io.github.FinishKit/mcp
FinishKit MCP: scan GitHub repos for security vulnerabilities, deployment blockers, and quality
Open source Open in the app JSON README (API)
About
FinishKit MCP: scan GitHub repos for security vulnerabilities, deployment blockers, and quality
Details
- Kind
- MCP servers
- Topic
- Cloud & DevOps
- Publisher
- finishkit
- Origin
- official
- Category
- ferramentas
- Transport
- local
- Version
- 0.1.0
- Last push
- 2026-03-30T08:26:38Z
- Repository state
- ativo
- Language
- TypeScript
- License
- MIT
- Added
- 2026-08-29 03:01:54
- Updated
- 2026-08-29 03:01:54
- Origin id
io.github.FinishKit/mcp
README
# @finishkit/mcp
[](https://www.npmjs.com/package/@finishkit/mcp)
[](https://modelcontextprotocol.io)
[](https://opensource.org/licenses/MIT)
MCP server for FinishKit. Production readiness scanner for AI-built apps. Enables AI agents in Claude, Cursor, Windsurf, and VS Code to check if your code is ready to ship.
## What AI Agents Can Do
| Tool | Description |
|---|---|
| `scan_repo` | Check if your app is ready to ship. Triggers a production readiness scan and returns a prioritized finish plan. |
| `get_scan_status` | Check progress of a production readiness scan. Returns current phase and progress percentage. |
| `get_findings` | Get the production readiness report with prioritized findings blocking launch. |
| `get_patches` | Get auto-generated code patches that fix production readiness issues. |
| `list_projects` | List all repositories connected to FinishKit for production readiness scanning. |
| `create_project` | Get instructions to connect a new GitHub repository to FinishKit. |
| `request_intelligence_pack` | Request a production readiness analysis pack tailored to your technology stack. |
| `sync_findings` | Sync production readiness findings from a local analysis back to the FinishKit dashboard. |
| `finishkit_setup` | Set up FinishKit or check connection status. Creates a browser-based setup link if not connected. |
## Quick Start
No API key required to get started. The server starts in setup mode and guides you through connecting your account.
### Option A: Browser login (recommended)
```
npx @finishkit/mcp login
```
Opens your browser. Sign in with GitHub or Google. Your editor picks up the key automatically. No copy-paste, no config editing, no restart.
### Option B: Setup command
```
npx @finishkit/mcp setup
```
Auto-detects your editor and configures FinishKit. Or target a specific editor:
```
npx @finishkit/mcp setup --claude-code
npx @finishkit/mcp setup --cursor
npx @finishkit/mcp setup --windsurf
npx @finishkit/mcp setup --codex
npx @finishkit/mcp setup --vscode
```
Then ask your AI to scan your project. It will show a setup link if you haven't connected yet.
### Option C: Manual configuration
Add the following to your editor's MCP config file:
**Claude Desktop** (`~/.claude/claude_desktop_config.json`), **Cursor** (`~/.cursor/mcp.json`), **Windsurf** (`~/.codeium/windsurf/mcp_config.json`), **VS Code Copilot** (`.vscode/mcp.json`):
```json
{
"mcpServers": {
"finishkit": {
"command": "npx",
"args": ["-y", "@finishkit/mcp"],
"env": {
"FINISHKIT_API_KEY": "fk_live_your_key_here"
}
}
}
}
```
**Claude Code**:
```
claude mcp add finishkit -- npx -y @finishkit/mcp
```
Get an API key at [finishkit.app/activate](https://finishkit.app/activate).
## Works Without API Key
The server always starts, even without an API key configured. This means FinishKit tools always appear in your IDE.
When called without a key, the `finishkit_setup` tool creates a browser-based activation link. Click the link, sign in, and your editor picks up the key on the next tool call. No restart needed.
Two tools always work without a key:
- `finishkit_setup`: Creates a setup link and checks connection status.
- `create_project`: Returns instructions for connecting a repository through the FinishKit dashboard.
## Tools Reference
### `scan_repo` (Primary Tool)
Check if your app is ready to ship. Triggers a production readiness scan on a GitHub repository, analyzing security, deployment, stability, tests, and UI completeness. Returns a prioritized finish plan with all findings. Typically takes 2-8 minutes.
| Parameter | Type | Required | Description |
|---|---|---|---|
| `repo_owner` | string | Yes | GitHub org or username (e.g., `myorg`) |
| `repo_name` | string | Yes | Repository name without owner (e.g., `my-app`) |
| `run_type` | enum | No | `baseline` (default), `pr`, or `manual_patch` |
| `commit_sha` | string | No | Specific commit to scan; defaults to latest |
Returns: Finding counts by severity and category, human-readable summary, dashboard URL.
---
### `get_scan_status`
Check progress of a production readiness scan. Returns current phase and progress percentage.
| Parameter | Type | Required | Description |
|---|---|---|---|
| `run_id` | string | Yes | Run ID from `scan_repo` or the dashboard |
---
### `get_findings`
Get the production readiness report with prioritized findings blocking launch. Filter by category (blockers, security, deploy, stability, tests, ui) or minimum severity (critical, high, medium, low).
| Parameter | Type | Required | Description |
|---|---|---|---|
| `run_id` | string | Yes | Run ID of a completed scan |
| `category` | enum | No | `blockers`, `security`, `deploy`, `stability`, `tests`, `ui` |
| `severity` | enum | No | Minimum severity: `critical`, `high`, `medium`, `low` |
| `limit` | number | No | Max findings to return (1-100, default 50) |
---
### `get_patches`
Get auto-generated code patches that fix production readiness issues. Each patch includes a unified diff you can apply directly.
| Parameter | Type | Required | Description |
|---|---|---|---|
| `run_id` | string | Yes | Run ID of a completed scan |
---
### `list_projects`
List all repositories connected to FinishKit for production readiness scanning. No inputs required.
---
### `create_project`
Get instructions to connect a new GitHub repository to FinishKit for production readiness scanning. Works without an API key.
| Parameter | Type | Required | Description |
|---|---|---|---|
| `repo_owner` | string | Yes | GitHub org or username |
| `repo_name` | string | Yes | Repository name |
---
### `request_intelligence_pack`
Request a production readiness analysis pack tailored to your technology stack. Returns framework-specific rules, security advisories, and analysis prompts for local scanning.
| Parameter | Type | Required | Description |
|---|---|---|---|
| `framework` | string | Yes | Web framework (e.g., `nextjs`, `remix`, `vite`) |
| `language` | enum | Yes | `typescript` or `javascript` |
| `package_manager` | enum | Yes | `npm`, `pnpm`, `yarn`, or `bun` |
| `framework_version` | string | No | Framework version (e.g., `16.0.0`) |
| `integrations` | array | No | Detected integrations (e.g., `["supabase", "stripe"]`) |
| `dependencies` | object | No | Package versions for CVE lookup |
| `focus` | enum | No | `full` (default), `security`, `api`, `deploy`, `stability` |
---
### `sync_findings`
Sync production readiness findings from a local analysis back to the FinishKit dashboard. Creates a run record and inserts findings with deduplication.
| Parameter | Type | Required | Description |
|---|---|---|---|
| `project_name` | string | Yes | Project display name |
| `agent_id` | enum | Yes | `claude-code`, `cursor`, `codex`, `windsurf`, `custom` |
| `pack_id` | string | Yes | Intelligence pack ID used |
| `pack_version` | string | Yes | Intelligence pack version used |
| `started_at` | string | Yes | ISO timestamp when analysis started |
| `finished_at` | string | Yes | ISO timestamp when analysis finished |
| `detected_stack` | object | Yes | Detected stack metadata |
| `findings` | array | Yes | Array of findings from the analysis |
| `summary` | string | Yes | Human-readable summary |
---
### `finishkit_setup`
Set up FinishKit or check connection status. If not connected, creates a browser-based activation link. If connected, shows available tools. Always works, even without an API key. No inputs required.
## Resources Reference
| URI | Description |
|---|---|
| `finishkit://projects` | All projects as a JSON array |
| `finishkit://projects/{id}` | Single project details by ID |
| `finishkit://runs/{run_id}/findings` | All findings for a scan run |
| `finishkit://runs/{run_id}/events` | Full event log for a scan run |
## For AI Agents
If you are an AI agent with access to FinishKit MCP tools:
### Primary workflow: Scan a repository
1. Call `scan_repo` with the repository owner and name
2. The tool handles the full lifecycle (trigger, poll, wait for completion)
3. Returns finding counts by severity and category
4. Call `get_findings` for detailed findings list
5. Call `get_patches` for generated code fixes
### Example: User asks "scan myorg/myapp for security issues"
```
scan_repo({ repo_owner: "myorg", repo_name: "myapp", run_type: "baseline" })
```
Then:
```
get_findings({ run_id: "<from scan_repo response>", category: "security" })
```
### Handling common situations
- "FinishKit is not connected": Use `finishkit_setup` to get a browser activation link
- "Project not found": The repository must be connected at https://finishkit.app/dashboard first
- "Authentication failed": The API key is invalid. Run `npx @finishkit/mcp login` to re-authenticate
- "Plan limit reached": User needs to upgrade at https://finishkit.app/dashboard/settings
### Key facts
- `scan_repo` typically takes 2-8 minutes. It blocks until complete, no need to poll separately.
- Findings have severity: critical, high, medium, low
- Findings have category: blockers, security, deploy, stability, tests, ui
- Critical and high findings should be fixed before production deployment
## Authentication
The simplest way to authenticate is `npx @finishkit/mcp login`, which opens your browser and stores the key locally at `~/.finishkit/credentials`.
The MCP resolves API keys in this order:
1. `FINISHKIT_API_KEY` environment variable (highest priority)
2. `~/.finishkit/credentials` file (written by `login` or `setup --api-key`)
3. No key (setup mode with browser activation link)
To get an API key manually:
1. Visit [finishkit.app/activate](https://finishkit.app/activate)
2. Sign in with GitHub or Google
3. Copy the key (starts with `fk_live_`)
API keys authenticate via `Authorization: Bearer <key>` on every request. Keep your key secret and never commit it to source control.
## Requirements
- Node.js 18+
- A FinishKit account ([finishkit.app](https://finishkit.app)) for scanning (optional for setup)
- At least one repository connected to FinishKit via the GitHub App (for scanning)
## Registry Listings
- [Smithery](https://smithery.ai/server/@finishkit/mcp)
- [npm: @finishkit/mcp](https://www.npmjs.com/package/@finishkit/mcp)
## License
MIT - Copyright (c) 2026 FinishKit