Enables loading, batching, and tracking of static analysis issues from ESLint SARIF reports, allowing agents to efficiently fix JavaScript code quality problems.
Enables loading, batching, and tracking of static analysis issues from SonarQube SARIF reports, facilitating systematic resolution of code quality and security problems.
Enables loading, batching, and tracking of security vulnerabilities and infrastructure issues from Trivy SARIF reports, helping agents focus on fixing high-priority findings.
This server does not currently have a deployable release on Glama. Follow the repository's setup instructions to install and configure it for your MCP client, including any required credentials and local dependencies.
Sheriff is an MCP server that helps AI agents efficiently fix static analysis issues from SARIF reports.
Documentation | Installation | Tool Reference
AI agents struggle with large static analysis reports:
Context overload - 100+ issues overwhelm context windows
Lost progress - Work is lost on context compaction or session restart
Inefficient navigation - No batching means jumping between files repeatedly
Sheriff solves this by acting as a work queue manager:
Intelligent batching - Issues grouped by file for efficient fixing
Persistent progress - State survives compaction, restarts, and agent switches
Scope filtering - Focus on specific rules, severities, or file patterns
Compact responses - Minimal context usage with abbreviated field names
Sheriff works with any tool that produces SARIF output:
Tool | Language | SARIF Command |
Qodana | Java/Kotlin/JS/Python |
|
Semgrep | Multi-language |
|
ESLint | JavaScript/TypeScript |
|
CodeQL | Multi-language | Built-in SARIF output |
SpotBugs | Java |
|
Bandit | Python |
|
Checkov | IaC |
|
Trivy | Container/IaC |
|
SonarQube | Multi-language | Built-in SARIF export |
Related MCP server: skillhub
Download sheriff-mcp-1.0.2-all.jar from Releases.
docker pull ghcr.io/ryansmith4/sheriff-mcp:latestClients that support the MCP Registry can install directly by name: io.github.ryansmith4/sheriff-mcp
See the Installation Guide for full details.
Add Sheriff to your MCP client (Claude Code, Cursor, ChatGPT Desktop, etc.):
{
"mcpServers": {
"sheriff": {
"command": "java",
"args": ["-jar", "/path/to/sheriff-mcp-1.0.2-all.jar", "start"]
}
}
}Or with Docker:
{
"mcpServers": {
"sheriff": {
"command": "docker",
"args": ["run", "-i", "--rm", "-v", ".:/data", "ghcr.io/ryansmith4/sheriff-mcp:latest"]
}
}
}See the Agent Setup Guide for client-specific instructions and recommended agent instructions.
1. Run static analysis → qodana scan
2. Load into Sheriff → sheriff load target="results.sarif"
3. Get next file's issues → sheriff next
4. Fix all issues in file → [edit the code]
5. Mark as done → sheriff done fps=[...] status="fixed"
6. Repeat 3-5 → until remaining = 0Sheriff exposes a single sheriff tool with 7 actions: load, next, done, progress, summary, reopen, and export. See the Tool Reference for full documentation.
User: "Fix all ConstantValue issues in my codebase"
Agent: sheriff load target="build/qodana/qodana.sarif.json"
→ 136 total issues, 22 ConstantValue, 15 unused...
Agent: sheriff next scope={rule: "ConstantValue"}
→ 3 issues in Service.java with code snippets
Agent: [reads Service.java, fixes all 3 issues]
Agent: sheriff done fps=["88d32cab35478753", "ab1c2d3e12345678", "f9e8d7c6a1b2c3d4"] status="fixed"
→ 3 marked fixed, 19 remaining
... continues until remaining = 0All release artifacts are signed with Sigstore for supply chain security.
Verify JAR:
VERSION=1.0.2
cosign verify-blob \
--signature sheriff-mcp-${VERSION}-all.jar.sig \
--certificate sheriff-mcp-${VERSION}-all.jar.pem \
--certificate-identity-regexp "https://github.com/ryansmith4/sheriff-mcp" \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
sheriff-mcp-${VERSION}-all.jarVerify Docker image:
cosign verify ghcr.io/ryansmith4/sheriff-mcp:latest \
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
--certificate-identity-regexp="github.com/ryansmith4/sheriff-mcp"See SECURITY.md for our security policy.
Contributions welcome! See CONTRIBUTING.md for guidelines.
Apache License 2.0 - see LICENSE
This server cannot be deployed
Assign Linear, Jira or GitHub issues to an AI coding agent team that plans, builds, reviews, tests.
Scores your code across 12 areas, with findings, fix prompts, and re-assessment in your AI agent
Hand tasks, bugs and finished work to AI coding agents, and get back a write-up with evidence.
Track issues, projects and dependencies with your agent in a workspace you control.
