Atlas / MCP servers / sbd-toe / @shiftleftpt/sbd-toe-mcp

@shiftleftpt/sbd-toe-mcpBLOCK

Name: @shiftleftpt/sbd-toe-mcp
Author: sbd-toe

mcp/sbd-toe/sbd-toe-mcp

MCP server by sbd-toe · Audited 2026-10-12

⚑ Report / re-scan Source ↗

PoC para um MCP sobre o knowledge base do SbD-ToE

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

30 26r · 4w · 0d

Transport

—

License

Apache-2.0

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

MCP server for the SbD-ToE (Security by Design — Theory of Everything) security manual — structured tools for Claude, GitHub Copilot, Cursor, Windsurf, Zed and any MCP-compatible client.

[](https://www.npmjs.com/package/@shiftleftpt/sbd-toe-mcp) [](LICENSE)

Quick Start

Zero configuration required. Works out-of-the-box with npx:

Claude Code:

claude mcp add sbd-toe -- npx -y @shiftleftpt/sbd-toe-mcp

Claude Desktop / Cursor / Windsurf — add to your MCP config:

{
"mcpServers": {
"sbd-toe": {
"command": "npx",
"args": ["-y", "@shiftleftpt/sbd-toe-mcp"]
}
}
}

VS Code + GitHub Copilot — add to .vscode/mcp.json:

{
"servers": {
"sbdToe": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@shiftleftpt/sbd-toe-mcp"]
}
}
}

For full installation instructions for all clients see docs/installation.md.

Requirements: Node.js ≥ 20.9.0

What it does

This MCP server gives any AI client structured access to the SbD-ToE security manual — a 15-chapter (00–14) framework for Security by Design — Theory of Everything.

All data is bundled locally. No Algolia, no internet connection required at runtime, no API keys.

Tools

Read from source at commit f1374a9be1adOBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code

claude mcp add sbd-toe-mcp -- npx -y @shiftleftpt/[email protected]

claude-desktop

{
  "mcpServers": {
    "sbd-toe-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@shiftleftpt/[email protected]"
      ]
    }
  }
}

Exposed tools (30)

26 read · 4 write · 0 destructive.

Tool	Risk	Description
`answer_sbd_toe_manual`	read	DOES NOT ANSWER — serves manual context for the CLIENT model to answer via MCP sampling; the judgement stays with the asker. Requires sampling support; without it, falls back to formatted retrieval output (same as search_sbd_toe_manual), the better choice on clients without sampling.
`ask_sbd_toe_manual`	read	MCP prompt to guide the AI chat to answer questions about the SbD-ToE manual with grounding.
`concerns`	read	Concerns DECLARADOS do vocabulário fechado (
`explain_sbd_toe_topic`	read	CONSULT reading —
`generate_sbd_toe_skill`	read	Generates from the published guide without validating your environment: it installs, configures and verifies nothing — it returns text for YOU to install. Use for
`get_guide_by_role`	read	Runtime-grounded practices, assignments and user stories for a risk level, optionally filtered by role and/or lifecycle phase. Each assignment carries its required ARTIFACTS (the requirement→evidence link, served from the bundle). Roles resolve via canonical aliases (e.g.
`get_sbd_toe_chapter_brief`	read	Operational summary of a chapter: title, objective, role, phases, artefacts (fields are present when the substrate carries them).
`get_sbd_toe_chapter_capability`	read	IMPL reading —
`get_sbd_toe_chapter_implementation_checklist`	read	The
`get_sbd_toe_macro_processes`	read	PROGRAMME reading —
`get_sbd_toe_operating_model`	read	The operating model — RACI, decision rights, governance cadences, org model — from the rollout playbook (implementation profile). Retrieval-grounded prose; coverage-preserving; nothing invented. Answers
`get_sbd_toe_playbook`	read	NORMATIVE path for cross-checks and playbooks:
`get_sbd_toe_verification_matrix`	read	The EXPECTED side of verification: per requirement/control at a risk level, the validation method, expected evidence and EvidencePattern reference from the published patterns (totals declared). Cited per row; coverage-preserving — declares requirements with no pattern. Answers
`includeRegulatoryOverlay`	read	When true, asks the tool to surface regulatory overlay context.
`inspect_sbd_toe_retrieval`	read	Inspects retrieval, context selection and the final prompt without requesting an answer from the client model.
`list_sbd_toe_chapters`	read	Lists the manual chapters: id, canonical title, clean readableTitle, graduated applicability (every chapter applies at every level) and derived demand_by_level.
`map_sbd_toe_review_scope`	write	Given a set of changed files, maps which SbD-ToE knowledge bundles should be reviewed, with explicit reasoning per path.
`mode`	read	codegen \| review \| test-plan. Defaults to codegen.
`plan_sbd_toe_rollout`	write	Serves the PUBLISHED phase sequence — it does not plan for you: the order of phases the manual publishes, mapped to the chapters each traverses; the roadmap is yours. Phase-ordered; the dependency DAG is deferred (declared, not faked). Grounded in the published runtime; nothing invented. Answers
`prepare_grounded_codegen`	read	MCP prompt that bundles the grounded-codegen guide with a user task and instructs the
`projectRole`	read	Project role or description (optional).
`query_sbd_toe_entities`	read	Queries manual entities by text, entity type, chapter or risk level.
`question`	read	Question about the SbD-ToE manual.
`regulatoryFrameworks`	read	Optional regulatory framework short codes or IDs (e.g.
`riskLevel`	read	Project risk level: L1, L2 or L3.
`select_sbd_toe_requirements`	write	START HERE. DECLARATIVE FIRST: DECLARE what you read — risk_level, concerns, exposure, data_sensitivity, technologies, changed_files, or structure (chapters, categories); the server never interprets prose (vocabulary: sbd://toe/activation-vocabulary).
`setup_sbd_toe_agent`	write	START HERE — entry point (2a chamada, após leres sbd://toe/agent-guide): MCP PROMPT (clientes sem suporte de prompts não o expõem — alternativa: activadores estruturados directos no select) to configure an agent with SbD-ToE manual context and rules for a given risk level.
`stack`	read	Stack hint (e.g.
`task`	read	Concrete coding task (e.g.
`trace_sbd_toe_requirement_sources`	read	Where each requirement

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	FAIL
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (3 observation(s))
Network: declared (2 observation(s))
Shell: declared (2 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (16)

HIGHInventory / provenance · inv.suspicious_name · CWE-1104

scripts/measure-codegen-payload.mjs

measure-codegen-payload.mjs

Why it matters. member named after an attack tool

Fix. remove or justify

HIGHInventory / provenance · inv.suspicious_name · CWE-1104

src/serving/payload-ceilings.ts

payload-ceilings.ts

Why it matters. member named after an attack tool

Fix. remove or justify

LOWInventory / provenance · inv.suspicious_name · CWE-1104

src/serving/payload-ceilings.test.ts

payload-ceilings.test.ts

Why it matters. member named after an attack tool

Fix. remove or justify

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

.github/ISSUE_TEMPLATE/release-checklist.yml:16

Referência: Manual SbD-ToE Cap. 10 + [`politica-testes.md`](../../docs/SecurityByDesign/politica-testes.md)

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

.github/ISSUE_TEMPLATE/security-incident.yml:14

> Para reportar uma vulnerabilidade em privado, consulta [SECURITY.md](../../SECURITY.md).

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

scripts/measure/cost-ceiling-matrix.mjs:32

const after = await load(new URL("../../dist", import.meta.url).pathname);

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

scripts/measure/s5-form-projection.mjs:19

import { handlePrepareCodegenContext } from "../../dist/tools/prepare-codegen-context.js";

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

scripts/measure/s5-form-projection.mjs:20

import { getOntologyData } from "../../dist/tools/ontology-loader.js";

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

package.json

oxigraph, yaml, @types/node, @vitest/coverage-v8, @vitest/ui, typescript, vitest

Why it matters. 7 dependency range(s) float

Fix. pin exact versions or ship a lockfile

LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

CHANGELOG.md:4336

antes→depois: «Endpoint de upload com sessão e token» = 57 selected vs «Receber

Why it matters. an instruction to move sensitive data to an outside destination

Fix. remove; a skill never needs the user's secrets off the machine

LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

agentic/briefs/2026-09-04-pontifex-0.19.0-ronda3-estabilidade.md:5

- **Caso reproduzido**: «Endpoint de upload com sessão e token» 57 selected vs «Receber ficheiros dos utilizadores autenticados» 8 (trace 100% task_term; razão do narrowed soava a regra). **Depois**:

Why it matters. an instruction to move sensitive data to an outside destination

Fix. remove; a skill never needs the user's secrets off the machine