{
  "markdown": "# MegaLinter MCP Server\n\n![Down At The Bottom Of The Mole Hole banner](.assets/org-banner.png)\n\n<!-- mcp-name: io.github.downatthebottomofthemolehole/megalinter-mcp-server -->\n\n> **Note:** This is a community-maintained MCP server. It is not an official Model Context Protocol server, but it is **sanctioned by Ox Security** as a complement to their official MegaLinter tools.\n\n[![CI/Publish](https://github.com/DownAtTheBottomOfTheMoleHole/megalinter-mcp/actions/workflows/publish-mcp.yml/badge.svg)](https://github.com/DownAtTheBottomOfTheMoleHole/megalinter-mcp/actions/workflows/publish-mcp.yml)\n[![Coverage](https://codecov.io/github/DownAtTheBottomOfTheMoleHole/megalinter-mcp/graph/badge.svg?branch=main)](https://codecov.io/github/DownAtTheBottomOfTheMoleHole/megalinter-mcp)\n[![npm](https://img.shields.io/npm/v/@downatthebottomofthemolehole/megalinter-mcp-server.svg)](https://registry.npmjs.org/@downatthebottomofthemolehole/megalinter-mcp-server)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](./LICENSE)\n[![Node Version](https://img.shields.io/badge/node-%3E%3D24.14.0-brightgreen)](https://nodejs.org/)\n\nA Model Context Protocol (MCP) server for running [Ox Security MegaLinter](https://megalinter.io/) through `mega-linter-runner`. Works with any CI/CD platform (GitHub Actions, GitLab CI, Azure DevOps, CircleCI, Jenkins) or locally.\n\n## Overview\n\nThis server provides 15 MCP tools in total: 10 core tools and 5 convenience aliases across execution, discovery, and analysis workflows.\n\n- `megalinter_quick_action` for short, natural requests with sensible defaults.\n- `megalinter_run` to execute MegaLinter with configurable runtime and runner options.\n- `megalinter_write_config` to generate a minimal `.mega-linter.yml` file.\n- `megalinter_list_flavors` to return common MegaLinter flavors.\n- `megalinter_get_linters` to discover available linters by language, security focus, and auto-fix capability.\n- `megalinter_get_security_info` to group security linters by threat category.\n- `megalinter_get_reporters` to list supported report output formats and CI-targeted reporters.\n- `megalinter_parse_reports` to parse JSON or SARIF report artefacts.\n- `megalinter_get_issue_summary` to aggregate report issues by linter and severity.\n- `megalinter_get_security_recommendations` to generate security-focused remediation guidance.\n\n### Quick Start (Short Prompts)\n\nIf you prefer short prompts, use `megalinter_quick_action` first:\n\n- `@megalinter quick scan this repository`\n- `@megalinter security scan`\n- `@megalinter summarise errors`\n- `@megalinter list python security linters`\n- `@megalinter write config`\n\nOr use **ultra-short aliases** for minimal typing:\n\n- `@megalinter scan` — Quick scan with defaults\n- `@megalinter summary` — Summarise last run's errors\n- `@megalinter parse` — Parse JSON report\n- `@megalinter help_quick` — Context-aware help for your project\n\n### Platform Compatibility\n\nThis MCP server is **platform-agnostic** and works universally:\n\n- ✅ **Locally** — Run MegaLinter from your IDE or command line\n- ✅ **GitHub Actions** — Integrate with workflows\n- ✅ **GitLab CI/CD** — Use in GitLab pipelines\n- ✅ **Azure DevOps** — Run in Azure Pipelines\n- ✅ **CircleCI, Jenkins, Bitbucket Pipelines** — Any CI/CD platform with Docker support\n- ✅ **AI Agents & Copilot** — Automated code quality checks via MCP\n\nThe only requirement is Docker (or a compatible container runtime like Colima).\n\n### Tool Matrix\n\n| Tool | Category | Typical outcome |\n| --- | --- | --- |\n| `megalinter_quick_action` | Interactive | Handle short natural requests with defaults |\n| `scan` | Alias | Ultra-short alias for quick scan |\n| `summary` | Alias | Ultra-short alias for error summary |\n| `parse` | Alias | Ultra-short alias for report parsing |\n| `help_quick` | Alias | Ultra-short alias for context-aware help |\n| `megalinter_help_quick` | Help | Context-aware suggestions for your project |\n| `megalinter_run` | Execution | Run linting and produce report artefacts |\n| `megalinter_write_config` | Configuration | Generate baseline `.mega-linter.yml` |\n| `megalinter_list_flavors` | Discovery | Identify an appropriate flavour for your stack |\n| `megalinter_get_linters` | Discovery | Filter linters by language, security, and auto-fix support |\n| `megalinter_get_security_info` | Discovery | View security linters grouped by SAST, secrets, container, and IaC |\n| `megalinter_get_reporters` | Discovery | Select output/reporting formats for local and CI workflows |\n| `megalinter_parse_reports` | Analysis | Read JSON or SARIF reports in structured form |\n| `megalinter_get_issue_summary` | Analysis | Summarise issue totals and top failing linters |\n| `megalinter_get_security_recommendations` | Analysis | Produce practical shift-left security actions |\n\n## Tools\n\n### `megalinter_quick_action`\n\nInteractive shortcut that accepts a short request and routes it to the right workflow.\n\nInputs:\n\n- `request` (string, optional): Short instruction. Default: `quick scan`.\n- `action` (string, optional): Explicit quick action (`scan`, `config`, `flavors`, `linters`, `security`, `reporters`, `parse`, `summary`, `recommendations`).\n- `scanMode` (string, optional): Scan preset (`quick`, `full`, `security`, `fix`).\n- `target` (string, optional): Directory to scan. Default: `.`.\n- `workingDirectory` (string, optional): Command working directory.\n- `reportsPath` (string, optional): Reports directory. Default: `megalinter-reports`.\n- `reportType` (string, optional): Parse format (`json` or `sarif`).\n- `severity` (string, optional): Summary filter (`error`, `warning`, `info`).\n- `language` (string, optional): Language filter for linter queries. For scans, maps to a flavor hint (`python`, `javascript`, `terraform`, and similar).\n- `securityOnly` (boolean, optional): Return only security linters in linter queries. For scans, forces `security` flavor.\n- `autoFixOnly` (boolean, optional): Return only auto-fix linters in linter queries.\n- `timeoutMinutes` (number, optional): Timeout for scan actions. Default: `20`.\n- `summaryOnly` (boolean, optional): Return concise output for scans. Default: `true`.\n- `flavor` (string, optional): Optional flavor override for scan actions.\n- `fix` (boolean, optional): Force auto-fixes for scan actions.\n- `targetPath` (string, optional): Config output path for write-config requests.\n\nExamples:\n\n- `request: \"quick scan\"` -> Runs `ci_light` against changed files.\n- `request: \"full scan\"` -> Runs `all` flavor.\n- `request: \"security scan\"` -> Runs `security` flavor.\n- `request: \"summarise errors\"` -> Returns issue summary filtered to errors.\n- `request: \"parse sarif report\"` -> Parses SARIF output.\n- `action: \"summary\", severity: \"error\"` -> Deterministic summary with no phrase parsing.\n- `action: \"scan\", scanMode: \"security\"` -> Deterministic security scan.\n\n### `scan` (Ultra-short alias)\n\nRun a quick scan with minimal typing. Accepts optional parameters for customization.\n\nInputs:\n\n- `language` (string, optional): Target language mapped to flavor (e.g., `python`, `javascript`, `terraform`).\n- `scanMode` (string, optional): Scan preset (`quick`, `full`, `security`, `fix`). Default: `quick`.\n- `summaryOnly` (boolean, optional): Return concise output. Default: `true`.\n\nExample: `@megalinter scan` runs a quick scan with concise output.\n\n### `summary` (Ultra-short alias)\n\nSummarise errors from the last MegaLinter run with minimal typing.\n\nInputs:\n\n- `severity` (string, optional): Filter by severity (`error`, `warning`, `info`).\n- `linterFilter` (string, optional): Filter by linter name.\n\nExample: `@megalinter summary` shows all error/warning totals.\n\n### `parse` (Ultra-short alias)\n\nParse MegaLinter report files with minimal typing.\n\nInputs:\n\n- `reportType` (string, optional): Report format (`json` or `sarif`). Default: `json`.\n- `reportsPath` (string, optional): Reports directory path.\n\nExample: `@megalinter parse` parses the JSON report.\n\n### `megalinter_help_quick`\n\nGet context-aware help based on your current repository. Detects languages, frameworks, Docker, Terraform, and security files to suggest relevant commands.\n\nNo inputs required.\n\nExample: `@megalinter help_quick` returns tailored suggestions for your project.\n\n### `megalinter_run`\n\nUse this tool when you need full argument-level control. For short prompts, prefer `megalinter_quick_action`.\n\nRuns `mega-linter-runner` via `npx`.\n\nInputs:\n\n- `workingDirectory` (string, optional): Command working directory. Defaults to current process directory.\n- `path` (string, optional): Directory path to lint.\n- `flavor` (string, optional): MegaLinter flavor. Default: `all`.\n- `release` (string, optional): MegaLinter image tag. Default: `v9`.\n- `image` (string, optional): Full Docker image override.\n- `env` (string, optional): Environment variable string passed to `--env`.\n- `fix` (boolean, optional): Apply auto-fixes.\n- `help` (boolean, optional): Show `mega-linter-runner` help.\n- `install` (boolean, optional): Generate MegaLinter starter config.\n- `containerName` (string, optional): Docker container name override.\n- `removeContainer` (boolean, optional): Remove container after run.\n- `configFile` (string, optional): Path to `.mega-linter.yml`.\n- `reportsPath` (string, optional): Reports directory. Default: `megalinter-reports`.\n- `disableLinters` (string, optional): Comma-separated list of linters to disable.\n- `lintChangedFilesOnly` (boolean, optional): Sets `VALIDATE_ALL_CODEBASE=false` when true.\n- `runnerVersion` (string, optional): npm version for `mega-linter-runner` (for example `latest`).\n- `timeoutSeconds` (number, optional): Timeout in seconds. Default: `3600`.\n- `summaryOnly` (boolean, optional): Return concise logs. Default: `false`.\n- `extraArgs` (string[], optional): Additional CLI arguments.\n\n### `megalinter_write_config`\n\nWrites a minimal MegaLinter configuration.\n\nInputs:\n\n- `targetPath` (string, optional): Output file path. Default: `.mega-linter.yml`.\n- `applyFixes` (string, optional): Value for `APPLY_FIXES`. Default: `none`.\n- `showElapsedTime` (boolean, optional): Value for `SHOW_ELAPSED_TIME`. Default: `true`.\n- `flavorSuggestions` (boolean, optional): Value for `FLAVOR_SUGGESTIONS`. Default: `false`.\n- `disableLinters` (string[], optional): Values for `DISABLE_LINTERS`.\n\n### `megalinter_list_flavors`\n\nReturns the built-in list of common flavors (`all`, `javascript`, `python`, `terraform`, and others).\n\n### `megalinter_get_linters`\n\nReturns linter metadata from the built-in catalogue and supports targeted filtering.\n\nInputs:\n\n- `language` (string, optional): Filter by language (for example `python`, `javascript`, `terraform`).\n- `securityOnly` (boolean, optional): Return only security-focused linters.\n- `autoFixOnly` (boolean, optional): Return only linters with automatic fix capability.\n\n### `megalinter_get_security_info`\n\nReturns security linters grouped into categories such as SAST, secrets, supply chain, container, and infrastructure.\n\nInputs:\n\n- None.\n\n### `megalinter_get_reporters`\n\nReturns available MegaLinter reporters, including CI-targeted formats.\n\nInputs:\n\n- None.\n\n### `megalinter_parse_reports`\n\nParses MegaLinter report files from the reports directory.\n\nInputs:\n\n- `reportsPath` (string, optional): Report directory path. Default: `megalinter-reports`.\n- `reportType` (string, optional): Report type (`json` or `sarif`). Default: `json`.\n\n### `megalinter_get_issue_summary`\n\nSummarises issues from `megalinter-report.json` and can apply severity/linter filters.\n\nInputs:\n\n- `reportsPath` (string, optional): Report directory path. Default: `megalinter-reports`.\n- `severityFilter` (string, optional): Filter results by severity (`error`, `warning`, `info`).\n- `linterFilter` (string, optional): Filter results by linter name.\n\n### `megalinter_get_security_recommendations`\n\nGenerates security recommendations based on active linters in the parsed report data.\n\nInputs:\n\n- `reportsPath` (string, optional): Report directory path. Default: `megalinter-reports`.\n\n## Prompt Cookbook\n\nUse these copy/paste prompts in Copilot Chat with `@megalinter`.\nCLI tools default to the current workspace root when no path is given.\nIf you add a file or folder as Copilot context (`#file` or `#folder`), reference it in your prompt and the tool will target that path.\n\n### Quick Actions (`megalinter_quick_action`)\n\n```text\n@megalinter quick scan\n@megalinter full scan\n@megalinter security scan\n@megalinter summarise errors\n@megalinter parse sarif report\n@megalinter write config\n```\n\n**Expected output**: Routes each short request to the correct tool with sensible defaults.\n\nDeterministic alternatives using explicit action fields:\n\n```text\n@megalinter run quick action with action summary and severity error\n@megalinter run quick action with action parse and reportType sarif\n@megalinter run quick action with action scan and scanMode security\n```\n\n### Run MegaLinter (`megalinter_run`)\n\n```text\n@megalinter run megalinter with flavor all on . with reports in megalinter-reports\n```\n\n**Expected output**: Executes linters and reports issues found across all languages. Creates `megalinter-reports/` with JSON, SARIF, and text reports.\n\n### Create Config (`megalinter_write_config`)\n\n```text\n@megalinter create a MegaLinter config at .mega-linter.yml\n```\n\n**Expected output**: Creates `.mega-linter.yml` with specified settings ready for customization.\n\n### List Flavors (`megalinter_list_flavors`)\n\n```text\n@megalinter list all available MegaLinter flavors\n```\n\n**Expected output**: Table of flavors (all, python, javascript, go, etc.) with descriptions and use cases.\n\n### Query Linters (`megalinter_get_linters`)\n\n```text\n@megalinter list python security linters with autofix support\n```\n\n**Expected output**: Filtered list of Python-related and multi-language security linters from the current catalog that support autofix (if any match the query).\n\n### Security Categories (`megalinter_get_security_info`)\n\n```text\n@megalinter show MegaLinter security linter categories\n```\n\n**Expected output**: Security categories (for example, `sast`, `secrets`, `supply-chain`, `container`, `infrastructure`) with associated linters (gitleaks, trivy, etc.).\n\n### List Reporters (`megalinter_get_reporters`)\n\n```text\n@megalinter list available MegaLinter reporters\n```\n\n**Expected output**: List of reporters (console, json, sarif, github-comment, etc.) with activation methods.\n\n### Parse Reports (`megalinter_parse_reports`)\n\n```text\n@megalinter parse the json report from megalinter-reports\n```\n\n**Expected output**: Parsed MegaLinter JSON or SARIF report content as structured data (raw report payload).\n\n### Issue Summary (`megalinter_get_issue_summary`)\n\n```text\n@megalinter summarise issues from megalinter-reports with severity error\n```\n\n**Expected output**: Summary of issues filtered by severity and linter inputs, aggregated by linter with totals and run counts.\n\n### Security Recommendations (`megalinter_get_security_recommendations`)\n\n```text\n@megalinter generate security recommendations using megalinter-reports\n```\n\n**Expected output**: Actionable security recommendations prioritized by severity with linter names, rule IDs, and suggested next steps.\n\n## Dependencies\n\n### System Dependencies\n\n- Node.js `>=24.0.0`\n- npm (bundled with Node.js)\n- Docker Engine or Docker Desktop (must be running for `megalinter_run`)\n- Optional local container runtime wrapper such as Colima\n\n### npm Dependencies\n\nRuntime:\n\n- `@modelcontextprotocol/sdk` (MCP server SDK)\n\nDevelopment:\n\n- `typescript` (build/compile)\n- `tsx` (development runner)\n- `@types/node` (Node.js typings)\n\nRuntime note:\n\n- `mega-linter-runner` is executed via `npx` at runtime and can be pinned with the `runnerVersion` tool input.\n\n## Installation\n\n```bash\nnpm install\nnpm run build\n```\n\n## Configuration\n\n### Usage with VS Code Copilot Chat\n\nThis workspace is preconfigured in `.vscode/mcp.json`:\n\n```json\n{\n  \"servers\": {\n    \"megalinter\": {\n      \"type\": \"stdio\",\n      \"command\": \"node\",\n      \"args\": [\"./dist/index.js\"]\n    }\n  }\n}\n```\n\nReload VS Code (`Cmd+Shift+P` → `Developer: Reload Window`) after changing MCP configuration.\n\nThen query the server from Copilot Chat with `@megalinter`, for example:\n\n```text\n@megalinter list available flavors\n@megalinter list security linters for javascript\n```\n\n### Usage with Other MCP Clients\n\nUse a stdio server configuration that runs the compiled entrypoint:\n\n```json\n{\n  \"name\": \"megalinter-mcp-server\",\n  \"type\": \"stdio\",\n  \"command\": \"node\",\n  \"args\": [\"/absolute/path/to/megalinter-mcp/dist/index.js\"]\n}\n```\n\nBuild first with `npm run build`, then start your MCP client.\n\n## Running\n\n```bash\nnpm start\n```\n\nDevelopment mode:\n\n```bash\nnpm run dev\n```\n\n## Debugging\n\nUse `.vscode/launch.json`:\n\n- `Debug MCP Server` (runs `npm run dev`)\n- `Debug MCP Server (Built)` (runs `dist/index.js` after build)\n\nSet breakpoints in `src/index.ts`, then press `F5`.\n\n## Testing\n\nSee [docs/TESTING.md](./docs/TESTING.md) for Copilot Chat scenarios, manual JSON-RPC checks, and troubleshooting guidance.\n\nQuick validation prompt in Copilot Chat:\n\n```text\n@megalinter list available flavors\n```\n\n## Interactive VS Code Workflows\n\n### 1. Shift-Left Security Triage\n\n1. Ask Copilot to run a scan:\n\n```text\n@megalinter run megalinter on this repository with reports enabled\n```\n\n1. Parse the generated report:\n\n```text\n@megalinter parse the json report in megalinter-reports\n```\n\n1. Summarise and prioritise:\n\n```text\n@megalinter summarise error-level issues and top failing linters\n```\n\n1. Request security guidance:\n\n```text\n@megalinter generate security recommendations from the current report\n```\n\n### 2. Language-Specific Linter Onboarding\n\n1. Discover linters for your stack:\n\n```text\n@megalinter list python security linters with autofix support\n```\n\n1. Generate starter config:\n\n```text\n@megalinter create a megalinter config file with apply fixes set to none\n```\n\n1. Disable unsuitable linters and iterate.\n\n### 3. CI/CD Reporter Selection\n\n1. List reporters:\n\n```text\n@megalinter list available reporters\n```\n\n1. Select formats for your pipeline (for example SARIF for security tooling, Markdown for human-readable summaries).\n\n### Best Practices\n\n- Start with `megalinter_write_config`, then tighten rules in small steps.\n- Use `lintChangedFilesOnly` during fast feedback loops, and full scans in CI.\n- Keep `reportsPath` stable so downstream analysis tools always read from a known location.\n- Prefer `megalinter_get_issue_summary` for triage before requesting full report dumps.\n- Run `megalinter_get_security_recommendations` regularly to maintain shift-left coverage.\n\n## Additional Use Cases\n\n- **Pre-merge quality gates**: Run `megalinter_run` in PR checks and publish SARIF output.\n- **Repo onboarding packs**: Use `megalinter_get_linters` and `megalinter_list_flavors` to choose a baseline quickly.\n- **Security baseline reporting**: Combine `megalinter_parse_reports` and `megalinter_get_issue_summary` for recurring snapshots.\n- **Compliance evidence**: Store generated reports and summaries as CI artefacts for audit trails.\n- **Developer self-service**: Let contributors query available linters/reporters directly through Copilot Chat.\n\n## Related Projects\n\n### Official MegaLinter Resources\n\n- [MegaLinter website](https://megalinter.io/) — Comprehensive documentation and configuration guide\n- [MegaLinter repository](https://github.com/oxsecurity/megalinter) — Source code and issue tracking\n- [mega-linter-runner](https://registry.npmjs.org/mega-linter-runner) — npm package used by this server\n\n### CI/CD Integrations\n\n- [MegaLinter Azure DevOps Extension](https://github.com/downatthebottomofthemolehole/megalinter-ado) — ADO task by the same author (also sanctioned by Ox Security)\n- GitHub Actions: Use MegaLinter's official [GitHub Action](https://github.com/marketplace/actions/megalinter)\n- GitLab CI/CD: See [MegaLinter GitLab integration docs](https://raw.githubusercontent.com/oxsecurity/megalinter/main/docs/install-gitlab.md)\n- Jenkins, CircleCI, and others: Run MegaLinter via Docker in any CI/CD pipeline\n\n### Model Context Protocol\n\n- [MCP official documentation](https://modelcontextprotocol.io/)\n- [MCP TypeScript SDK](https://github.com/modelcontextprotocol/typescript-sdk)\n- [MCP servers registry](https://github.com/mcp)\n\n## Community and Contributing\n\n- [Contributing Guide](./CONTRIBUTING.md)\n- [Code of Conduct](./CODE_OF_CONDUCT.md)\n- [Security Policy](./SECURITY.md)\n- [Testing Guide](./docs/TESTING.md)\n- [Maintainer Guide](./docs/MAINTAINERS.md)\n\n## Attribution and License\n\nMaintained by Carl Dawson under the [Down At The Bottom Of The Mole Hole](https://github.com/downatthebottomofthemolehole) organization.\n\nLicensed under the MIT License. MegaLinter is managed by [Ox Security](https://www.ox.security/).\n",
  "bytes": 20814,
  "sha": "d6e322786ad1e7cd186638ddcb4de1e3f8becdf2805ed202ebc1e51838f8d041",
  "repo_slug": "downatthebottomofthemolehole/megalinter-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_downatthebottomofthemolehole_m_c0712b63/readme"
}