@finishkit/mcp

MCP server for FinishKit. Enables AI agents in Cursor, Claude Desktop, Windsurf, and VS Code Copilot to scan GitHub repositories for security vulnerabilities, deployment blockers, and code quality issues.

What AI Agents Can Do

Tool	Description	Primary Use Case
scan_repo	Trigger a full scan and wait for completion	Check if a repo is production-ready
get_scan_status	Check progress of an in-flight scan	Poll a previously triggered scan
get_findings	Retrieve detailed findings filtered by category or severity	Review security issues, blockers, etc.
get_patches	Retrieve auto-generated code patches with unified diffs	Apply FinishKit's suggested fixes
list_projects	List all connected repositories and last scan dates	Discover which repos are configured
create_project	Get guided instructions to link a new GitHub repo	Onboard a new repository

Quick Start

Get an API key at finishkit.app/dashboard/settings?tab=developer, then configure your MCP client.

Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "finishkit": {
      "command": "npx",
      "args": ["-y", "@finishkit/mcp"],
      "env": {
        "FINISHKIT_API_KEY": "fk_live_..."
      }
    }
  }
}

Cursor

Add to .cursor/mcp.json in your project root (or ~/.cursor/mcp.json globally):

{
  "finishkit": {
    "command": "npx",
    "args": ["-y", "@finishkit/mcp"],
    "env": {
      "FINISHKIT_API_KEY": "fk_live_..."
    }
  }
}

Windsurf

Edit ~/.codeium/windsurf/mcp_config.json:

{
  "finishkit": {
    "command": "npx",
    "args": ["-y", "@finishkit/mcp"],
    "env": {
      "FINISHKIT_API_KEY": "fk_live_..."
    }
  }
}

VS Code Copilot Chat

Add to .vscode/mcp.json in your workspace (or user settings):

{
  "servers": {
    "finishkit": {
      "command": "npx",
      "args": ["-y", "@finishkit/mcp"],
      "env": {
        "FINISHKIT_API_KEY": "${env:FINISHKIT_API_KEY}"
      }
    }
  }
}

After configuring, restart your AI client and try: "Scan myorg/my-app for security issues"

Tools Reference

scan_repo (Primary Tool)

Scan a GitHub repository with FinishKit to detect security vulnerabilities, deployment blockers, stability issues, test coverage gaps, and UI problems. This is the primary tool - it handles the full scan lifecycle: finds the project, triggers a new scan run, polls until completion (typically 2-8 minutes), and returns a comprehensive summary of all findings.

Parameter	Type	Required	Description
repo_owner	string	Yes	GitHub org or username (e.g., myorg)
repo_name	string	Yes	Repository name without owner (e.g., my-app)
run_type	enum	No	baseline (default), pr, or manual_patch
commit_sha	string	No	Specific commit to scan; defaults to latest

Returns: Finding counts by severity and category, human-readable summary, dashboard URL.

---

get_scan_status

Check the current status of an in-progress FinishKit scan. Returns the scan phase, progress percentage, and estimated time remaining. Use this to check a scan triggered in a previous session.

Parameter	Type	Required	Description
run_id	string	Yes	Run ID from scan_repo or the dashboard

---

get_findings

Retrieve detailed findings from a completed scan. Each finding includes file path, line numbers, severity, category, detailed explanation, and suggested fix.

Parameter	Type	Required	Description
run_id	string	Yes	Run ID of a completed scan
category	enum	No	blockers, security, deploy, stability, tests, ui
severity	enum	No	Minimum severity: critical, high, medium, low
limit	number	No	Max findings to return (1-100, default 50)

---

get_patches

Retrieve automatically generated code patches from a completed scan. Each patch includes the unified diff, application status, and verification status.

Parameter	Type	Required	Description
run_id	string	Yes	Run ID of a completed scan

---

list_projects

List all FinishKit projects connected to your account, with their last scan date and repository details. No inputs required.

---

create_project

Get guided instructions for creating a new FinishKit project by linking a GitHub repository. Directs to the dashboard for GitHub App installation.

Parameter	Type	Required	Description
repo_owner	string	Yes	GitHub org or username
repo_name	string	Yes	Repository name

Resources Reference

URI	Description
finishkit://projects	All projects as a JSON array
finishkit://projects/{id}	Single project details by ID
finishkit://runs/{run_id}/findings	All findings for a scan run
finishkit://runs/{run_id}/events	Full event log for a scan run

For AI Agents

If you are an AI agent with access to FinishKit MCP tools:

Primary workflow: Scan a repository

1. Call scan_repo with the repository owner and name
2. The tool handles the full lifecycle (trigger, poll, wait for completion)
3. Returns finding counts by severity and category
4. Call get_findings for detailed findings list
5. Call get_patches for generated code fixes

Example: User asks "scan myorg/myapp for security issues"

scan_repo({ repo_owner: "myorg", repo_name: "myapp", run_type: "baseline" })

Then:

get_findings({ run_id: "<from scan_repo response>", category: "security" })

Handling common errors

• "Project not found" - The repository must be connected at https://finishkit.app/dashboard first
• "Authentication failed" - The FINISHKIT_API_KEY env var is missing or invalid
• "Plan limit reached" - User needs to upgrade at https://finishkit.app/dashboard/settings

Key facts

• scan_repo typically takes 2-8 minutes - it blocks until complete, no need to poll separately
• Findings have severity: critical, high, medium, low
• Findings have category: blockers, security, deploy, stability, tests, ui
• Critical and high findings should be fixed before production deployment

Authentication

Set the FINISHKIT_API_KEY environment variable with your API key:

FINISHKIT_API_KEY=fk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

To get an API key:

1. Go to finishkit.app/dashboard/settings?tab=developer
2. Generate a new API key
3. Copy the key (it starts with fk_live_)

API keys authenticate via Authorization: Bearer <key> on every request. Keep your key secret - never commit it to source control.

Requirements

• Node.js 18+
• A FinishKit account (finishkit.app)
• At least one repository connected to FinishKit via the GitHub App

Registry Listings

• Smithery - Smithery MCP registry
• npm: @finishkit/mcp - npm package

License

MIT - Copyright (c) 2026 FinishKit