{"_id":"@abyssbugg/sourcery","_rev":"5-ebe20a463ad977b1ad1c691961ae532a","name":"@abyssbugg/sourcery","dist-tags":{"latest":"0.2.4"},"versions":{"0.2.0":{"name":"@abyssbugg/sourcery","version":"0.2.0","keywords":["sourcery","security","findings","triage","mcp"],"license":"MIT","_id":"@abyssbugg/sourcery@0.2.0","maintainers":[{"name":"abyssbug","email":"human.nbaby@gmail.com"}],"bin":{"sourcery":"dist/cli.js"},"dist":{"shasum":"6020a77bccd81c0a51940f589957a1fcb843fd23","tarball":"https://registry.npmjs.org/@abyssbugg/sourcery/-/sourcery-0.2.0.tgz","fileCount":27,"integrity":"sha512-Mgp3ckFq8uLtgLYipO7LCTh5I+hNWqkN+RU342TtHIHKcLcrhrVuQgWEEnfU2MhCD+ffXNeO9qa2ThA/2oaItw==","signatures":[{"sig":"MEQCIEDpOlNoYOiL4XBJjKGQ9+pLGl2sL/SUPGhvne5cd+sIAiAXuW7NUZZyvEh2P/zXClZy8cd3FOoKdJyPL4G+zt9giQ==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":185513},"type":"module","engines":{"node":">=20"},"gitHead":"e1c1b5d25ac174363c0532300854f707897f0fb7","scripts":{"test":"vitest run","build":"tsc -p tsconfig.json","typecheck":"tsc -p tsconfig.json --noEmit"},"_npmUser":{"name":"abyssbug","email":"human.nbaby@gmail.com"},"_npmVersion":"11.20.0","description":"Sourcery security findings for AI coding agents: MCP server, findings CLI, and remediation prompt builder over the public Sourcery security API.","directories":{},"_nodeVersion":"25.9.0","dependencies":{"zod":"^4.6.5","@modelcontextprotocol/sdk":"^1.31.0"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^4.1.11","typescript":"^7.0.2","@types/node":"^26.6.3"},"_npmOperationalInternal":{"tmp":"tmp/sourcery_0.2.0_1790628281717_0.4452073845593243","host":"s3://npm-registry-packages-npm-production"}},"0.2.1":{"name":"@abyssbugg/sourcery","version":"0.2.1","keywords":["sourcery","security","findings","triage","mcp"],"license":"MIT","_id":"@abyssbugg/sourcery@0.2.1","maintainers":[{"name":"abyssbug","email":"human.nbaby@gmail.com"}],"bin":{"sourcery":"dist/cli.js"},"dist":{"shasum":"dfbe58c91ecaaca5085c9e4bbef86367f3feda83","tarball":"https://registry.npmjs.org/@abyssbugg/sourcery/-/sourcery-0.2.1.tgz","fileCount":27,"integrity":"sha512-lY31sXS3RQhdYwozCBv1naTqNH6jIVEQgGdxJ9VtHWwaKlhG5OxRmXXtPmEHYsWp3j71kRHhdJnfeUC3fmY7eQ==","signatures":[{"sig":"MEQCIExlMiP224k0FWYCOpVb4T+PoqiVj2IuSR8RRcsvkIqKAiByBfLWOVYsscK31e5TObOuLWNFZizBnTIEe/mDCBYEoQ==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEUCIQDmOtzTDkTqVnY7zm40BiHIg/kS+w8lNnBleC3ms56hZQIgWJ3fl6HjfSj5pv2ZvZhCWZdjfj0rnrcI52hqD5glg5g=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":185558},"type":"module","engines":{"node":">=20"},"gitHead":"e1c1b5d25ac174363c0532300854f707897f0fb7","mcpName":"io.github.abyssbugg/sourcery","scripts":{"test":"vitest run","build":"tsc -p tsconfig.json","typecheck":"tsc -p tsconfig.json --noEmit"},"_npmUser":{"name":"abyssbug","email":"human.nbaby@gmail.com"},"_npmVersion":"11.20.0","description":"Sourcery security findings for AI coding agents: MCP server, findings CLI, and remediation prompt builder over the public Sourcery security API.","directories":{},"_nodeVersion":"25.9.0","dependencies":{"zod":"^4.6.5","@modelcontextprotocol/sdk":"^1.31.0"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^4.1.11","typescript":"^7.0.2","@types/node":"^26.6.3"},"_npmOperationalInternal":{"tmp":"tmp/sourcery_0.2.1_1790629243540_0.24168478465486598","host":"s3://npm-registry-packages-npm-production"}},"0.2.2":{"name":"@abyssbugg/sourcery","version":"0.2.2","keywords":["sourcery","security","findings","triage","mcp"],"license":"MIT","_id":"@abyssbugg/sourcery@0.2.2","maintainers":[{"name":"abyssbug","email":"human.nbaby@gmail.com"}],"homepage":"https://github.com/abyssbugg-labs/sourcery-agent-bundle#readme","bugs":{"url":"https://github.com/abyssbugg-labs/sourcery-agent-bundle/issues"},"bin":{"sourcery":"dist/cli.js"},"dist":{"shasum":"0f2acf076cfaf6fae9faaefeeb87215733d500e2","tarball":"https://registry.npmjs.org/@abyssbugg/sourcery/-/sourcery-0.2.2.tgz","fileCount":27,"integrity":"sha512-74kJgEYCPmGcsZC5Q4LOlsGDTIxwxbSQgONqoeSl3zDWbB4TNuO63QLBOcnllNuRifmge18kbBKSqCqycjXcSA==","signatures":[{"sig":"MEQCICPQE0XwATJCrdGXk24he2HZTvJBUIZz4euZr1+/wKdQAiAvTGEvhzYsZgZUdqajfq61uRLbVzzN60kZ34aPxg835w==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEYCIQDHwo9xWGGATt8454nxvNKEEtXD8Bdpa6wGI15bttGCCgIhAIsSGD1pppBYprVOx7zgJ8THztHzD1mifch6hpGhES4s","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":211494},"type":"module","engines":{"node":">=20"},"gitHead":"587a83d92011eb3f575cbdfb557489ffc86d3df5","mcpName":"io.github.abyssbugg/sourcery","scripts":{"test":"vitest run","build":"tsc -p tsconfig.json","typecheck":"tsc -p tsconfig.json --noEmit"},"_npmUser":{"name":"abyssbug","email":"human.nbaby@gmail.com"},"repository":{"url":"git+https://github.com/abyssbugg-labs/sourcery-agent-bundle.git","type":"git"},"_npmVersion":"10.9.8","description":"Sourcery security findings for AI coding agents: MCP server, findings CLI, and remediation prompt builder over the public Sourcery security API.","directories":{},"_nodeVersion":"22.23.2","dependencies":{"zod":"^4.6.5","@modelcontextprotocol/sdk":"^1.31.0"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^4.1.11","typescript":"^7.0.2","@types/node":"^26.6.3"},"_npmOperationalInternal":{"tmp":"tmp/sourcery_0.2.2_1790725517408_0.08753724996405143","host":"s3://npm-registry-packages-npm-production"}},"0.2.3":{"name":"@abyssbugg/sourcery","version":"0.2.3","keywords":["sourcery","security","findings","triage","mcp"],"license":"MIT","_id":"@abyssbugg/sourcery@0.2.3","maintainers":[{"name":"abyssbug","email":"human.nbaby@gmail.com"}],"homepage":"https://github.com/abyssbugg-labs/sourcery-agent-bundle#readme","bugs":{"url":"https://github.com/abyssbugg-labs/sourcery-agent-bundle/issues"},"bin":{"sourcery":"dist/cli.js"},"dist":{"shasum":"c7349bbb54e18750fbc12e13b3d93f84b7060a4a","tarball":"https://registry.npmjs.org/@abyssbugg/sourcery/-/sourcery-0.2.3.tgz","fileCount":27,"integrity":"sha512-GDU8FAIlSOpVRVKJO6LI2iDDPwd87TZkbOoBKqn5zAai+mSvVUYFVxcCYPFNiaxUYwSnGBngN2HJsb3Q3BZr/w==","signatures":[{"sig":"MEUCIFSpPbDZxI2BKvDtwgmXLLpcBpWJt35nwf8lpwa9HnW0AiEA7XRxVj6gB6XSpUycrVBbCVeEwfSeUfF1kCcZH3RIRD4=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEUCIFBATVl0p3car3xr+crUVl4J4qcvfhfvd3mM9QviB8pdAiEArfvOHh7fiAJO65iZSMPNXQAv8c1kvwUBlJVWQ+3SA2U=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":211499},"type":"module","engines":{"node":">=20"},"gitHead":"3ef005c355fae4e2b5b1a4e81f9fa1124e8aba6e","mcpName":"io.github.abyssbugg-labs/sourcery","scripts":{"test":"vitest run","build":"tsc -p tsconfig.json","typecheck":"tsc -p tsconfig.json --noEmit"},"_npmUser":{"name":"abyssbug","email":"human.nbaby@gmail.com"},"repository":{"url":"git+https://github.com/abyssbugg-labs/sourcery-agent-bundle.git","type":"git"},"_npmVersion":"10.9.8","description":"Sourcery security findings for AI coding agents: MCP server, findings CLI, and remediation prompt builder over the public Sourcery security API.","directories":{},"_nodeVersion":"22.23.2","dependencies":{"zod":"^4.6.5","@modelcontextprotocol/sdk":"^1.31.0"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^4.1.11","typescript":"^7.0.2","@types/node":"^26.6.3"},"_npmOperationalInternal":{"tmp":"tmp/sourcery_0.2.3_1790726106165_0.227742476556255","host":"s3://npm-registry-packages-npm-production"}},"0.2.4":{"_id":"@abyssbugg/sourcery@0.2.4","bin":{"sourcery":"dist/cli.js"},"bugs":{"url":"https://github.com/abyssbugg-labs/sourcery-agent-bundle/issues"},"dist":{"shasum":"21c24b9aff762054e5baa08538d55f65a3a0c0b9","tarball":"https://registry.npmjs.org/@abyssbugg/sourcery/-/sourcery-0.2.4.tgz","fileCount":27,"integrity":"sha512-XjHf2CBudvtHDQWjRWcy7+uhsJZa/TdzjHtIVZ/J/ykHRL2Guz3YLpTgNWpygnfj7FlBKhVeZp01NEx/qcryMg==","signatures":[{"sig":"MEUCIQCg6fbEl6ZFmEP0QDfCsbkqjZBSzG7q8KmhmISUEpufYQIga4ckUAIQoo1Qy5d0GoKZ3JH7Nhr1PaTLoMl6flj4NNc=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIQCXXAuxRg+XPR5b0bGxqWTe5afdM49706VuM3kro6wXRQIgR0GLvQZPz2cxl4PIPNeXXHecPIamAdON5DaVzfSo0fk="}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@abyssbugg%2fsourcery@0.2.4","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":211499},"name":"@abyssbugg/sourcery","type":"module","engines":{"node":">=20"},"gitHead":"927ecd439e464936c241a8b35f8f57975800fb47","license":"MIT","mcpName":"io.github.abyssbugg-labs/sourcery","scripts":{"test":"vitest run","build":"tsc -p tsconfig.json","typecheck":"tsc -p tsconfig.json --noEmit"},"version":"0.2.4","_npmUser":{"name":"abyssbug","email":"human.nbaby@gmail.com"},"homepage":"https://github.com/abyssbugg-labs/sourcery-agent-bundle#readme","keywords":["sourcery","security","findings","triage","mcp"],"repository":{"url":"git+https://github.com/abyssbugg-labs/sourcery-agent-bundle.git","type":"git"},"_npmVersion":"10.9.8","description":"Sourcery security findings for AI coding agents: MCP server, findings CLI, and remediation prompt builder over the public Sourcery security API.","directories":{},"maintainers":[{"name":"abyssbug","email":"human.nbaby@gmail.com"}],"_nodeVersion":"22.23.2","dependencies":{"zod":"^4.6.5","@modelcontextprotocol/sdk":"^1.31.0"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^4.1.11","typescript":"^7.0.2","@types/node":"^26.6.3"},"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/sourcery_0.2.4_1790737431958_0.5613549658060908"}}},"time":{"created":"2026-09-28T20:44:41.405Z","modified":"2026-09-30T03:03:52.455Z","0.2.0":"2026-09-28T20:44:41.849Z","0.2.1":"2026-09-28T21:00:43.680Z","0.2.2":"2026-09-29T23:45:17.523Z","0.2.3":"2026-09-29T23:55:06.248Z","0.2.4":"2026-09-30T03:03:52.036Z"},"bugs":{"url":"https://github.com/abyssbugg-labs/sourcery-agent-bundle/issues"},"license":"MIT","homepage":"https://github.com/abyssbugg-labs/sourcery-agent-bundle#readme","keywords":["sourcery","security","findings","triage","mcp"],"repository":{"url":"git+https://github.com/abyssbugg-labs/sourcery-agent-bundle.git","type":"git"},"description":"Sourcery security findings for AI coding agents: MCP server, findings CLI, and remediation prompt builder over the public Sourcery security API.","maintainers":[{"name":"abyssbug","email":"human.nbaby@gmail.com"}],"readme":"# Sourcery Agent Bundle\n\nA hybrid plugin bundle for agent-driven Sourcery security workflows: an MCP server (12 tools over Sourcery's public security API, pinned OpenAPI snapshot), two Agent Skills, and adapters for Claude Code, Cursor, Codex/ChatGPT, VS Code, Devin, Grok (CLI + Bot), Amp, Hermes, OpenClaw, and Rovo Dev CLI. The server ships as the npm package `@abyssbugg/sourcery` — most hosts just register `npx -y @abyssbugg/sourcery@latest`. See [`docs/COMPATIBILITY.md`](docs/COMPATIBILITY.md) for per-host install steps.\n\n## What is confirmed\n\nSourcery's current docs say the **only public API** is a Team-plan REST API for security findings. The documented API base is `https://api.sourcery.ai/api`, and the first documented request is:\n\n```bash\ncurl https://api.sourcery.ai/api/v1/security-issues \\\n  -H \"Authorization: Bearer $SOURCERY_API_KEY\"\n```\n\n**Verified and pinned.** The live OpenAPI document (`https://api.sourcery.ai/api/openapi.json`) is committed as a snapshot at `openapi/sourcery-openapi.json`:\n\n- Info: `Sourcery API 0.1.0 (OpenAPI 3.1.0)`\n- Fetched: 2026-09-10\n- SHA-256: `9fdb45e657a6406c86ea0d0def2963d534e20bec1a9c88f7d62dbc2e6807f877`\n\nEvery tool and the client allow-list are wired from that snapshot. The verified surface is exactly eight operations:\n\n| Method | Path | Purpose |\n|---|---|---|\n| GET | `/v1/security-issues` | List issues (filters + cursor pagination) |\n| GET | `/v1/security-issues/stats` | Counts by status and severity |\n| GET | `/v1/security-issues/{id}` | Fetch one issue |\n| PATCH | `/v1/security-issues` | Bulk update (max 100 ids) |\n| GET | `/v1/security-issue-groups` | List groups (same filters) |\n| GET | `/v1/security-issue-groups/stats` | Counts by status and severity |\n| GET | `/v1/security-issue-groups/{id}` | Fetch one group including its issues |\n| PATCH | `/v1/security-issue-groups` | Bulk update groups (max 100 ids) |\n\n## Why the Sourcery API + Git connector split\n\nSourcery's PR review controls are currently documented as GitHub/GitLab comment or label commands (`review`, `summary`, `guide`, `title`, `resolve`, `dismiss`, `create issue`) rather than public REST endpoints. Those actions are therefore best implemented through your GitHub/GitLab connector, while Sourcery is used for security findings.\n\n## Bundle shape\n\nRepo root = plugin root. The portable core (`plugin.json` + `skills/` + `mcp.json`) follows the [Agent Plugins 1.0.0](https://agent-plugins.org/specification) standard, which Cursor and OpenAI (Codex, ChatGPT desktop) load natively; the other files are thin per-host adapters.\n\n```text\nsourcery-agent-bundle/\n  plugin.json                      # Agent Plugins core manifest\n  mcp.json                         # portable stdio wiring -> bin/sourcery\n  skills/\n    sourcery-triage/SKILL.md       # findings triage workflow\n    sourcery-remediate/SKILL.md    # minimal-change fix workflow\n  bin/\n    sourcery                       # launcher: dist/cli.js when built, else npx @abyssbugg/sourcery\n  agents/\n    sourcery-triager.md            # read-only triage sub-agent (Claude format)\n  .claude-plugin/plugin.json       # Claude Code manifest + userConfig API key\n  .mcp.json                        # Claude Code MCP wiring (npx)\n  .agents/plugins/marketplace.json # Codex/ChatGPT local marketplace entry\n  scripts/\n    install-rovodev.sh             # Rovo Dev CLI wiring (mcp.json + skills)\n    install-local-hosts.sh         # grok, amp, hermes, openclaw, VS Code, Devin\n  examples/\n    mcp.http.json                  # remote deployment template\n    hooks/                         # optional hooks example (SessionStart echo; not enabled)\n  docs/\n    COMPATIBILITY.md               # per-host setup matrix\n    grok-bot-skill.md              # paste-in skill for Grok Bot\n  openapi/\n    sourcery-openapi.json          # pinned spec snapshot (SHA-256 above)\n  src/                             # TypeScript: MCP server + findings CLI (@abyssbugg/sourcery)\n    constants.ts                   # pinned facts: operations, enums, spec hash\n  tests/                           # TypeScript tests (constants drift pin, tools, client)\n  python/                          # Python reference implementation (server, client, prompts)\n    src/sourcery_agent/\n    tests/\n  package.json                     # npm package manifest (@abyssbugg/sourcery)\n  .env.example\n  README.md\n```\n\n## Tools\n\n- `sourcery_security_snapshot`: counts by status/severity plus the first page of active issues — start here for a triage overview.\n- `sourcery_list_findings`: list issues with `repository_ids`, `issue_types`, `statuses`, `search`, `limit`, `cursor`.\n- `sourcery_get_finding`: fetch one issue (full record incl. source snippet and dependency graph).\n- `sourcery_get_security_counts`: aggregate counts by status and severity.\n- `sourcery_bulk_update_findings`: bulk status/severity changes (≤100 ids; `SOLVED` is scanner-owned and rejected).\n- `sourcery_list_groups`, `sourcery_get_group`, `sourcery_get_group_counts`, `sourcery_bulk_update_groups`: the same capabilities for issue groups.\n- `sourcery_build_fix_prompt`: builds the Sourcery-style minimal-change agent prompt from a finding; the DEPENDENCY path uses `fixed_versions` + `manifest_file_path` and renders the dependency chain.\n- `sourcery_capabilities`: describes the verified surface, spec pin, and enum values.\n- `sourcery_api_request`: compatibility bridge restricted to the eight verified operations.\n\n## CLI\n\n```bash\nnpx -y @abyssbugg/sourcery@latest snapshot                          # counts + first page of active findings\nnpx -y @abyssbugg/sourcery@latest list --status ACTIVE --limit 50   # filterable list\nnpx -y @abyssbugg/sourcery@latest get 1234                          # one finding in full\nnpx -y @abyssbugg/sourcery@latest fix-prompt 1234                   # minimal-change agent prompt\n```\n\nInside an enabled plugin host, `bin/sourcery` runs the same CLI (it prefers a locally built `dist/cli.js` and otherwise falls back to npx). Add `--json` to any query command for scripting.\n\n## Setup\n\nRequirements: Node 20+. Most hosts register the MCP server directly:\n\n```bash\nexport SOURCERY_API_KEY='...'\nnpx -y @abyssbugg/sourcery@latest        # stdio MCP server (no args)\nnpx -y @abyssbugg/sourcery@latest http   # Streamable HTTP (127.0.0.1:8765/mcp)\n```\n\nOr install it as a plugin bundle — one step per host (details in [`docs/COMPATIBILITY.md`](docs/COMPATIBILITY.md)):\n\n| Host | Quick start |\n|---|---|\n| Claude Code | `claude --plugin-dir .` — prompts for the API key on enable |\n| Cursor | symlink the repo into `~/.cursor/plugins/local/`, reload |\n| Codex CLI / ChatGPT desktop | `codex plugin marketplace add ./` |\n| ChatGPT web | run `npx -y @abyssbugg/sourcery@latest http` behind HTTPS, add via developer mode |\n| VS Code / Grok / Amp / Hermes / OpenClaw | `scripts/install-local-hosts.sh` (idempotent; registers plugin, MCP, and skills) |\n| Devin | skill links via the installer; `devin plugins install --local .` for the full plugin |\n| Grok Bot | paste-in skill from `docs/grok-bot-skill.md` |\n| Rovo Dev CLI | `scripts/install-rovodev.sh` |\n\nFor development and tests, see the [Python reference implementation](python/) (its suite doubles as the bundle-packaging checker) and run `npm test` for the TypeScript suite. The server is built on the official MCP TypeScript SDK (`@modelcontextprotocol/sdk`).\n\n## Regenerating the pinned snapshot\n\nWhen Sourcery publishes a spec change:\n\n```bash\ncurl -sS --fail -o openapi/sourcery-openapi.json https://api.sourcery.ai/api/openapi.json\nshasum -a 256 openapi/sourcery-openapi.json   # update SPEC_SHA256 in src/constants.ts (+ python/src/sourcery_agent/constants.py, README/docs)\nnpm test                                      # tests/constants.spec.ts fails on drift\n```\n\nSourcery's PR review commands (review, summary, guide, title, resolve, dismiss, create issue) remain GitHub/GitLab comment or label commands — implement those through your Git provider connector, not the Sourcery REST API.\n","readmeFilename":"README.md"}