MCP server for fixing static analysis issues from SARIF reports with AI agents
Sheriff-MCP is a Model Context Protocol (MCP) server designed to fix static analysis issues identified in SARIF reports using AI agents. It processes SARIF data to guide automated corrections within a Java-focused static-analysis workflow, integrating with code-quality tooling and MCP ecosystems.
🛠️ Key Features
AI-assisted remediation of static analysis issues from SARIF outputs
MCP server paradigm for modular model context coordination
Java-centric focus with code-quality tooling compatibility
Clear readme excerpt-backed project intent and maintainers
🚀 Use Cases
Automating fixes for SARIF-reported defects
Integrating AI agents into static-analysis pipelines
Enhancing MCP-based tooling with contextual remediation
⚡ Developer Benefits
Sharable MCP server for issue context in AI-assisted repairs
Open-source repository structure and CI indicators
Documentation-oriented design with project metadata
⚠️ Limitations
Details in readme excerpt indicate scope is SARIF-driven remediation; broader MCP capabilities not described
Operational specifics (APIs, data formats, deployment) are not provided in the excerpt
See the Agent Setup Guide for client-specific instructions and recommended agent instructions.
3. Use It
code
1. Run static analysis → qodana scan
2. Load into Sheriff → sheriff load target="results.sarif"
3. Get next file's issues → sheriff next
4. Fix all issues in file → [edit the code]
5. Mark as done → sheriff done fps=[...] status="fixed"
6. Repeat 3-5 → until remaining = 0
Sheriff exposes a single sheriff tool with 7 actions: load, next, done, progress, summary, reopen, and export. See the Tool Reference for full documentation.
Example Session
code
User: "Fix all ConstantValue issues in my codebase"
Agent: sheriff load target="build/qodana/qodana.sarif.json"
→ 136 total issues, 22 ConstantValue, 15 unused...
Agent: sheriff next scope={rule: "ConstantValue"}
→ 3 issues in Service.java with code snippets
Agent: [reads Service.java, fixes all 3 issues]
Agent: sheriff done fps=["88d32cab35478753", "ab1c2d3e12345678", "f9e8d7c6a1b2c3d4"] status="fixed"
→ 3 marked fixed, 19 remaining
... continues until remaining = 0
Security
All release artifacts are signed with Sigstore for supply chain security.
