Enables loading, batching, and tracking of static analysis issues from ESLint SARIF reports, allowing agents to efficiently fix JavaScript code quality problems.
Enables loading, batching, and tracking of static analysis issues from SonarQube SARIF reports, facilitating systematic resolution of code quality and security problems.
Enables loading, batching, and tracking of security vulnerabilities and infrastructure issues from Trivy SARIF reports, helping agents focus on fixing high-priority findings.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Sheriff-MCP Load the SARIF report and show me the next batch of issues to fix"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Sheriff is an MCP server that helps AI agents efficiently fix static analysis issues from SARIF reports.
Documentation | Installation | Tool Reference
AI agents struggle with large static analysis reports:
Context overload - 100+ issues overwhelm context windows
Lost progress - Work is lost on context compaction or session restart
Inefficient navigation - No batching means jumping between files repeatedly
Sheriff solves this by acting as a work queue manager:
Intelligent batching - Issues grouped by file for efficient fixing
Persistent progress - State survives compaction, restarts, and agent switches
Scope filtering - Focus on specific rules, severities, or file patterns
Compact responses - Minimal context usage with abbreviated field names
Sheriff works with any tool that produces SARIF output:
Tool | Language | SARIF Command |
Qodana | Java/Kotlin/JS/Python |
|
Semgrep | Multi-language |
|
ESLint | JavaScript/TypeScript |
|
CodeQL | Multi-language | Built-in SARIF output |
SpotBugs | Java |
|
Bandit | Python |
|
Checkov | IaC |
|
Trivy | Container/IaC |
|
SonarQube | Multi-language | Built-in SARIF export |
Related MCP server: CodePeel MCP Server
Download sheriff-mcp-1.0.2-all.jar from Releases.
docker pull ghcr.io/ryansmith4/sheriff-mcp:latestClients that support the MCP Registry can install directly by name: io.github.ryansmith4/sheriff-mcp
See the Installation Guide for full details.
Add Sheriff to your MCP client (Claude Code, Cursor, ChatGPT Desktop, etc.):
{
"mcpServers": {
"sheriff": {
"command": "java",
"args": ["-jar", "/path/to/sheriff-mcp-1.0.2-all.jar", "start"]
}
}
}Or with Docker:
{
"mcpServers": {
"sheriff": {
"command": "docker",
"args": ["run", "-i", "--rm", "-v", ".:/data", "ghcr.io/ryansmith4/sheriff-mcp:latest"]
}
}
}See the Agent Setup Guide for client-specific instructions and recommended agent instructions.
1. Run static analysis → qodana scan
2. Load into Sheriff → sheriff load target="results.sarif"
3. Get next file's issues → sheriff next
4. Fix all issues in file → [edit the code]
5. Mark as done → sheriff done fps=[...] status="fixed"
6. Repeat 3-5 → until remaining = 0Sheriff exposes a single sheriff tool with 7 actions: load, next, done, progress, summary, reopen, and export. See the Tool Reference for full documentation.
User: "Fix all ConstantValue issues in my codebase"
Agent: sheriff load target="build/qodana/qodana.sarif.json"
→ 136 total issues, 22 ConstantValue, 15 unused...
Agent: sheriff next scope={rule: "ConstantValue"}
→ 3 issues in Service.java with code snippets
Agent: [reads Service.java, fixes all 3 issues]
Agent: sheriff done fps=["88d32cab35478753", "ab1c2d3e12345678", "f9e8d7c6a1b2c3d4"] status="fixed"
→ 3 marked fixed, 19 remaining
... continues until remaining = 0All release artifacts are signed with Sigstore for supply chain security.
Verify JAR:
VERSION=1.0.2
cosign verify-blob \
--signature sheriff-mcp-${VERSION}-all.jar.sig \
--certificate sheriff-mcp-${VERSION}-all.jar.pem \
--certificate-identity-regexp "https://github.com/ryansmith4/sheriff-mcp" \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
sheriff-mcp-${VERSION}-all.jarVerify Docker image:
cosign verify ghcr.io/ryansmith4/sheriff-mcp:latest \
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
--certificate-identity-regexp="github.com/ryansmith4/sheriff-mcp"See SECURITY.md for our security policy.
Contributions welcome! See CONTRIBUTING.md for guidelines.
Apache License 2.0 - see LICENSE
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
No tool schema history has been recorded yet.
This server cannot be installed
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
The issue tracker AI coding agents pull work from: atomic claims, dependency-aware dispatch.
Production-readiness for your AI coding agents.
Task management for teams building with AI agents. Agents claim tasks and report progress.
Give your AI agent a persistent map of your project's structure, dependencies, and bugs.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/ryansmith4/sheriff-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
