cognium-mcp

The Cognium MCP server and the editor plugins that use it.

The server

npx -y @cognium/mcp-server

It speaks MCP over stdio and serves seventeen deterministic static-analysis tools built on circle-ir: scan a project, list entry points and reachable sinks, trace taint paths, explain a finding, check a sanitizer. No API key, no network, no model.

The same package is also a library, so a host can mount the server over its own transport:

import { createServer } from '@cognium/mcp-server';

const { server } = await createServer();
await server.connect(transport);

Optional tool modules are loaded when they are installed next to the server. circle-ir-ai ships one, circle-ir-ai/mcp, which adds ten more tools. A module built against a different circle-ir minor is refused, on stderr and to the client (the server's capabilities and instructions), and the seventeen built-in tools keep serving.

Client configuration, the environment variables and the licence states are in the package README.

Related MCP server: sec-graph

What this repository promises

The tool list and its schemas are the API. A removed or renamed tool, or a changed schema, is a major version; a new tool or field is a minor. A first outputSchema on a tool that had none counts as a new field; once declared, removing or changing it is a major. CI holds that, and the other promises, as separate checks:

Development

npm install
npm run build
npm test
npm run lint
npm run check:pins

Node.js 20.19 or newer. See CONTRIBUTING.md and RELEASING.md.

Where the engine lives

The analysis itself is circle-ir, in the cognium-dev repository, along with the cognium-dev command-line scanner. This package lived there until 0.2.0 and moved here with its history; issue numbers in older commits and changelog entries refer to that repository.

License

MIT. See LICENSE.