@getdebug/mcp

Model Context Protocol server for getdebug. Lets Claude, Cursor, and any MCP-compatible AI client read your projects, findings, and proposed fixes through the same bearer token getdebug login already creates.

Tools (v0.2)

• list_projects — projects in your active org, with last-run status + finding counts.

• list_findings — findings for a project, filterable by severity, with id / file / line / CWE / OWASP.

• get_finding — full details of one finding: explanation, snippet, CWE/OWASP refs, and the proposed-fix diff when one exists.

• list_fixes — proposed/applied fixes (optionally scoped to a project or status), with finding link + PR URL.

• start_scan — enqueue a fresh hosted analyze run on a project. Findings appear in ~1-2 min; re-call list_findings to fetch.

apply_fix lands in a future release. Today: when get_finding shows a proposed-fix diff, applying it still happens via the PR review flow on the dashboard.

Related MCP server: DefectDojo Intelligence MCP Server

Auth

The server reads ~/.getdebug/config.json, the same file getdebug login writes. You must:

1. Install the CLI: npm i -g @getdebug/cli

2. Run getdebug login once.

3. The config file must be chmod 600 — the server refuses to load with looser perms, matching the CLI.

No new credentials, no extra OAuth, no MCP_TOKEN env var to manage.

Setup — Claude Desktop

Add this to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or the equivalent on your OS:

{
  "mcpServers": {
    "getdebug": {
      "command": "npx",
      "args": ["-y", "@getdebug/mcp"]
    }
  }
}

Restart Claude Desktop. The three tools appear under the 🔧 menu in any chat.

Setup — Cursor

Cursor's MCP config lives at ~/.cursor/mcp.json (or per-workspace at .cursor/mcp.json):

{
  "mcpServers": {
    "getdebug": {
      "command": "npx",
      "args": ["-y", "@getdebug/mcp"]
    }
  }
}

Setup — any other MCP client

Transport is stdio. Spawn getdebug-mcp (or npx @getdebug/mcp); the server speaks MCP over the child's stdin/stdout. Stderr is for logs only.

Local development

pnpm install --filter @getdebug/mcp...
cd mcp
pnpm dev        # tsx, hot-reload
pnpm typecheck
pnpm build && node dist/index.js

Override the API base for staging or local dev:

GETDEBUG_API_URL=http://localhost:3001 node dist/index.js

(The CLI honors the same env var — see cli/internal/cmd/login.go.)

What the agent will see

Example: an agent asks "any high-severity findings in my debug project?" The tool flow:

1. list_projects → picks the project id matching "debug".

2. list_findings({projectId, severity: "high", limit: 25}) → returns a list of HIGH findings with file paths + line numbers.

3. get_finding({findingId}) for any the agent wants to drill into → returns explanation + snippet + proposed-fix diff.

The agent can now reference your actual security findings by file and line while answering questions or writing code — without you copying anything in.

Privacy

This server is a thin client. It never touches your source files directly; it only reads what's already in your getdebug org via the same API the CLI and dashboard use. Run getdebug login --logout (or just delete ~/.getdebug/config.json) to revoke access.

License

MIT.