Integration

Wire the server into your AI assistant and the manager.

The MCP server runs over stdio for client integrations, while the vulnerability manager accepts authenticated uploads from the publish action using a JWT-backed API session.

MCP client config

Point your MCP client at the repository with uv run main.py.

{
  "mcpServers": {
    "security-advisor": {
      "command": "uv",
      "args": ["--directory", "/absolute/path/to/security-advisor", "run", "main.py"]
    }
  }
}

Manager upload flow

The publish action authenticates to the manager, resolves the inventory path, and uploads normalized findings.

organization=Acme
project=Payments
service=checkout-api
version=v1.4.2

Gemini Code Review Tools

security_gemini_code_review_skill

Runs Gemini CLI against the current branch diff in non-interactive mode and returns a vulnerability_schema.json-compatible payload.

gemini -p 'activate the code review skill and
  review code changes in current branch'
  --yolo -e code-review --output-format json

Returns {"vulnerabilities": [...]} with fields mapped from Gemini findings: severity, affected_component (file_path:line_number), remediation, and source_tool: "Gemini Code Review".

security_gemini_publish_to_vulnerability_manager_skill

Combines the Gemini code review with a Vulnerability Manager upload in a single call. Accepts the same inventory parameters as the standard publish action.

path=/path/to/repo
organization=Acme
project=Payments
service=checkout-api
version=v1.4.2

Authenticates, resolves or creates the org → project → service → version hierarchy, and uploads the normalized payload to /api/versions/{id}/vulnerabilities/upload.