{
  "markdown": "# @finishkit/mcp\n\n[![npm version](https://img.shields.io/npm/v/@finishkit/mcp)](https://www.npmjs.com/package/@finishkit/mcp)\n[![MCP Compatible](https://img.shields.io/badge/MCP-Compatible-blue)](https://modelcontextprotocol.io)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n\nMCP server for FinishKit. Production readiness scanner for AI-built apps. Enables AI agents in Claude, Cursor, Windsurf, and VS Code to check if your code is ready to ship.\n\n## What AI Agents Can Do\n\n| Tool | Description |\n|---|---|\n| `scan_repo` | Check if your app is ready to ship. Triggers a production readiness scan and returns a prioritized finish plan. |\n| `get_scan_status` | Check progress of a production readiness scan. Returns current phase and progress percentage. |\n| `get_findings` | Get the production readiness report with prioritized findings blocking launch. |\n| `get_patches` | Get auto-generated code patches that fix production readiness issues. |\n| `list_projects` | List all repositories connected to FinishKit for production readiness scanning. |\n| `create_project` | Get instructions to connect a new GitHub repository to FinishKit. |\n| `request_intelligence_pack` | Request a production readiness analysis pack tailored to your technology stack. |\n| `sync_findings` | Sync production readiness findings from a local analysis back to the FinishKit dashboard. |\n| `finishkit_setup` | Set up FinishKit or check connection status. Creates a browser-based setup link if not connected. |\n\n## Quick Start\n\nNo API key required to get started. The server starts in setup mode and guides you through connecting your account.\n\n### Option A: Browser login (recommended)\n\n```\nnpx @finishkit/mcp login\n```\n\nOpens your browser. Sign in with GitHub or Google. Your editor picks up the key automatically. No copy-paste, no config editing, no restart.\n\n### Option B: Setup command\n\n```\nnpx @finishkit/mcp setup\n```\n\nAuto-detects your editor and configures FinishKit. Or target a specific editor:\n\n```\nnpx @finishkit/mcp setup --claude-code\nnpx @finishkit/mcp setup --cursor\nnpx @finishkit/mcp setup --windsurf\nnpx @finishkit/mcp setup --codex\nnpx @finishkit/mcp setup --vscode\n```\n\nThen ask your AI to scan your project. It will show a setup link if you haven't connected yet.\n\n### Option C: Manual configuration\n\nAdd the following to your editor's MCP config file:\n\n**Claude Desktop** (`~/.claude/claude_desktop_config.json`), **Cursor** (`~/.cursor/mcp.json`), **Windsurf** (`~/.codeium/windsurf/mcp_config.json`), **VS Code Copilot** (`.vscode/mcp.json`):\n\n```json\n{\n  \"mcpServers\": {\n    \"finishkit\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@finishkit/mcp\"],\n      \"env\": {\n        \"FINISHKIT_API_KEY\": \"fk_live_your_key_here\"\n      }\n    }\n  }\n}\n```\n\n**Claude Code**:\n\n```\nclaude mcp add finishkit -- npx -y @finishkit/mcp\n```\n\nGet an API key at [finishkit.app/activate](https://finishkit.app/activate).\n\n## Works Without API Key\n\nThe server always starts, even without an API key configured. This means FinishKit tools always appear in your IDE.\n\nWhen called without a key, the `finishkit_setup` tool creates a browser-based activation link. Click the link, sign in, and your editor picks up the key on the next tool call. No restart needed.\n\nTwo tools always work without a key:\n\n- `finishkit_setup`: Creates a setup link and checks connection status.\n- `create_project`: Returns instructions for connecting a repository through the FinishKit dashboard.\n\n## Tools Reference\n\n### `scan_repo` (Primary Tool)\n\nCheck if your app is ready to ship. Triggers a production readiness scan on a GitHub repository, analyzing security, deployment, stability, tests, and UI completeness. Returns a prioritized finish plan with all findings. Typically takes 2-8 minutes.\n\n| Parameter | Type | Required | Description |\n|---|---|---|---|\n| `repo_owner` | string | Yes | GitHub org or username (e.g., `myorg`) |\n| `repo_name` | string | Yes | Repository name without owner (e.g., `my-app`) |\n| `run_type` | enum | No | `baseline` (default), `pr`, or `manual_patch` |\n| `commit_sha` | string | No | Specific commit to scan; defaults to latest |\n\nReturns: Finding counts by severity and category, human-readable summary, dashboard URL.\n\n---\n\n### `get_scan_status`\n\nCheck progress of a production readiness scan. Returns current phase and progress percentage.\n\n| Parameter | Type | Required | Description |\n|---|---|---|---|\n| `run_id` | string | Yes | Run ID from `scan_repo` or the dashboard |\n\n---\n\n### `get_findings`\n\nGet the production readiness report with prioritized findings blocking launch. Filter by category (blockers, security, deploy, stability, tests, ui) or minimum severity (critical, high, medium, low).\n\n| Parameter | Type | Required | Description |\n|---|---|---|---|\n| `run_id` | string | Yes | Run ID of a completed scan |\n| `category` | enum | No | `blockers`, `security`, `deploy`, `stability`, `tests`, `ui` |\n| `severity` | enum | No | Minimum severity: `critical`, `high`, `medium`, `low` |\n| `limit` | number | No | Max findings to return (1-100, default 50) |\n\n---\n\n### `get_patches`\n\nGet auto-generated code patches that fix production readiness issues. Each patch includes a unified diff you can apply directly.\n\n| Parameter | Type | Required | Description |\n|---|---|---|---|\n| `run_id` | string | Yes | Run ID of a completed scan |\n\n---\n\n### `list_projects`\n\nList all repositories connected to FinishKit for production readiness scanning. No inputs required.\n\n---\n\n### `create_project`\n\nGet instructions to connect a new GitHub repository to FinishKit for production readiness scanning. Works without an API key.\n\n| Parameter | Type | Required | Description |\n|---|---|---|---|\n| `repo_owner` | string | Yes | GitHub org or username |\n| `repo_name` | string | Yes | Repository name |\n\n---\n\n### `request_intelligence_pack`\n\nRequest a production readiness analysis pack tailored to your technology stack. Returns framework-specific rules, security advisories, and analysis prompts for local scanning.\n\n| Parameter | Type | Required | Description |\n|---|---|---|---|\n| `framework` | string | Yes | Web framework (e.g., `nextjs`, `remix`, `vite`) |\n| `language` | enum | Yes | `typescript` or `javascript` |\n| `package_manager` | enum | Yes | `npm`, `pnpm`, `yarn`, or `bun` |\n| `framework_version` | string | No | Framework version (e.g., `16.0.0`) |\n| `integrations` | array | No | Detected integrations (e.g., `[\"supabase\", \"stripe\"]`) |\n| `dependencies` | object | No | Package versions for CVE lookup |\n| `focus` | enum | No | `full` (default), `security`, `api`, `deploy`, `stability` |\n\n---\n\n### `sync_findings`\n\nSync production readiness findings from a local analysis back to the FinishKit dashboard. Creates a run record and inserts findings with deduplication.\n\n| Parameter | Type | Required | Description |\n|---|---|---|---|\n| `project_name` | string | Yes | Project display name |\n| `agent_id` | enum | Yes | `claude-code`, `cursor`, `codex`, `windsurf`, `custom` |\n| `pack_id` | string | Yes | Intelligence pack ID used |\n| `pack_version` | string | Yes | Intelligence pack version used |\n| `started_at` | string | Yes | ISO timestamp when analysis started |\n| `finished_at` | string | Yes | ISO timestamp when analysis finished |\n| `detected_stack` | object | Yes | Detected stack metadata |\n| `findings` | array | Yes | Array of findings from the analysis |\n| `summary` | string | Yes | Human-readable summary |\n\n---\n\n### `finishkit_setup`\n\nSet up FinishKit or check connection status. If not connected, creates a browser-based activation link. If connected, shows available tools. Always works, even without an API key. No inputs required.\n\n## Resources Reference\n\n| URI | Description |\n|---|---|\n| `finishkit://projects` | All projects as a JSON array |\n| `finishkit://projects/{id}` | Single project details by ID |\n| `finishkit://runs/{run_id}/findings` | All findings for a scan run |\n| `finishkit://runs/{run_id}/events` | Full event log for a scan run |\n\n## For AI Agents\n\nIf you are an AI agent with access to FinishKit MCP tools:\n\n### Primary workflow: Scan a repository\n\n1. Call `scan_repo` with the repository owner and name\n2. The tool handles the full lifecycle (trigger, poll, wait for completion)\n3. Returns finding counts by severity and category\n4. Call `get_findings` for detailed findings list\n5. Call `get_patches` for generated code fixes\n\n### Example: User asks \"scan myorg/myapp for security issues\"\n\n```\nscan_repo({ repo_owner: \"myorg\", repo_name: \"myapp\", run_type: \"baseline\" })\n```\n\nThen:\n\n```\nget_findings({ run_id: \"<from scan_repo response>\", category: \"security\" })\n```\n\n### Handling common situations\n\n- \"FinishKit is not connected\": Use `finishkit_setup` to get a browser activation link\n- \"Project not found\": The repository must be connected at https://finishkit.app/dashboard first\n- \"Authentication failed\": The API key is invalid. Run `npx @finishkit/mcp login` to re-authenticate\n- \"Plan limit reached\": User needs to upgrade at https://finishkit.app/dashboard/settings\n\n### Key facts\n\n- `scan_repo` typically takes 2-8 minutes. It blocks until complete, no need to poll separately.\n- Findings have severity: critical, high, medium, low\n- Findings have category: blockers, security, deploy, stability, tests, ui\n- Critical and high findings should be fixed before production deployment\n\n## Authentication\n\nThe simplest way to authenticate is `npx @finishkit/mcp login`, which opens your browser and stores the key locally at `~/.finishkit/credentials`.\n\nThe MCP resolves API keys in this order:\n1. `FINISHKIT_API_KEY` environment variable (highest priority)\n2. `~/.finishkit/credentials` file (written by `login` or `setup --api-key`)\n3. No key (setup mode with browser activation link)\n\nTo get an API key manually:\n1. Visit [finishkit.app/activate](https://finishkit.app/activate)\n2. Sign in with GitHub or Google\n3. Copy the key (starts with `fk_live_`)\n\nAPI keys authenticate via `Authorization: Bearer <key>` on every request. Keep your key secret and never commit it to source control.\n\n## Requirements\n\n- Node.js 18+\n- A FinishKit account ([finishkit.app](https://finishkit.app)) for scanning (optional for setup)\n- At least one repository connected to FinishKit via the GitHub App (for scanning)\n\n## Registry Listings\n\n- [Smithery](https://smithery.ai/server/@finishkit/mcp)\n- [npm: @finishkit/mcp](https://www.npmjs.com/package/@finishkit/mcp)\n\n## License\n\nMIT - Copyright (c) 2026 FinishKit\n",
  "bytes": 10526,
  "sha": "028c60529d4ee7541b5deb62e9a6dc30756c3b780d6cc48fc4770aeec9de72e5",
  "repo_slug": "finishkit/mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_finishkit_mcp_6a7cbdc8/readme"
}