@asobacloud/sdlc-integrity-mcp

MCP server for enterprise SDLC code integrity. AI coding agents call its tools over the Model Context Protocol to scan a workspace for lifecycle teardown gaps, mock-theater tests, DRY violations, and language-specific safety issues in shell, JavaScript/HTML, and Python.

License: MIT

Quick start

Set SDLC_WORKSPACE to the absolute path of the repo to audit. If omitted, the server uses its process working directory. The server speaks MCP over stdio (no HTTP port).

Cursor

Add to ~/.cursor/mcp.json or the project .cursor/mcp.json:

{
  "mcpServers": {
    "sdlc-integrity": {
      "command": "npx",
      "args": ["-y", "@asobacloud/sdlc-integrity-mcp"],
      "env": {
        "SDLC_WORKSPACE": "/absolute/path/to/your/repo"
      }
    }
  }
}

Restart Cursor (or reload MCP servers), then ask the agent to run the integrity tools.

Claude Code

CLI (user scope):

claude mcp add --transport stdio --scope user \
  --env SDLC_WORKSPACE=/absolute/path/to/your/repo \
  sdlc-integrity -- npx -y @asobacloud/sdlc-integrity-mcp

Or put the same JSON under mcpServers in project .mcp.json (team-shared) or ~/.claude.json (user-wide):

{
  "mcpServers": {
    "sdlc-integrity": {
      "command": "npx",
      "args": ["-y", "@asobacloud/sdlc-integrity-mcp"],
      "env": {
        "SDLC_WORKSPACE": "/absolute/path/to/your/repo"
      }
    }
  }
}

Verify with claude mcp list. Project .mcp.json servers need approval the first time you open the repo in Claude Code.

Codex

CLI:

codex mcp add sdlc-integrity --env SDLC_WORKSPACE=/absolute/path/to/your/repo -- npx -y @asobacloud/sdlc-integrity-mcp

Or edit ~/.codex/config.toml (or project .codex/config.toml in a trusted project):

[mcp_servers.sdlc-integrity]
command = "npx"
args = ["-y", "@asobacloud/sdlc-integrity-mcp"]

[mcp_servers.sdlc-integrity.env]
SDLC_WORKSPACE = "/absolute/path/to/your/repo"

Codex CLI, the IDE extension, and the ChatGPT desktop Codex host share this config.

Run directly

npx -y @asobacloud/sdlc-integrity-mcp

Tools

Tool	Runtime	What it checks
`AuditCodeIntegrity`	`python3`	Lifecycle teardown parity, mock-theater test detection, naming invariants, swallowed exceptions, DRY / duplicative functions. Returns structured JSON.
`ShellSafetyChecker`	`bash`	Missing `set -euo pipefail`, shebang issues, hardcoded credentials, background-job silent-failure risk; optionally shellcheck errors.
`JsSafetyChecker`	`node`	JS/HTML syntax errors, duplicate function definitions, duplicate HTML element IDs (AST-based via esprima).
`PythonSafetyChecker`	`python3`	bandit (High/Critical), ruff, AST checks for `eval`/`exec`, pickle loads, hardcoded credentials, mutable default args.

Each tool accepts:

target — file or directory to scan (relative paths resolve against SDLC_WORKSPACE)
timeout — optional timeout in ms (default 120000, max 600000)

Checker exit code 1 (findings) becomes isError: true on the MCP result. Unexpected crashes are reported as errors.

Requirements

Runtime	Required for
Node.js ≥ 22	MCP server + `JsSafetyChecker`
Python 3	`AuditCodeIntegrity`, `PythonSafetyChecker`
bash	`ShellSafetyChecker`

Optional (skipped with a warning if missing):

Tool	Improves
shellcheck	`ShellSafetyChecker`
bandit	`PythonSafetyChecker`
ruff	`PythonSafetyChecker`

Custom rules

Drop JSON tool configs into <workspace>/.sdlc-rules/. Local rules override bundled tools with the same name, or add new ones. Script paths resolve relative to .sdlc-rules/.

{
  "name": "MyCustomAudit",
  "description": "Project-specific integrity check",
  "input_schema": {
    "type": "object",
    "properties": {
      "target": { "type": "string", "description": "File or directory to scan" },
      "timeout": { "type": "integer", "description": "Timeout in ms (max 600000)" }
    }
  },
  "execution": {
    "runtime": "python3",
    "script": "./my-audit.py",
    "args": ["--target", "{{target}}"],
    "default_timeout": 120000,
    "max_timeout": 600000
  }
}

{{placeholder}} values are filled from the tool call. If a value is omitted, that flag and its placeholder are skipped.

Architecture

rules/*.json   → tool schemas + execution specs
scripts/*      → checker subprocesses
src/loader.ts  → bundled rules + .sdlc-rules/ overlay
src/runner.ts  → spawn, timeouts, exit-code → isError
src/index.ts   → MCP stdio server
bin/cli.js     → npx / bin entrypoint

Development

git clone https://github.com/AsobaCloud/sdlc-integrity-mcp.git
cd sdlc-integrity-mcp
npm install
npm run build
npm test

Script	Purpose
`npm run build`	Compile TypeScript → `dist/`
`npm test`	E2E via real MCP `Client` + fixture assertions for all tools
`npm start`	Run the server on stdio
`npm run dev`	`node --watch` on `dist/`

Local MCP config (instead of npx):

{
  "mcpServers": {
    "sdlc-integrity": {
      "command": "node",
      "args": ["/absolute/path/to/sdlc-integrity-mcp/dist/index.js"],
      "env": {
        "SDLC_WORKSPACE": "/absolute/path/to/your/repo"
      }
    }
  }
}

Releasing

CI runs build + E2E on every push/PR. To publish a new version:

Bump version in package.json
Commit, push, and create a GitHub Release (gh release create vX.Y.Z --generate-notes)
.github/workflows/publish.yml publishes to npm (Trusted Publisher / OIDC, or NPM_TOKEN if configured)

@asobacloud/sdlc-integrity-mcp