MCP

🚀 Symbiotic MCP Server

A Model Context Protocol (MCP) server for security analysis using Symbiotic CLI, enabling security analysis of code and infrastructure files without affecting your workspace.

🚀 Quick Start

This server exposes security analysis tools via the MCP protocol for any MCP-compatible client, allowing you to scan code and infrastructure files without interfering with your workspace.

✨ Features

Available Tools

• code_scan_files - Static code analysis
• infra_scan_files - Infrastructure security scanning
• security_scan_files - Comprehensive security scan (code + infrastructure)
• get_supported_languages - List of supported programming languages

Cursor Integration

Setting up the Security Review Command

1. Create a .cursor directory in your project root if it doesn't exist.
2. Create or update .cursor/commands/security-review.md with the contents of security-review.md.

Using the Command

1. Open the chat panel in Cursor (Cmd+L or Ctrl+L).
2. Type /security-review followed by optional file paths or glob patterns.
3. The command will perform a comprehensive security analysis, including:
   • Scanning selected files or the entire workspace.
   • Analyzing for security vulnerabilities.
   • Triaging findings and filtering false positives.
   • Providing a detailed report with severity levels and remediation suggestions.
   • Offering to apply automatic fixes for identified issues.

📦 Installation

1. Install symbiotic-cli

https://github.com/SymbioticSec/cli/releases

2. Get API token Create an account on Symbiotic Security and retrieve your API token.
3. Build and start Clone this repository and install dependencies:

npm install
npm run build

📚 Documentation

MCP Configuration

In VSCode, open MCP: Open User Configuration and add in servers:

{
 "servers": {
  "symbiotic-security": {
       "command": "node",
      "args": ["path/to/build/index.js"],
      "env": {
        "SYMBIOTIC_API_TOKEN": "your_token_here",
    }
  },
}

Configuration for other MCP clients may vary but generally follows the same structure.

{
  "mcpServers": {
    "symbiotic-security": {
      "command": "node",
      "args": ["path/to/build/index.js"],
      "env": {
        "SYMBIOTIC_API_TOKEN": "your_token_here"
      }
    }
  }
}

Important environment variables:

• SYMBIOTIC_API_TOKEN (required) - Your Symbiotic API token

Note: Configuration file name and location may vary depending on your MCP client.

Transport Modes

• STDIO (default) - Standard communication for MCP
• SSE - Server-Sent Events over HTTP
• Streamable HTTP - HTTP with /mcp endpoint

# STDIO (default)
node build/index.js

# HTTP server on port 9593
SERVER_PORT=9593 node build/index.js

Authentication

The server requires a valid Symbiotic Security API token. Configuration is done via MCP environment variables. Minimal required configuration:

"env": {
  "SYMBIOTIC_API_TOKEN": "your_token_here"
}

How It Works

1. Receives code files via MCP.
2. Creates temporary files.
3. Executes symbiotic-cli.
4. Automatic cleanup of temporary files.
5. Returns formatted results.