HefestoAI
HefestoAI checks AI-generated code before you ship it.
Should I use this
Quality & Safety
Based on automated analysis of tool definitions and protocol compliance.
Context Cost
This is the approximate number of tokens consumed each time the server's tools are loaded into a model's context. Higher counts reduce the attention available for other tasks.
Install
One-Click Install
Add this to your `claude_desktop_config.json` file:
{
"mcpServers": {
"hefestoai": {
"url": "https://hefestoai.narapallc.com/api/mcp-protocol"
}
}
}Remote endpoints
https://hefestoai.narapallc.com/api/mcp-protocolstreamable-httpWhat it can do
Tool inventory
Tools (4)
🟢analyze(files, code, path, language, severity, ...)
Runs the open-source hefesto-ai engine (`hefesto analyze --no-config`, free tier) on the files you send to the hosted analyzer and returns its findings: rule id, severity, file, line, message and the SARIF hefestoFingerprint/v1 fingerprint (format "sarif" adds the full SARIF 2.1.0 log). Use it to check a file or snippet the user shares (for example "analyze this file") for security and quality issues before committing. Try it: {"code":"password = \"Sup3rS3cret!2026\""} returns a HARDCODED_SECRET finding. Minimum call: {"code": "<file contents>"}. Add path (e.g. "app/run.py") so the language comes from the extension; without path or language the language is inferred from the content, else python. For several files send files=[{"path", "content"}] instead. severity and format are optional. Covers Python, COBOL, the DevOps/IaC formats hefesto analyze routes, and TypeScript, JavaScript, Java, Go, Rust and C# through the multilang tree-sitter grammars (the first such request on a fresh server instance downloads the grammars and can take a few seconds longer). Limits: 20 files, 100 KB per file, 256 KB in total, 20 seconds, 10 requests per minute per IP, shared across server instances. No .hefesto.yaml is read. Files are deleted after the run; nothing is stored. For a whole repository, run `hefesto analyze .` locally.
Input Schema
{
"type": "object",
"properties": {
"files": {
"type": "array",
"maxItems": 20,
"description": "Several files to analyze. Used instead of code when present. path: relative POSIX, at most 200 characters and 8 levels; each segment is letters, digits, \"_\", \".\" or \"-\" and must not start with \"-\"; no \"..\", no absolute paths, no \".git\" or \".hefesto.yaml\". content: UTF-8 text, no NUL bytes, at most 100 KB.",
"items": {
"type": "object",
"additionalProperties": false,
"properties": {
"path": {
"type": "string",
"maxLength": 200,
"description": "Relative POSIX path. The extension picks the language."
},
"content": {
"type": "string",
"description": "UTF-8 source text. At most 100 KB. No NUL bytes."
}
},
"required": [
"path",
"content"
]
}
},
"code": {
"type": "string",
"description": "Contents of one file or snippet, used when files is omitted. At most 100 KB. This is the only argument a first call needs."
},
"path": {
"type": "string",
"description": "Optional file name for code, e.g. \"app/run.py\" or \"Dockerfile\". The extension picks the language. Same rules as files[].path. Ignored when files is set."
},
"language": {
"type": "string",
"enum": [
"python",
"py",
"cobol",
"yaml",
"yml",
"dockerfile",
"docker",
"terraform",
"hcl",
"shell",
"bash",
"sh",
"sql",
"javascript",
"js",
"typescript",
"ts",
"java",
"go",
"rust",
"csharp",
"c#"
],
"description": "Optional language of code. Ignored when files or path is set. When omitted it is inferred from the content (python if unsure). An unknown language is rejected; send path or files instead."
},
"severity": {
"type": "string",
"enum": [
"LOW",
"MEDIUM",
"HIGH",
"CRITICAL"
],
"description": "Optional minimum severity to report (default LOW)."
},
"format": {
"type": "string",
"enum": [
"json",
"sarif"
],
"description": "Optional. json (default): findings only; sarif: also the full SARIF 2.1.0 log."
}
},
"additionalProperties": false,
"description": "Send code (one file; path and language optional) or files (several). Everything else is optional.",
"examples": [
{
"code": "import sqlite3\n\npassword = \"Sup3rS3cret!2026\"\n\n\ndef find_user(db, name):\n return db.execute(\"SELECT * FROM users WHERE name = '\" + name + \"'\")\n"
},
{
"code": "import sqlite3\n\npassword = \"Sup3rS3cret!2026\"\n\n\ndef find_user(db, name):\n return db.execute(\"SELECT * FROM users WHERE name = '\" + name + \"'\")\n",
"path": "app/users.py",
"severity": "MEDIUM"
},
{
"files": [
{
"path": "src/users.py",
"content": "import sqlite3\n\npassword = \"Sup3rS3cret!2026\"\n\n\ndef find_user(db, name):\n return db.execute(\"SELECT * FROM users WHERE name = '\" + name + \"'\")\n"
}
]
}
]
}Output Schema
{
"type": "object",
"properties": {
"ok": {
"type": "boolean",
"description": "true when the engine returned analyzed: true."
},
"analysis": {
"type": "object",
"description": "Analyzer JSON. The content text is a one-line summary plus this object.",
"additionalProperties": true,
"required": [
"analyzed",
"summary",
"findings",
"stored"
],
"properties": {
"analyzed": {
"type": "boolean",
"description": "true on this branch."
},
"stored": {
"type": "boolean",
"description": "false. Nothing is stored."
},
"summary": {
"type": "object",
"additionalProperties": true,
"properties": {
"files_received": {
"type": "number"
},
"files_analyzed": {
"type": "number"
},
"total_issues": {
"type": "number"
},
"critical": {
"type": "number"
},
"high": {
"type": "number"
},
"medium": {
"type": "number"
},
"low": {
"type": "number"
}
}
},
"findings": {
"type": "array",
"items": {
"type": "object",
"additionalProperties": true
}
},
"engine": {
"type": "object",
"additionalProperties": true
}
}
},
"error": {
"type": "string",
"description": "Failure code when ok is false. invalid_json when the analyzer body was not JSON."
},
"message": {
"type": "string",
"description": "Same string as content[0].text when ok is false."
}
},
"required": [
"ok"
],
"additionalProperties": false,
"description": "ok true carries the hosted analyzer body in analysis. ok false carries error and message. On success the content text is the summary and the analyzer JSON. On failure the content text is the error sentence only.",
"allOf": [
{
"if": {
"type": "object",
"properties": {
"ok": {
"const": true
}
},
"required": [
"ok"
]
},
"then": {
"required": [
"ok",
"analysis"
]
}
},
{
"if": {
"type": "object",
"properties": {
"ok": {
"const": false
}
},
"required": [
"ok"
]
},
"then": {
"required": [
"ok",
"error",
"message"
]
}
}
]
}🟢pricing
Return current HefestoAI prices (Free $0, PRO $8/month per user, OMEGA $19/month). Use it when the user asks what HefestoAI costs. Static text. Does not look up or change a subscription. No parameters: call it with {}.
Input Schema
{
"type": "object",
"additionalProperties": false
}Output Schema
{
"type": "object",
"properties": {
"free": {
"type": "string",
"description": "Free tier, $0/month."
},
"pro": {
"type": "string",
"description": "PRO $8/month per user."
},
"omega": {
"type": "string",
"description": "OMEGA $19/month."
},
"checkout": {
"type": "string",
"description": "Checkout URL."
}
},
"required": [
"free",
"pro",
"omega",
"checkout"
],
"additionalProperties": false,
"description": "Current HefestoAI prices. Static. The content text is this object as JSON."
}🟢install
Return install commands for the open-source package (pip install hefesto-ai, Python 3.11+). Use it when the user wants to run HefestoAI locally, in a pre-commit hook or on a whole repository. Does not install anything on the caller's machine. No parameters: call it with {}.
Input Schema
{
"type": "object",
"additionalProperties": false
}Output Schema
{
"type": "object",
"properties": {
"command": {
"type": "string",
"description": "pip install command."
},
"requires": {
"type": "string",
"description": "Python version required."
},
"steps": {
"type": "array",
"description": "Quickstart steps, in order.",
"items": {
"type": "string"
}
}
},
"required": [
"command",
"requires",
"steps"
],
"additionalProperties": false,
"description": "Install commands for the open-source package. Does not install anything. The content text is the same prose as before."
}🟢compare(tool)
Return a short static comparison of HefestoAI with one named tool. Use it when the user asks how HefestoAI differs from another scanner. No live lookup and no code is inspected. All arguments are optional: {} compares with sonarqube. Known values: sonarqube (the default when tool is omitted), snyk, github-advanced-security, semgrep, claude-code-security, coderabbit, qodo. Any other value is answered as sonarqube.
Input Schema
{
"type": "object",
"properties": {
"tool": {
"type": "string",
"description": "Optional. Tool to compare with: sonarqube (default), snyk, github-advanced-security, semgrep, claude-code-security, coderabbit, or qodo."
}
},
"additionalProperties": false,
"examples": [
{},
{
"tool": "semgrep"
}
]
}Output Schema
{
"type": "object",
"properties": {
"tool": {
"type": "string",
"description": "sonarqube, snyk, github-advanced-security, semgrep, claude-code-security, coderabbit, or qodo."
},
"text": {
"type": "string",
"description": "Comparison paragraph. Same string as content[0].text."
}
},
"required": [
"tool",
"text"
],
"additionalProperties": false,
"description": "Static comparison. tool is the known value actually answered (unknown names are sonarqube). text is the content text."
}Community
Evidence