Audits legacy PHP projects with read-only static analysis: runs Semgrep SAST rules, Psalm type/security analysis, Progpilot taint analysis, and PHPCS coding-standards checks, returning per-finding JSON (file, line, severity, rule, message, snippet). Also maps project structure (source files, probable PHP version, entry points) and reads code context by file and line range.
This server does not currently have a deployable release on Glama. Follow the repository's setup instructions to install and configure it for your MCP client, including any required credentials and local dependencies.
A read-only Model Context Protocol server that audits legacy PHP projects with four static analysis tools:
Tool | Purpose |
| SAST rules for legacy PHP ( |
| Type/security analysis (Psalm) |
| Taint analysis for PHP (Progpilot) |
| Code style / PHP coding standards (PHPCS) |
Other tools: get_auditor_status, map_project_structure, read_code_context.
Python 3.10+
PHP 8.1+ (needed by Psalm, Progpilot and PHPCS)
The official mcp SDK (FastMCP) — install with pip install -e .
pydantic (already a dependency of mcp)
Install the dev dependencies with Composer (they ship the PHP binaries):
composer install --no-interaction --no-progressBinary | How it is provided |
| Python package, |
|
|
|
|
|
|
Related MCP server: Ecosystem Intelligence MCP
The server only ever scans directories inside ALLOWED_AUDIT_ROOT.
Set it before starting the server:
export ALLOWED_AUDIT_ROOT=/path/to/legacy-app
python -m php_legacy_auditor.serverIf ALLOWED_AUDIT_ROOT is not set, the tools still run (the server logs a
warning) but the root validation is disabled.
# With the package installed
mcp serve php_legacy_auditor.server
# Or directly with the SDK
python -m mcp.server.fastmcp php_legacy_auditor.serverThe FastMCP app is also importable:
from php_legacy_auditor.server import mcp.
Tool | Arguments | Output |
| — |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Every tool is read-only: they never modify, delete, or execute the audited
code. Paths are resolved and blocked when they escape ALLOWED_AUDIT_ROOT
(validate_safe_path / security.py). Subprocesses are always invoked with an
argument list and a strict timeout (no shell=True).
Scan tools return a compact JSON event per finding:
{
"file": "/tmp/app.php",
"line": 17,
"severity": "WARNING",
"rule": "legacy-php-mysql-connect",
"message": "mysql_connect() is deprecated; use mysqli or PDO",
"snippet": "<?php mysql_connect(...);"
}# Unit tests (Python level)
python -m pytest tests/ -q
# All four tools on the sample vulnerable app
./scripts/run_all_audits.shThe sample app lives in tests/sample_vulnerable_app/ and contains classic
legacy PHP vulnerabilties (SQL injection, remote inclusion, eval(),
unserialize()).
MIT (see LICENSE).
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
This server cannot be deployed
GitHub security scanning, code audit, and workflow automation for repositories.
Generate SBOMs, scan vulnerabilities, and analyze dependencies from local projects or Git repos.
Detects database migration table locks, terraform cost leaks, and OWASP API flaws.
Audit GitHub repos for malicious and supply-chain code before you depend on them.
