent

Run STATIC on the files that changed since the last analysis and summarize defects by rule. Never uploads. For C/C++ only changed translation units run; Java, Kotlin, Python and C# are analyzed in full and the summary is narrowed to changed files. Counts cover this run's scope, not the project total - say so when reporting, and do not list defects file by file. reason=NO_CHANGES usually means the Stop hook already analyzed the edit; do not suggest a rebuild or upload for it. code=NEEDS_BOOTSTRAP means the project is not connected: offer to connect it (statica_get_guide topic=bootstrap) and start only after the user agrees. reason=BOOTSTRAP_IN_PROGRESS means a connection was started earlier: resume it per the guide, never start over.

Inputs: projectDir (required), force, parallel.

statica_reportGenerate and download a reportA

Ask the server to generate a report from the latest revision, wait for it, and download it (default /.static/reports/). Can take minutes. Kinds: 1 project summary, 2 remaining defects, 3 suppressed defects, 4 by rule, 5 by ruleset, 6 by severity, 7 by file, 8 module metrics, 9 file metrics, 10 class metrics, 11 function metrics, 12 suppressed metrics. On failure 'stage' tells how far it got.

Inputs: kinds (required), format (required), projectDir (required), out, +1 more.

statica_report_generator_setSet automatic report generationA
DestructiveIdempotent

Turn automatic report generation after each analysis on or off. Turning it on needs a format and at least one kind (1-12). Applies to everyone using the server project; confirm with the user first.

Inputs: enabled (required), projectDir (required), kinds, format.

statica_report_generator_showShow automatic report settingsA
Read-only

Show whether the server generates a report after each analysis, and in which format and kinds. Changes nothing.

Inputs: projectDir (required).

statica_ruleset_setReplace project rulesetsA
DestructiveIdempotent

Replace the server project's ruleset selection. FULL REPLACEMENT: every ruleset not listed is turned off, so call statica_ruleset_show first and build on its current selection. At least one id is required. Applies to everyone using the server project; confirm the final list with the user before calling.

Inputs: projectDir (required), rulesetIds (required), localeLanguage.

statica_ruleset_showShow project rulesetsB
Read-only

Show which rulesets the server project enables and the rule display language. Changes nothing.

Inputs: projectDir (required).

statica_scope_excludeExclude paths from analysisA
Idempotent

Exclude files or directories from analysis. Adds to the current list. Real paths only (no globs); if any path is missing nothing is written (NO_SUCH_PATH). Headers cannot be excluded (NOT_ANALYZABLE). Defects already on the server stay until the next full analysis; when reporting later counts, say they changed because the scope changed, not the code. Confirm the exact paths with the user first.

Inputs: paths (required), projectDir (required).

statica_scope_includeRe-include paths in analysisA
Idempotent

Return files or directories to analysis, or re-include an exception inside an excluded directory. Real paths only; if any path is missing nothing is written.

Inputs: paths (required), projectDir (required).

statica_scope_showShow analysis scopeA
Read-only

List the files and directories excluded from analysis, the exceptions re-included inside excluded directories, and (C/C++ only) the build modules with their skip state. Changes nothing. Read this before changing the scope.

Inputs: projectDir (required).

statica_scope_skip_moduleSkip C/C++ build modulesA
Idempotent

C/C++ only: skip whole build modules. Pass modules[].output from statica_scope_show. Unknown values are rejected (NO_SUCH_MODULE) with knownModules listed. Which modules are noise is the user's call; show the list and confirm first.

Inputs: paths (required), projectDir (required).

statica_scope_unskip_moduleUn-skip C/C++ build modulesA
Idempotent

C/C++ only: return skipped build modules to analysis.

Inputs: paths (required), projectDir (required).

statica_set_auto_analysisTurn automatic analysis on or offA
Idempotent

Turn the Stop-hook analysis after each response on or off, for this project or globally. Commands such as statica_pre_analyze keep working either way. Local setting only.

Inputs: enabled (required), global, projectDir.

statica_statusShow project STATIC statusA
Read-only

Show how this project relates to STATIC in one call: link state, bootstrap status, automatic-analysis switch (per project and global), scope exclusions, and the server's ruleset, metric, report-generator and last-analysis state. Changes nothing. project.linked=false is a valid answer (not connected), not a failure. Server sections carry their own 'error'; one failing does not invalidate the rest.

Inputs: projectDir (required), local.

statica_uploadAnalyze and upload to the serverA

Analyze the whole project and upload the result to the STATIC server as a new revision the whole team sees. Holds a licence slot and takes time. Call ONLY when the user explicitly asks to upload or publish results to the server; never as a follow-up to pre-analyze, a scope change or NO_CHANGES. returncode 113: the project is already being analyzed; 114: licence limit reached - ask the user to retry later. If ok is false, do not say the upload happened.

Inputs: projectDir (required), parallel.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    TDQS

    A3.6/5.0

    Scored across 24 tools

    Disambiguation4/5

    Most tools target a clearly distinct resource+action (scope include/exclude vs skip_module/unskip_module, pre_analyze vs upload), and descriptions explicitly fence off risky confusions such as 'never uploads' or 'call ONLY when the user asks'. The main overlap is statica_status, which already reports ruleset, metric, report-generator and last-analysis state that statica_ruleset_show, statica_metric_show and statica_report_generator_show expose individually; statica_bootstrap_detect vs statica_doctor vs statica_status also require reading descriptions to choose correctly.

    Naming Consistency4/5

    All 24 tools share the statica_ prefix and snake_case, with coherent families (ruleset_show/set, metric_show/set, scope_show/exclude/include/skip_module, bootstrap_detect/begin/guard/verify/finish/abort). There is a minor ordering inconsistency: most follow noun_verb (ruleset_show, report_generator_set) while a few follow verb_noun (set_auto_analysis, get_guide, pre_analyze), though each pair is internally consistent.

    Tool Count3/5

    24 tools is on the heavy side of the range, spread across eight areas (bootstrap, scope, rulesets, metrics, reports, analysis, status, guide). Each tool does map to a distinct operation and the show/set and skip/unskip pairs are justified, but the surface is large enough that an agent must plan across multiple families before acting.

    Completeness3/5

    Core lifecycle is well covered: detection, bootstrap with guard/verify/finish/abort, scope management, configuration, analysis, upload and reporting. Notable gaps remain around defect handling — reports can list suppressed defects (kinds 3, 12) but there is no tool to suppress or annotate an individual defect — and there is no way to unlink/disconnect an already-linked project or inspect historical revisions, both of which agents will likely need.

    Maintenance

    ActivityMaintained
    ResponsivenessNo recent community issues

    Related MCP Connectors

    Related MCP Servers

    • -
      license
      Not graded
      quality
      Not graded
      maintenance
      MCP server for Blackduck Coverity Static Analysis Software.
      -
    • F
      license
      Not graded
      quality
      C
      maintenance
      Enables querying SAST code quality and security data from SonarQube and Coverity Connect via MCP, including quality gates, issues, projects, streams, and defects.
      194 npm
      1
      -