{
  "markdown": "<!-- mcp-name: io.github.ryansmith4/sheriff-mcp -->\n# Sheriff-MCP\n\n[![CI](https://github.com/ryansmith4/sheriff-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/ryansmith4/sheriff-mcp/actions/workflows/ci.yml)\n[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/ryansmith4/sheriff-mcp/badge)](https://scorecard.dev/viewer/?uri=github.com/ryansmith4/sheriff-mcp)\n[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/12244/badge)](https://www.bestpractices.dev/projects/12244)\n[![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)\n[![Java 21+](https://img.shields.io/badge/Java-21%2B-blue.svg)](https://openjdk.org/projects/jdk/21/)\n[![GitHub release](https://img.shields.io/github/v/release/ryansmith4/sheriff-mcp)](https://github.com/ryansmith4/sheriff-mcp/releases)\n\nSheriff is an MCP server that helps AI agents efficiently fix static analysis issues from SARIF reports.\n\n**[Documentation](https://ryansmith4.github.io/sheriff-mcp/)** | **[Installation](https://ryansmith4.github.io/sheriff-mcp/getting-started/installation/)** | **[Tool Reference](https://ryansmith4.github.io/sheriff-mcp/tools/)**\n\n---\n\n## Why Sheriff?\n\nAI agents struggle with large static analysis reports:\n- **Context overload** - 100+ issues overwhelm context windows\n- **Lost progress** - Work is lost on context compaction or session restart\n- **Inefficient navigation** - No batching means jumping between files repeatedly\n\nSheriff solves this by acting as a work queue manager:\n- **Intelligent batching** - Issues grouped by file for efficient fixing\n- **Persistent progress** - State survives compaction, restarts, and agent switches\n- **Scope filtering** - Focus on specific rules, severities, or file patterns\n- **Compact responses** - Minimal context usage with abbreviated field names\n\n### Supported Static Analysis Tools\n\nSheriff works with any tool that produces [SARIF](https://sarifweb.azurewebsites.net/) output:\n\n| Tool | Language | SARIF Command |\n|------|----------|---------------|\n| **Qodana** | Java/Kotlin/JS/Python | `qodana scan` |\n| **Semgrep** | Multi-language | `semgrep --sarif -o results.sarif` |\n| **ESLint** | JavaScript/TypeScript | `eslint --format @microsoft/sarif` |\n| **CodeQL** | Multi-language | Built-in SARIF output |\n| **SpotBugs** | Java | `spotbugs -sarif` |\n| **Bandit** | Python | `bandit -f sarif` |\n| **Checkov** | IaC | `checkov -o sarif` |\n| **Trivy** | Container/IaC | `trivy --format sarif` |\n| **SonarQube** | Multi-language | Built-in SARIF export |\n\n---\n\n## Quick Start\n\n### 1. Install\n\n<details>\n<summary><strong>JAR (All Platforms)</strong> — Requires Java 21+</summary>\n\nDownload `sheriff-mcp-1.0.2-all.jar` from [Releases](https://github.com/ryansmith4/sheriff-mcp/releases).\n\n</details>\n\n<details>\n<summary><strong>Docker</strong></summary>\n\n```bash\ndocker pull ghcr.io/ryansmith4/sheriff-mcp:latest\n```\n\n</details>\n\n<details>\n<summary><strong>MCP Registry</strong></summary>\n\nClients that support the [MCP Registry](https://registry.modelcontextprotocol.io/) can install directly by name: `io.github.ryansmith4/sheriff-mcp`\n\n</details>\n\nSee the [Installation Guide](https://ryansmith4.github.io/sheriff-mcp/getting-started/installation/) for full details.\n\n### 2. Configure Your MCP Client\n\nAdd Sheriff to your MCP client (Claude Code, Cursor, ChatGPT Desktop, etc.):\n\n```json\n{\n  \"mcpServers\": {\n    \"sheriff\": {\n      \"command\": \"java\",\n      \"args\": [\"-jar\", \"/path/to/sheriff-mcp-1.0.2-all.jar\", \"start\"]\n    }\n  }\n}\n```\n\nOr with Docker:\n\n```json\n{\n  \"mcpServers\": {\n    \"sheriff\": {\n      \"command\": \"docker\",\n      \"args\": [\"run\", \"-i\", \"--rm\", \"-v\", \".:/data\", \"ghcr.io/ryansmith4/sheriff-mcp:latest\"]\n    }\n  }\n}\n```\n\nSee the [Agent Setup Guide](https://ryansmith4.github.io/sheriff-mcp/getting-started/agent-setup/) for client-specific instructions and recommended agent instructions.\n\n### 3. Use It\n\n```\n1. Run static analysis     →  qodana scan\n2. Load into Sheriff       →  sheriff load target=\"results.sarif\"\n3. Get next file's issues  →  sheriff next\n4. Fix all issues in file  →  [edit the code]\n5. Mark as done            →  sheriff done fps=[...] status=\"fixed\"\n6. Repeat 3-5              →  until remaining = 0\n```\n\nSheriff exposes a single `sheriff` tool with 7 actions: `load`, `next`, `done`, `progress`, `summary`, `reopen`, and `export`. See the [Tool Reference](https://ryansmith4.github.io/sheriff-mcp/tools/) for full documentation.\n\n---\n\n## Example Session\n\n```\nUser: \"Fix all ConstantValue issues in my codebase\"\n\nAgent: sheriff load target=\"build/qodana/qodana.sarif.json\"\n       → 136 total issues, 22 ConstantValue, 15 unused...\n\nAgent: sheriff next scope={rule: \"ConstantValue\"}\n       → 3 issues in Service.java with code snippets\n\nAgent: [reads Service.java, fixes all 3 issues]\n\nAgent: sheriff done fps=[\"88d32cab35478753\", \"ab1c2d3e12345678\", \"f9e8d7c6a1b2c3d4\"] status=\"fixed\"\n       → 3 marked fixed, 19 remaining\n\n       ... continues until remaining = 0\n```\n\n---\n\n## Security\n\nAll release artifacts are signed with [Sigstore](https://sigstore.dev/) for supply chain security.\n\n**Verify JAR:**\n```bash\nVERSION=1.0.2\ncosign verify-blob \\\n  --signature sheriff-mcp-${VERSION}-all.jar.sig \\\n  --certificate sheriff-mcp-${VERSION}-all.jar.pem \\\n  --certificate-identity-regexp \"https://github.com/ryansmith4/sheriff-mcp\" \\\n  --certificate-oidc-issuer \"https://token.actions.githubusercontent.com\" \\\n  sheriff-mcp-${VERSION}-all.jar\n```\n\n**Verify Docker image:**\n```bash\ncosign verify ghcr.io/ryansmith4/sheriff-mcp:latest \\\n  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \\\n  --certificate-identity-regexp=\"github.com/ryansmith4/sheriff-mcp\"\n```\n\nSee [SECURITY.md](SECURITY.md) for our security policy.\n\n---\n\n## Contributing\n\nContributions welcome! See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.\n\n## License\n\nApache License 2.0 - see [LICENSE](LICENSE)\n",
  "bytes": 5955,
  "sha": "3470590870a6aa851500f1512a0ff2e6519c20b97ea0235bcd76b41e7cbe2917",
  "repo_slug": "ryansmith4/sheriff-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_ryansmith4_sheriff_mcp_8ffea570/readme"
}