BugSmash MCP

Local Model Context Protocol server that lets an LLM read and manage BugSmash reviewer feedback without ever seeing your BugSmash API key.

LLM (Claude) --MCP--> bugsmash-mcp --HTTPS + X-API-Key--> https://api.bugsmash.io/api/v2

Install

npm install -g @mxrcochxvez/bugsmash-mcp

Or run without a global install via npx (see connector config below).

Requires Node.js 18+.

Generate an API key

Sign in at tools.bugsmash.io.
Open your profile menu → Settings.
Find the API Key section and copy the key.
Treat it like a password. If it leaks, regenerate it immediately from the same settings page.

Official auth docs: docs.bugsmash.io/authentication

Set `BUGSMASH_API_KEY` (do not commit it)

Export the key in your shell — never put it in a committed file.

export BUGSMASH_API_KEY="your-key-here"

macOS / Linux (zsh), persist for your user:

echo 'export BUGSMASH_API_KEY="your-key-here"' >> ~/.zshrc
source ~/.zshrc

Confirm it is set (does not print the value):

test -n "$BUGSMASH_API_KEY" && echo "BUGSMASH_API_KEY is set"

Register as a user-level MCP connector

Use a user scope so the server is available in every project.

Claude Code / Claude CLI (recommended: npx)

claude mcp add --scope user bugsmash --env BUGSMASH_API_KEY=$BUGSMASH_API_KEY -- npx -y @mxrcochxvez/bugsmash-mcp

If you installed globally:

claude mcp add --scope user bugsmash --env BUGSMASH_API_KEY=$BUGSMASH_API_KEY -- bugsmash-mcp

Claude Desktop

Edit your Claude Desktop config (macOS: ~/Library/Application Support/Claude/claude_desktop_config.json):

{
  "mcpServers": {
    "bugsmash": {
      "command": "npx",
      "args": ["-y", "@mxrcochxvez/bugsmash-mcp"],
      "env": {
        "BUGSMASH_API_KEY": "your-key-here"
      }
    }
  }
}

Prefer injecting the key from the environment your Desktop app inherits, rather than pasting it into a synced config file when possible.

Cursor

Add a similar MCP entry: command npx, args ["-y", "@mxrcochxvez/bugsmash-mcp"], and BUGSMASH_API_KEY under env.

Tools

Tool	BugSmash API	Purpose
`list_projects`	`GET /projects`	Paginated project list (find `projectId`)
`get_project`	`GET /project/{projectId}`	Project details + versions
`list_feedback`	`GET /comments?projectId`	All reviewer comments on a project
`get_feedback`	`GET /comment/{commentId}`	Single comment (+ replies)
`update_feedback`	`PATCH /comment/{commentId}`	Update text / status / priority / privacy
`list_replies`	`GET /comment/{commentId}/replies`	Thread replies
`post_reply`	`POST /reply`	Reply on a thread

Base URL: https://api.bugsmash.io/api/v2
Auth header: X-API-Key (never a tool argument).

Typical flow: list_projects → list_feedback → optionally update_feedback / post_reply.

Security note

The API key is read only from BUGSMASH_API_KEY.
It is never accepted as a tool parameter.
It must never be logged, printed, masked-partially in errors, or returned in tool responses.
On startup, a missing key exits with the generic message BUGSMASH_API_KEY is not set.
All HTTP calls go through one helper that attaches X-API-Key; request headers are not surfaced on errors.

Local development

git clone https://github.com/mxrcochxvez/bugsmash_mcp.git
cd bugsmash_mcp
npm install
npm run build
export BUGSMASH_API_KEY="your-key-here"
npm start

npm run typecheck   # tsc --noEmit
npm run pack:check  # preview files included in the npm tarball

API reference: docs.bugsmash.io