AI Tool Integration (MCP)

Connect SPHIOR CODE to Cursor, Claude Code, VS Code, JetBrains and any MCP-compatible agent. SPHIOR finds vulnerabilities deterministically; your own AI applies the fix. Your source code never leaves your machine.

1. Get your API key

Create an API key in your account, then use it as SPHIOR_API_KEY in the config below.

Open SPHIOR CODE

2. Connect your tool

Most tools use the same mcpServers config below. In the SPHIOR CODE dashboard, the Connect panel (link icon) gives one-click install for Cursor and VS Code and ready-made snippets for every tool.

mcpServers config (Cursor · JetBrains · Windsurf · Cline · Zed · …)

{
  "mcpServers": {
    "sphior-code": {
      "command": "npx",
      "args": ["sphior-code-mcp"],
      "env": { "SPHIOR_API_KEY": "sk_live_YOUR_KEY_HERE" }
    }
  }
}

Cursor / VS Code — one-click deep link (Connect panel), or paste the config into .cursor/mcp.json / .vscode/mcp.json.

Claude Code — claude mcp add sphior-code -e SPHIOR_API_KEY=... -- npx sphior-code-mcp

JetBrains AI — Settings → Tools → AI Assistant → MCP → "As JSON", paste the config above.

Available tools

list_findings	List open findings across your repos (filter by severity/status).
get_finding	Fetch full detail for one finding (CWE, OWASP, location).
get_fix	Deterministic fix guidance for a finding — steps + agent instructions, no code sent.
get_evidence_pack	Tamper-proof evidence for audit (hashes, timestamps).

Ask your agent, e.g. "List my critical SPHIOR findings and fix the top one." It calls these tools automatically.

Data boundary

SPHIOR never transmits your source code through MCP. Findings and deterministic remediation guidance are returned; your agent reads the actual code from your local workspace and applies the fix, with a human reviewing before merge.