What can you do with this server?

The SDLC Command Center MCP Server is a comprehensive local-first tool for project analysis, security auditing, and controlled file modifications, accessible as an API for AI coding assistants and a web dashboard. It provides a suite of MCP tools for safe inspection and gated, audit-logged write operations. * Read & Understand: Repository snapshot, directory tree, file reading (single and batch up to 20 files) with automatic secret redaction, language statistics, and dependency inventory. * Release & Risk: Release readiness checks, composite risk score (0–100 with letter grade), and plugin manifest validation. * Search & Security: Secret scanning (pattern-based detection of API keys, passwords, tokens), regex code search with context lines, all findings redacted. * Git Insights: Local git history showing recent commits, distinct authors, and file churn hotspots. * Safe Modifications: Create, overwrite, or append files; exact text replacement; all with dry-run preview, automatic backup, and tamper-evident audit logging; explicit confirmation required. * Change Management: List recorded changes, verify audit log integrity, and rollback any change by ID. * Shadow Workspaces: Create, promote, and destroy isolated project copies (Git worktrees) for safe experimentation. * Server & Environment: Streamable HTTP transport, OAuth 2.0 Bearer authentication (rotatable via CLI), configuration engine, environment diagnostics (doctor), and a zero-dependency web dashboard for visualizing risk, audit chain, language stats, and tool registry. Safety Guarantees: All read tools are non-destructive and idempotent; write tools default to dry-run mode; secrets are always redacted; every mutation is backed up and logged in a hash-chained audit trail.

How do I use SDLC Command Center MCP Server?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@SDLC Command Center MCP Server run a release readiness check on the project repo" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

SDLC Command Center MCP Server

by Senpai-Sama7

Overview Schema Related Servers Score Discussions

Python

Local

Autonomous SDLC Command Center

Your project's autopilot for quality, security, and delivery readiness.

The SDLC Command Center is a local-first tool that inspects your software project and tells you, in plain language, what's going on — what shape the code is in, whether there are secrets leaked, if you're ready to release, and how risky the current state is. It can also make safe, approved changes to files with full rollback and audit tracking.

Think of it as a project health dashboard that lives in your terminal or connects to your AI coding assistant.

Who is this for?

If you are...	You can use it to...
A project manager	Check if a release is ready, see code health scores, understand risk without reading code
A team lead	Get a quick snapshot of repository structure, dependencies, and delivery signals
A developer	Search code, read files safely, find secrets, understand language breakdown
A security reviewer	Scan for leaked secrets, check entropy of tokens, audit file changes
An AI coding agent	Use 26 built-in tools to inspect, analyze, and safely modify codebases

Related MCP server: SnapBack MCP Server

What does it do?

The tool answers these questions about any software project:

"What's in this repo?" — File counts, directory structure, language breakdown
"Is it ready to ship?" — Release readiness checks, risk scoring, dependency inventory
"Are there secrets in the code?" — Pattern-based and entropy-based secret detection
"What's the code quality?" — TODO counts, complexity hints, health scoring
"Can I safely change a file?" — Gated writes with backup, rollback, and audit trail
"What changed recently?" — Git history, churn hotspots, author activity

What's new in v1.3.0

Streamable HTTP Transport — 2026 MCP-compliant HTTP server with session management, CORS, and DELETE /mcp for session termination
Bearer Token Authentication — OAuth 2.0 Bearer token auth for remote HTTP deployments. Token auto-generated on first run, rotatable via CLI
Configuration Engine — sdlc.config.json for tunable security, mutation, auth, and HTTP settings with schema-validated defaults
CLI auth and config commands — sdlc auth rotate/status/token and sdlc config show/init/validate
Web Dashboard — sdlc dashboard launches a zero-dependency, read-only web UI at http://127.0.0.1:8420 with risk score, release readiness, audit chain, shadow worktrees, language stats, and the full tool registry. Works offline, no CDN
npm wrapper — npx sdlc-mcp runs the server straight from the Node ecosystem (bundles the Python sources; only needs Python 3.9+ on PATH)

Getting started

Step 1: Check that Python is installed

Open a terminal and run:

python3 --version

You need Python 3.9 or newer. If you don't have it, download from python.org.

Step 2: Clone or download the project

git clone https://github.com/Senpai-Sama7/autonomous-sdlc-command-center.git
cd autonomous-sdlc-command-center

Step 3: Run it

Option A: Using the CLI directly

# Check your environment
python3 mcp/sdlc_cli.py doctor

# Scan a project for issues
python3 mcp/sdlc_cli.py snapshot --path /path/to/your/project

# Check if a release is ready
python3 mcp/sdlc_cli.py release-readiness --path /path/to/your/project

# Scan for leaked secrets
python3 mcp/sdlc_cli.py secret-scan --path /path/to/your/project

# Get a risk score (0-100)
python3 mcp/sdlc_cli.py risk --path /path/to/your/project

Option B: Connect to an AI coding assistant

The tool works as a Model Context Protocol (MCP) server, which means AI assistants like Claude Desktop, Cursor, Windsurf, and others can use its tools automatically.

# Start the server (it waits for your AI assistant to connect)
python3 mcp/sdlc_mcp_server.py

# Or run it as a local web service
python3 mcp/sdlc_mcp_server.py --http 8765

See UNIVERSAL_INSTALL.md for setup instructions for each AI assistant.

Option C: PowerShell (Windows)

.\scripts\commands\repo_snapshot.ps1 -Path C:\your\project
.\scripts\commands\release_readiness.ps1 -Path C:\your\project

The 26 tools — what each one does

Reading and understanding your project

These tools look at your project and report back. They never change anything.

Tool	What it does in plain English
repo_snapshot	Gives you a complete inventory: how many files, what types, directory tree, symlinks, non-UTF-8 files, and optional git status
release_readiness	Answers "can we ship this?" by checking for README, license, tests, git state, and whitespace issues
plugin_preflight	Validates that plugin manifests and skill contracts are correctly formatted
read_file	Safely reads a single file with automatic secret redaction and binary detection
read_files	Reads up to 20 files at once (same safety as read_file)
directory_tree	Shows the folder structure up to a configurable depth
search_code	Searches across all text files using regex patterns, with context lines
language_stats	Breaks down the project by programming language (file count and line count)
dependency_inventory	Lists all dependencies from package.json, requirements.txt, pyproject.toml, go.mod, Cargo.toml
git_history	Shows recent commits, distinct authors, and which files change most often
risk_score	Gives the project a risk grade from A (low risk) to F (high risk) based on multiple signals
doctor	Checks that the tool itself is working correctly on your system
list_changes	Shows all file changes that have been made through the write engine (for rollback)
audit_log	Reads the tamper-evident audit trail and verifies its integrity

Finding secrets

Tool	What it does in plain English
secret_scan	Looks for patterns that look like API keys, passwords, tokens, and credentials. Always redacts the actual values — it reports where secrets are, not what they are
entropy_scan (new)	Finds secrets that pattern-based scanning misses. Uses math (Shannon entropy) to detect randomly-generated strings like API keys, JWTs, and tokens that don't match any known pattern. Handles deduplication and shows safe previews

Code quality

Tool	What it does in plain English
code_metrics	Counts TODOs, FIXMEs, large files, long lines, empty files, and flags files with high branch density. Gives an overall health score from A to F
sbom	Creates a Software Bill of Materials (SBOM) — a list of every dependency your project uses, in a standard format

Making changes (safely)

These tools can modify files, but only when you explicitly approve. Every change is backed up first.

Tool	What it does in plain English
write_file	Creates or overwrites a file. Shows a preview of what will change before you confirm
replace_in_file	Finds exact text in a file and replaces it. Verifies the number of matches before applying
replace_in_file_ast (new)	Same as replace_in_file, but smarter for Python files. It understands code structure, so it only replaces text inside string literals — it won't accidentally change variable names or code logic
rollback	Undoes a previous change by its ID. Restores the original content or deletes files that were created

Shadow workspaces (new)

These tools let you make changes in an isolated copy of your project, test them, and only merge back if everything works.

Tool	What it does in plain English
shadow_create	Creates a temporary copy of your project (a Git worktree) where you can make changes without affecting the real project
shadow_promote	Checks if your changes conflict with anything in the real project, then copies them over if it's safe
shadow_destroy	Cleans up a temporary workspace when you're done with it
shadow_list	Shows all active temporary workspaces

How the safety system works

The write engine is designed so that mistakes are recoverable. Here's how:

Preview first — Every change starts as a dry-run. You see exactly what will change (a diff preview) before anything happens.
Confirm to apply — Nothing changes unless you explicitly say "yes, do it" (pass confirm: true).
Backup before change — The original content is saved in .sdlc/backups/ before any file is modified.
Atomic writes — Changes are written to a temporary file first, then swapped in place. If something fails mid-write, the original is preserved.
Audit trail — Every change is recorded in .sdlc/audit.jsonl with a cryptographic hash chain. If anyone tampers with the log, it's detectable.
Rollback — Any change can be undone by its unique ID. The tool restores the exact original content.

You run a write tool
        │
        ▼
   ┌─────────┐
   │ Dry-run │ ──► Shows you the diff preview
   └────┬────┘
        │ confirm: true
        ▼
   ┌─────────┐
   │ Backup  │ ──► Saves original to .sdlc/backups/
   └────┬────┘
        │
        ▼
   ┌─────────┐
   │ Write   │ ──► Atomic temp file + rename
   └────┬────┘
        │
        ▼
   ┌─────────┐
   │ Audit   │ ──► Appends to hash-chained log
   └─────────┘

Installation for AI coding assistants

The SDLC Command Center works as an MCP server, which means AI assistants can use its tools automatically. Here's how to connect it:

Universal install (recommended)

# Install the CLI and MCP server globally
pip install --user -e .

# The binaries are now at:
#   ~/.local/bin/sdlc        (CLI)
#   ~/.local/bin/sdlc-mcp    (MCP server)

npm / npx install (JavaScript ecosystem)

If you live in the Node world, the sdlc-mcp npm package bundles the entire Python implementation — no pip install needed, just Python 3.9+ on PATH:

# Run the MCP server directly
npx sdlc-mcp

# Or use the CLI
npx -p sdlc-mcp sdlc doctor

MCP client config for npx:

{
  "mcpServers": {
    "sdlc": { "command": "npx", "args": ["-y", "sdlc-mcp"] }
  }
}

Web dashboard

For a visual, read-only overview of any repository:

sdlc dashboard --path /path/to/project --open
# Serves http://127.0.0.1:8420 — risk grade, release readiness checks,
# audit chain status, shadow worktrees, language breakdown, tool registry.
# Read-only: the dashboard can never modify your code.

Connecting to your AI assistant

Assistant	Config location	What to add
OpenCode	`~/.config/opencode/opencode.jsonc`	Add `sdlc-mcp` to the MCP servers section
Claude Desktop	`~/.config/Claude/claude_desktop_config.json`	Add the server command to `mcpServers`
Claude Code	`~/.claude.json`	Add to `mcpServers`
Cursor	`~/.cursor/mcp.json`	Add to `mcpServers`
Windsurf	`~/.codeium/windsurf/mcp_config.json`	Add to `mcpServers`
VSCode	`~/.vscode/mcp.json`	Add to `servers`
Gemini	`~/.gemini/settings.json`	Add to `mcpServers`

See UNIVERSAL_INSTALL.md for exact configuration examples for each assistant.

Configuration

Config file (`sdlc.config.json`)

Create a config file to tune all settings:

sdlc config init     # Creates sdlc.config.json with defaults
sdlc config show     # Display active configuration
sdlc config validate # Check config file is valid

Key settings:

Section	Setting	Default	What it controls
`security`	`entropyThreshold`	`4.5`	Minimum Shannon entropy to flag a token
`auth`	`mode`	`"bearer"`	`"bearer"` for token auth, `"none"` for local-only
`http`	`sessionTimeoutSeconds`	`3600`	Streamable HTTP session expiry
`mutations`	`maxFileSizeBytes`	`1048576`	Maximum write size (1 MiB)
`rateLimiting`	`maxRequestsPerMinute`	`120`	Per-tool rate limit

Environment variables

Variable	Default	What it controls
`SDLC_RATE_LIMIT_CALLS`	`60`	Maximum calls per tool per time window
`SDLC_RATE_LIMIT_WINDOW_SECONDS`	`60`	Time window for rate limiting (seconds)
`SDLC_ALLOW_NETWORK_PATHS`	(unset)	Set to `1` to allow scanning network/UNC paths

Authentication

The server generates a Bearer token on first startup (stored in .sdlc/server.token).

sdlc auth status   # Show auth config and token preview
sdlc auth rotate   # Generate new token, archive old one
sdlc auth token    # Print the raw token (for CI/CD)

For local-only use (no auth required):

sdlc serve --http 8765 --auth none

MCP server options

# Run on stdio (default, for AI assistants)
python3 mcp/sdlc_mcp_server.py

# Run as HTTP server (basic)
python3 mcp/sdlc_mcp_server.py --http 8765

# Run as Streamable HTTP (2026 MCP standard, with sessions + auth)
python3 mcp/sdlc_mcp_server.py --http-streamable 8765

# Run without auth (local-only)
python3 mcp/sdlc_mcp_server.py --http-streamable 8765 --auth none
python3 mcp/sdlc_mcp_server.py --http 8765 --host 0.0.0.0

What's in the box

Component	Description	Works on
MCP Server	26 tools over stdio or localhost HTTP	Windows, Linux, macOS (Python 3.9+)
CLI	Full tool surface for any shell or CI runner	Windows, Linux, macOS (Python 3.9+)
Skills	7 workflow skills with machine-readable contracts	Any harness that loads Markdown
PowerShell	Snapshot, readiness, preflight scripts	Windows PowerShell / pwsh
Tests	48 cross-platform smoke tests	Python 3.9+
Install scripts	Universal bash and PowerShell installers	Bash, PowerShell

No third-party packages. No network calls against targets. No telemetry.

Running the tests

# Run the full test suite
python3 scripts/tests/smoke.py

# Expected: 48 passed, 0 failed, 1 skipped (UNC test is Windows-only)

Project structure

autonomous-sdlc-command-center/
├── mcp/                          # Core Python modules
│   ├── sdlc_core.py              # Shared utilities, file walking, git helpers
│   ├── sdlc_analyze.py           # Read-only analysis tools
│   ├── sdlc_write.py             # Safety-gated write engine
│   ├── sdlc_extensions.py        # Extended tools (metrics, SBOM, entropy, AST)
│   ├── sdlc_shadow.py            # Shadow worktree engine
│   ├── sdlc_mcp_server.py        # MCP server (stdio + HTTP)
│   └── sdlc_cli.py               # Command-line interface
├── scripts/
│   ├── commands/                 # PowerShell automation
│   ├── tests/                    # Smoke tests
│   ├── completions/              # Shell tab-completions (bash, zsh)
│   ├── install.sh                # Universal bash installer
│   └── install.ps1               # PowerShell installer
├── skills/                       # 7 workflow skills
├── hooks/                        # Lifecycle hooks
├── docs/                         # Operating model documentation
├── ANALYSIS_REPORT.md            # Deep analysis and evaluation
├── UNIVERSAL_INSTALL.md          # AI assistant setup guide
├── SECURITY.md                   # Security notes
├── PORTABILITY.md                # Cross-platform compatibility
└── README.md                     # This file

Deep dives

Operating Model — How the tool fits into your development workflow
Security Notes — Detailed security guarantees and safety invariants
Portability — Cross-platform compatibility details
Universal Install — Step-by-step AI assistant setup
Analysis Report — Deep code analysis and quality evaluation

License

See LICENSE for details.

Install Server

license - permissive license

quality

maintenance

How are these scores calculated?

Maintenance

–Maintainers

–Response time

–Release cycle

–Releases (12mo)

Commit activity

Resources

GitHub Repository

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Tools

View all tools

Related MCP Servers

Git MCP
Version Control Developer Tools CI/CD & DevOps
Andre-Buzeli
-
license
B
quality
-
maintenance
Enables comprehensive Git and GitHub operations through 30 DevOps tools including repository management, file operations, workflows, and advanced Git features. Provides complete Git functionality without external dependencies for seamless integration with Gitea and GitHub platforms.
Last updated 2025-10-10
18
819
SnapBack MCP Server
Code Analysis Developer Tools Security
vreko-dev
A
license
-
quality
B
maintenance
Enables AI-powered code safety analysis including risk detection, secret scanning, dependency checking, and code snapshot management. Works offline for basic features with optional cloud integration for advanced ML analysis and team collaboration.
Last updated 2026-06-12
8
1
Apache 2.0
mcp-release-guardian
Developer Tools CI/CD & DevOps
curtis-d-williams
A
license
A
quality
D
maintenance
Validates release hygiene in local repositories with network-free, read-only tools for checking repo structure, version alignment, and generating release checklists.
Last updated 2026-03-01
3
MIT
Gitrama MCP Serverofficial
Version Control Developer Tools
GitramaLLC
A
license
-
quality
C
maintenance
Provides 15 MCP tools for AI-powered Git intelligence, enabling commit messages, branch creation, PR descriptions, code review, diff analysis, and push operations directly from your AI assistant.
Last updated 2026-03-23
MIT

View all related MCP servers

Related MCP Connectors

GitLumen MCP
Screens public GitHub repos and PRs to generate risk maps, findings, and merge-readiness signals.
AXIS Toolbox — Agentic Commerce Codebase Intelligence
Generate AGENTS.md, AP2 compliance docs, checkout rules, debug playbook & MCP configs from any repo.
Commit — Supply Chain Risk Scoring
Supply chain risk scoring for npm, PyPI, Cargo, and Go. 9 tools. Behavioral signals.

View all MCP Connectors

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Senpai-Sama7/autonomous-sdlc-command-center'

If you have feedback or need assistance with the MCP directory API, please join our Discord server