Sphior Code MCP runs on your own machine — the client starts it, so there is no endpoint to ping. 169 installs a week from npm. Last commit 26 Oct 2026.
Deterministic SAST/SCA findings + fix guidance for your AI agent. Runs locally, no account needed.
We read the source, 6 d ago · rules 995398eba69f
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
пакет sphior-code-mcp ссылается на toraastrta/sphior
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add sphior-code-mcp -- npx -y sphior-code-mcp
{
"mcpServers": {
"sphior-code-mcp": {
"command": "npx",
"args": [
"-y",
"sphior-code-mcp"
]
}
}
}
[mcp_servers.sphior-code-mcp]
command = "npx"
args = ["-y", "sphior-code-mcp"]
{
"mcpServers": {
"sphior-code-mcp": {
"command": "npx",
"args": [
"-y",
"sphior-code-mcp"
]
}
}
}
{
"servers": {
"sphior-code-mcp": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"sphior-code-mcp"
]
}
}
}
Optional settings from the registry entry, left out of the block above:
SPHIOR_API_KEY (Optional. Without it the server runs in local mode: it scans your workspace with the bundled deterministic engine and returns fix guidance. Set it to also get tamper-evident evidence, history and GRC integrations. Create one at https://sphior.com/account/code), SPHIOR_WORKSPACE (Optional. Directory to scan in local mode. Defaults to the directory your client launches the server in), SPHIOR_API_BASE (Override the API base URL for self-hosted / regional deployments. Default: https://sphior.com/api/v1).
Deterministic release gate for AI-written code and coding agents.
Deterministic, read-only audits of repo readiness for AI coding agents and of agent context files.
Detect API breaking changes, scan your codebase for impact, and draft the fix. Runs locally.
Deterministic code map for AI coding agents: a tree-sitter call graph with exact file:line over MCP.
Deterministic local repository context, impact analysis, and merge-readiness evidence for AI agents.
Finds documentation that no longer matches your code. Deterministic AST check; no API key.
15 deterministic validation tools for AI agents: tax IDs (15 countries), VAT, IBAN, LEI, HS codes.
Read-only access to deterministic engineering decisions stored in a local repository.
Answers built from our own checks of this server.