Content
# Secure Code Review MCP
A STDIO MCP server that analyzes source code provided by Cursor for security vulnerabilities and code issues using local rules and Semgrep, improves the code with OpenAI, and returns a unified diff.
## Preparation
- Java 17+
- `OPENAI_API_KEY`
- Semgrep (optional): If not installed, only a warning will be returned and the remaining steps will continue.
```bash
export OPENAI_API_KEY="..."
./gradlew clean bootJar
```
## Cursor Registration
Add the following server to your Cursor MCP settings. Replace the `command` path with the absolute path to this project.
```json
{
"mcpServers": {
"reviewpilot": {
"command": "/absolute/path/reviewpilot-mcp/gradlew",
"args": ["-q", "bootRun"],
"env": {
"OPENAI_API_KEY": "${env:OPENAI_API_KEY}",
"OPENAI_MODEL": "gpt-5-mini",
"SEMGREP_ENABLED": "true"
}
}
}
}
```
After registration, call the `improve_code` tool from Cursor.
```json
{
"filePath": "src/main/java/example/UserService.java",
"source": "public class UserService { ... }",
"instruction": "Improve security and readability"
}
```
The result will include `status`, original `issues`, `remainingIssues` after improvement, `diff`, and `warnings`. The `status` is determined as `IMPROVED`, `UNCHANGED`, or `REGRESSED` based on the total risk score. The server does not modify files directly.
## Configuration
| Environment Variable | Default Value | Description |
|---|---|---|
| `OPENAI_BASE_URL` | `https://api.openai.com` | OpenAI compatible API URL |
| `OPENAI_MODEL` | `gpt-5-mini` | Code improvement model |
| `SEMGREP_ENABLED` | `true` | Whether to run Semgrep |
| `SEMGREP_CONFIG` | `.semgrep/reviewpilot.yml` | Semgrep rule configuration |
The default security rules detect SQL injection, command injection, dangerous deserialization, and vulnerable hash algorithms in Java and Python. In Python, the use of `eval` and `exec` is also detected.
Analysis is performed in the order of `Java MCP → Semgrep → LLM → diff`.
## Testing
```bash
./gradlew test
```
