HefestoAI MCP Server

by artvepa80 Your server? Claim it

not responding

HefestoAI is listed as active in the registry but did not answer our last check. It exposes 4 tools. Last commit 8 Nov 2026.

HefestoAI checks AI-generated code before you ship it.

Uptime history 91 days of history · worst day 0%

91 days agonow

0.0%

Uptime 24h

0 of 91 checks

Tools

read from the server

88 ms

Response time

average over 24h

Stars

last commit 8 Nov 2026

What changed 16

Every tool that appeared, vanished or quietly changed what it asks for. Recorded since 13 October 2026. No other catalogue keeps this.

25 Oct 4 tool descriptions were rewritten analyze, compare, install and 1 more

25 Oct 2 tools changed the parameters they ask for analyze, compare

18 Oct 4 tool descriptions were rewritten analyze, compare, install and 1 more

18 Oct 4 tools changed the parameters they ask for analyze, compare, install and 1 more

13 Oct a tool description was rewritten analyze

13 Oct a tool changed the parameters it asks for analyze

What the code does

We read the source, 14 h ago · tools taken from the live server · rules 995398eba69f

Capabilities

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

Checks whether it runs in a sandbox hefesto/telemetry/client.py:178

        if os.path.exists("/.dockerenv"):

Runs an external command build_grammars.py:32, hefesto/core/providers/base.py:78, hefesto/validators/ci_parity.py:85 и ещё 4

        subprocess.run(["git", "clone", "--depth", "1", url], check=True)

Touches key and credential files hefesto/analyzers/devops/dockerfile_analyzer.py:112

                r"\.env|\.pem|\.key|id_rsa|id_ed25519|credentials|\.npmrc|\.pypirc|\.netrc"

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

This code can reach further than it looks

We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 14 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add hefestoai --transport http https://hefestoai.narapallc.com/api/mcp-protocol

Settings → Connectors → Add custom connector, then paste this address

https://hefestoai.narapallc.com/api/mcp-protocol

~/.codex/config.toml

[mcp_servers.hefestoai]
url = "https://hefestoai.narapallc.com/api/mcp-protocol"

.cursor/mcp.json

{
  "mcpServers": {
    "hefestoai": {
      "url": "https://hefestoai.narapallc.com/api/mcp-protocol"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "hefestoai": {
      "type": "http",
      "url": "https://hefestoai.narapallc.com/api/mcp-protocol"
    }
  }
}

Available tools 4

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

analyze

analyze

Runs the open-source hefesto-ai engine (`hefesto analyze --no-config`, free tier) on the files you send to the hosted analyzer and returns its findings: rule id, severity, file, line, message and the SARIF hefestoFingerprint/v1 fingerprint (format "sarif" adds the full SARIF 2.1.0 log). Use it to check a file or snippet the user shares (for example "analyze this file") for security and quality issues before committing. Minimum call: {"code": "<file contents>"}. Add path (e.g. "app/run.py") so the language comes from the extension; without path or language the language is inferred from the content, else python. For several files send files=[{"path", "content"}] instead. severity and format are optional. Covers Python, COBOL, the DevOps/IaC formats hefesto analyze routes, and TypeScript, JavaScript, Java, Go, Rust and C# through the multilang tree-sitter grammars (the first such request on a fresh server instance downloads the grammars and can take a few seconds longer). Limits: 20 files, 100 KB per file, 256 KB in total, 20 seconds, 10 requests per minute per IP, shared across server instances. No .hefesto.yaml is read. Files are deleted after the run; nothing is stored. For a whole repository, run `hefesto analyze .` locally.

compare

compare

Return a short static comparison of HefestoAI with one named tool. Use it when the user asks how HefestoAI differs from another scanner. No live lookup and no code is inspected. All arguments are optional: {} compares with sonarqube. Known values: sonarqube (the default when tool is omitted), snyk, github-advanced-security, semgrep, claude-code-security, coderabbit, qodo. Any other value is answered as sonarqube.

install

install

Return install commands for the open-source package (pip install hefesto-ai, Python 3.10+). Use it when the user wants to run HefestoAI locally, in a pre-commit hook or on a whole repository. Does not install anything on the caller's machine. No parameters: call it with {}.

pricing

pricing

Return current HefestoAI prices (Free $0, PRO $8/month per user, OMEGA $19/month). Use it when the user asks what HefestoAI costs. Static text. Does not look up or change a subscription. No parameters: call it with {}.

Endpoints

URL	Transport	State	Latency	Checked
https://hefestoai.narapallc.com/api/mcp-protocol	streamable-http	answering	88 ms	14 min ago

Alternatives to HefestoAI

same job, measured the same way

Import Guardian

by baneado98

Catch AI-hallucinated (slopsquatted) npm imports in generated code before npm install.

62 installs/wk local only

Verdict — Compliance for AI-Generated Code

by getverdict-ai

Compliance verdicts for AI-generated code. SOC 2, HIPAA, HITRUST for healthcare IT.

local only

Skillproof

by skillproofdev

Check whether a Claude Code skill was tested and whether it works before installing it.

62 installs/wk local only

Reuse Before Generate

by aradar46

Checks whether your idea already exists before your agent builds it. Searches GitHub, npm, Python.

88 installs/wk local only

MCPVetter

by mcpvetter

Audit your MCP servers for poisoned tools and leaked secrets, and check AI-generated code for flaws.

988 installs/wk answering

Solwyn

by solwyn

Check budgets before AI spend, record what your code spends and read Solwyn costs.

3 042 installs/wk local only

Pituitary

by dusk-network

Catch spec drift before it catches you. Detect overlap, stale docs, and code drift.

local only

Ybe Check

by addycuber

Ybe Check – security and compliance orchestrator for AI-generated repositories.

101 installs/wk local only

HefestoAI — questions

Answers built from our own checks of this server.

What can HefestoAI do?

It exposes 4 tools, read directly from the server on our last check. Among them: analyze, compare, install, pricing. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

Is HefestoAI working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 0 of 91 checks got a reply (0.0%), average response time 88 ms. The bar chart above shows every period we have measured.

The registry lists HefestoAI as active — why does it not respond?

The official MCP registry stores what the author submitted; it does not verify that the server still runs. We check the endpoint ourselves, and this one does not answer. Catalogues that copy the registry without checking will show it as working.

How do I connect HefestoAI?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does HefestoAI need an API key?

No. HefestoAI completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 4 of them are readable on this page. This is what we observed, not what the docs claim.

Is HefestoAI open source?

The code is open source: it is published under the MIT licence, written in Python, 7 stars on GitHub and 5 open issues. The licence covers the code in the repository, not the hosted service at hefestoai.narapallc.com, which runs on its operator's own terms.