@repomend/mcp

Security scanner that hands Claude a fix prompt and opens the PR.

16 scanners → one normalised graph → MCP resource. Claude reads your findings with full codebase context and drafts surgical patches. Your job: review and merge.

---

What This Is

This is the official MCP (Model Context Protocol) server for RepoMend. It connects Claude Desktop, Claude Code, Cursor, Windsurf, or any MCP-compatible client to your RepoMend security findings.

When you run this server, Claude can:

• List and filter your security findings by severity, status, or scanner
• Read full finding details including vulnerable code snippets
• Get AI-optimized remediation prompts for any finding
• Update finding status (resolve, accept, mark false positive)
• View your scan history, monitored repos, and network targets

Quick Start

1. Get your API token

Sign in at repomend.com/dashboard/settings and generate an MCP token.

2. Configure Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "repomend": {
      "command": "npx",
      "args": ["-y", "@repomend/mcp"],
      "env": {
        "REPOMEND_TOKEN": "your-token-here"
      }
    }
  }
}

3. Ask Claude about your security posture

"Show me the critical findings in my API repo and draft fixes for anything safely patchable."

That's it. Claude will call RepoMend's tools, read your findings, and start drafting patches.

---

Configuration

Variable	Required	Description
REPOMEND_TOKEN	Yes	Your personal MCP API token from repomend.com
REPOMEND_ENDPOINT	No	Override the API endpoint (default: https://mcp.repomend.ai/api/mcp)

Claude Code

claude mcp add repomend -- npx -y @repomend/mcp

Then set REPOMEND_TOKEN in your shell environment.

Cursor

Add to your Cursor MCP settings:

{
  "repomend": {
    "command": "npx",
    "args": ["-y", "@repomend/mcp"],
    "env": {
      "REPOMEND_TOKEN": "your-token-here"
    }
  }
}

---

Available Tools

list_findings

List security findings for your team, filtered by severity, status, or scanner.

Parameters:

Name	Type	Required	Description
severity	string	No	Filter: critical, high, medium, low, info
status	string	No	Filter: open, resolved, accepted, false_positive
scanner	string	No	Filter by scanner type (e.g. trivy, semgrep, nuclei)
limit	number	No	Max results (default: 25)

Example prompt: "List all critical open findings from trivy"

---

get_finding

Get full details of a specific finding by ID, including code snippets and remediation guidance.

Parameters:

Name	Type	Required	Description
findingId	number	Yes	The finding ID

Example prompt: "Show me finding #42 in detail"

---

update_finding_status

Update a finding's status. Requires developer or admin role.

Parameters:

Name	Type	Required	Description
findingId	number	Yes	The finding ID
status	string	Yes	New status: open, resolved, accepted, false_positive
note	string	No	Optional note explaining the change

Example prompt: "Mark finding #42 as resolved with note 'patched in PR #891'"

---

get_remediation_prompt

Get an AI-optimized remediation prompt for a finding. Returns a structured markdown document with vulnerability details, vulnerable code, and fix instructions that Claude can act on.

Parameters:

Name	Type	Required	Description
findingId	number	Yes	The finding ID

Example prompt: "Get the remediation prompt for finding #42 and draft the fix"

---

list_scans

List recent scans for your team.

Parameters:

Name	Type	Required	Description
limit	number	No	Max results (default: 10)

Example prompt: "Show me recent scan results"

---

list_repos

List all monitored repositories for your team.

Parameters: None

Example prompt: "Which repos are we currently scanning?"

---

list_targets

List all network targets configured for your team.

Parameters: None

Example prompt: "Show me our network scan targets"

---

Architecture & Security Model

┌─────────────────────────────────────────────────────────┐
│  Your Machine                                           │
│                                                         │
│  ┌───────────┐       ┌──────────────────┐              │
│  │  Claude   │──MCP──│  @repomend/mcp   │              │
│  │  Desktop  │ stdio │  (this package)  │              │
│  └───────────┘       └────────┬─────────┘              │
│                               │                         │
└───────────────────────────────┼─────────────────────────┘
                                │ HTTPS + Bearer token
                                ▼
                   ┌────────────────────────┐
                   │  mcp.repomend.ai       │
                   │  (RepoMend Platform)   │
                   │                        │
                   │  • Token validation    │
                   │  • Team isolation      │
                   │  • RBAC enforcement    │
                   │  • Subscription check  │
                   │  • Findings database   │
                   └────────────────────────┘

What this package does

• Reads REPOMEND_TOKEN from your environment
• Starts an MCP stdio server that Claude connects to
• Forwards tool calls as JSON-RPC over HTTPS to mcp.repomend.ai
• Returns responses back to Claude

What this package does NOT do

• Store tokens on disk or in memory beyond the session
• Log tokens, findings, or response bodies
• Contact any host other than mcp.repomend.ai
• Execute code from server responses
• Access your filesystem (beyond reading the env var)
• Send telemetry or analytics

Multi-tenant isolation

Your token is scoped to your team. The server enforces tenant isolation — you can only access findings, repos, and targets belonging to your team. Cross-team access is impossible regardless of what tool parameters are sent.

Role-based access

Role	Read findings	Update status	Read repos/targets
Viewer	✓	✗	✓
Developer	✓	✓	✓
Admin	✓	✓	✓

---

Supported Scanners

RepoMend runs 16 scanners across four categories. All findings are normalized into a single schema and accessible through this MCP server:

Core: Nuclei, Trivy, Semgrep, ZAP Baseline
API Security: ZAP API Scan, Nuclei API
Network & Infrastructure: Nmap Quick, Nmap Full, Nmap Vuln, SSL/TLS Scan
Custom Protection: Endpoint Patrol, Semgrep Protections, Coverage Diff

---

Development

git clone https://github.com/RepoMend-dev/mcp.git
cd mcp
npm install
npm run build

To test locally with Claude Desktop, point the config at your built version:

{
  "mcpServers": {
    "repomend": {
      "command": "node",
      "args": ["/path/to/mcp/dist/index.js"],
      "env": {
        "REPOMEND_TOKEN": "your-token-here"
      }
    }
  }
}

---

Troubleshooting

"Unauthorized" error

Your token is invalid or revoked. Generate a new one at repomend.com/dashboard/settings.

"Subscription expired" error

Your team's subscription has lapsed. Renew at repomend.com.

"Forbidden: your role cannot update findings"

Your token belongs to a viewer-role account. Ask your team admin to upgrade your role to developer or admin.

Claude doesn't see the tools

Restart Claude Desktop after editing claude_desktop_config.json. Ensure the REPOMEND_TOKEN environment variable is set.

---

Links

• Website: repomend.com
• Dashboard: repomend.com/dashboard
• Security Policy: SECURITY.md
• Issues: github.com/RepoMend-dev/mcp/issues
• Email: hello@repomend.com

---

License

MIT — see LICENSE