MCP server for fixing static analysis issues from SARIF reports with AI agents
io.github.ryansmith4/sheriff-mcp MCP Server
Sheriff-MCP is an MCP server for fixing static analysis issues from SARIF reports with AI agents. It targets code-quality workflows by ingesting SARIF output and using agent-based processing to address reported findings.
🛠️ Key Features
MCP server focused on static analysis remediation
Works with SARIF reports
Designed for AI agents to fix reported issues
🚀 Use Cases
Processing SARIF results from static analysis tools
Automating remediation steps using AI agents
Integrating code-quality fixes into developer toolchains
⚡ Developer Benefits
Standard SARIF input format for static-analysis findings
MCP compatibility for agent-driven workflows
Project categorization includes ai, devtools, java, mcp, mcp-server, sarif, and code-quality
⚠️ Limitations
Described only at a high level (no explicit tool list or operational details provided in the available data).
See the Agent Setup Guide for client-specific instructions and recommended agent instructions.
3. Use It
code
1. Run static analysis → qodana scan
2. Load into Sheriff → sheriff load target="results.sarif"
3. Get next file's issues → sheriff next
4. Fix all issues in file → [edit the code]
5. Mark as done → sheriff done fps=[...] status="fixed"
6. Repeat 3-5 → until remaining = 0
Sheriff exposes a single sheriff tool with 7 actions: load, next, done, progress, summary, reopen, and export. See the Tool Reference for full documentation.
Example Session
code
User: "Fix all ConstantValue issues in my codebase"
Agent: sheriff load target="build/qodana/qodana.sarif.json"
→ 136 total issues, 22 ConstantValue, 15 unused...
Agent: sheriff next scope={rule: "ConstantValue"}
→ 3 issues in Service.java with code snippets
Agent: [reads Service.java, fixes all 3 issues]
Agent: sheriff done fps=["88d32cab35478753", "ab1c2d3e12345678", "f9e8d7c6a1b2c3d4"] status="fixed"
→ 3 marked fixed, 19 remaining
... continues until remaining = 0
Security
All release artifacts are signed with Sigstore for supply chain security.
