CodeDx SRM MCP Server

Remote (Streamable HTTP) MCP server for CodeDx Software Risk Manager (SRM).

• Streamable HTTP MCP endpoint: /mcp
• MCP Server Card: /.well-known/mcp/server-card.json
• OAuth2-compatible flow for MCP clients (/.well-known/*, /register, /authorize, /token)
• Stateless by design: bearer tokens encrypt upstream credentials (no DB)

Documentation

• Upstream API + auth model: docs/API.md
• Tool catalog + usage examples: docs/TOOLS.md

Configuration

Environment variables:

• PORT (default: 9090)
• MCP_SERVER_URL (default: http://localhost:<PORT>)
• MCP_AUTH_SECRET (recommended): base64url-encoded 32-byte key (no padding)
  • If omitted, the server will generate an ephemeral secret at startup and previously issued tokens will become invalid after a restart.
• CODEDX_BASE_URL (default: https://codedx.example.com/srm)
• CODEDX_CA_CERT_FILE (optional): path to an extra PEM CA bundle for CodeDx TLS verification
• CODEDX_CA_CERT_BASE64 (optional): base64-encoded PEM CA bundle for CodeDx TLS verification
• MCP_JSON_RESPONSE (default: false)
• LOG_LEVEL (default: info)

Run locally

With Docker

See docker-compose.yaml. If your CodeDx SRM server is fronted by a private/enterprise certificate authority, provide the trusted CA via CODEDX_CA_CERT_FILE or CODEDX_CA_CERT_BASE64.

With Go

From repo root:

export MCP_AUTH_SECRET="$(python3 - <<'PY'
import os, base64
print(base64.urlsafe_b64encode(os.urandom(32)).decode().rstrip('='))
PY
)"

GO111MODULE=on go run ./cmd/codedx-srm-mcp

OpenAPI snapshot + client generation

This server is implemented from an OpenAPI snapshot pinned at api/swagger.json.

The upstream docs/spec are SSO-protected; see docs/API.md and scripts/update-codedx-swagger.sh for details.

Scripts:

• Update pinned swagger snapshot:
  • scripts/update-codedx-swagger.sh
• Regenerate typed Go client:
  • scripts/generate-codedx-openapi.sh