# DeepSource MCP for AI Agents AI Agent Connect > DeepSource MCP lets your AI agent monitor code quality, security vulnerabilities, and repository metrics in real-time. It pulls report cards, identifies bugs, and tracks dependency risks across your codebase so you don't have to dig through a dashboard. ## Overview - **Category:** developer-tools - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_gRojrYBqBJYk2MB0kmqFd1Bq7M9JWeWmipQYTeBA/ai-agent-connect - **Tags:** code-review, static-analysis, vulnerability-scanning, code-quality, automated-testing, security-linting ## Description DeepSource connects your code quality data directly to your AI agent. Instead of jumping between tabs to check for bugs or security flaws, you can just ask your agent to summarize the health of a specific repo. It pulls in everything from high-level report cards to granular details on cyclomatic complexity or test coverage. If a new dependency introduces a CVE, your agent can spot it and tell you if it's actually reachable. It also handles the boring stuff, like updating default branches or rotating DSN tokens, so you can keep your workspace clean. You'll find this Connector in the Vinkius catalog, where it acts as a bridge between your deep analysis tools and your daily workflow. It turns your agent into a security reviewer or a code quality analyst that's always on call. You can get a pulse on technical debt across your entire organization without ever leaving your primary workspace. ## Tools ### activate_repository Turns on code quality monitoring for a repository so it starts receiving analyses. Use this to enable monitoring for a project that was previously inactive. ### deactivate_repository Pauses analysis for a repository to stop billing or archive the project. This stops new analyses from running until you reactivate it. ### get_report_card Fetches the high-level health grade and score breakdown for a repository. It provides a quick check of your overall code quality status. ### get_repository_metrics Returns specific data points like line coverage or cyclomatic complexity for a repo. You can filter by specific metric shortcodes if needed. ### get_repository Retrieves the configuration details for a repository to help identify its unique ID. Use this to inspect a repo before querying issues or metrics. ### get_test_coverage Shows the current percentage of code covered by tests against your set thresholds. This helps ensure your code meets your team's testing standards. ### get_viewer Verifies your API token is active and pulls your account profile details. Use this to confirm your connection to DeepSource is working correctly. ### get_vulnerability Provides deep-dive details on a specific dependency vulnerability using its unique ID. This helps you understand a risk before deciding on a fix. ### list_analysis_runs Shows the history of recent analysis runs including status and the specific analyzer used. You can filter these results by branch name. ### list_issues Lists code quality problems like smells and bugs along with their file paths and lines. This helps you identify anti-patterns across your codebase. ### list_sca_targets Shows which dependency manifest files like package.json or requirements.txt are being scanned. This clarifies which files are being monitored for security. ### list_vulnerabilities Lists all security risks in your dependencies including CVE IDs and fixability status. Use this to prioritize which security flaws to tackle first. ### regenerate_dsn Invalidates the current Data Source Name and generates a new one for a repository. This is the best way to rotate your credentials if they get compromised. ### update_default_branch Changes the branch DeepSource analyzes as the default for a specific repository. This is useful when your team migrates from master to main. ## Prompt Examples **Prompt:** ``` What's the health grade for the 'payment-gateway' repo and are there any critical bugs? ``` **Response:** ``` I've checked the health for 'payment-gateway': **Current Grade: C+** (Score: 72/100) **Critical Issues Found:** - **SQL Injection Risk** (Security) in `db_connector.py` at line 45 - **High Cyclomatic Complexity** (CC > 25) in `process_payment` function - **Unused Imports** in 12 files Would you like me to pull the full list of issues for the auth module? ``` **Prompt:** ``` List all the security vulnerabilities in our 'mobile-app' project that have a fix available. ``` **Response:** ``` I found 3 fixable vulnerabilities in the 'mobile-app' repository: | Package | CVE ID | Severity | Fix Version | | :--- | :--- | :--- | :--- | | `lodash` | CVE-2023-XXXX | HIGH | v4.17.21 | | `express` | CVE-2024-YYYY | MEDIUM | v4.18.0 | | `axios` | CVE-2023-ZZZZ | LOW | v1.6.0 | All three are marked as reachable in your current configuration. ``` **Prompt:** ``` Show me the test coverage for the 'auth-api' and tell me if it's below our 80% target. ``` **Response:** ``` I've retrieved the coverage for 'auth-api': **Current Test Coverage: 74.2%** (Line Coverage) **Status:** ⚠️ Below Target Your configured threshold is 80.0%. You are currently 5.8% below the target. Would you like me to list the files with the lowest coverage? ``` ## Capabilities ### Get repository health grades Retrieve a high-level score and grade for any repository in your organization. ### List security vulnerabilities Identify dependency risks with CVE IDs, severity scores, and reachability status. ### Check code quality metrics Pull specific data points like cyclomatic complexity, maintainability index, and test coverage. ### View analysis history See the status and results of recent code scans across different branches. ### Manage repository settings Activate, deactivate, and update default branches for your monitored projects. ### Track test coverage Monitor how much of your codebase is covered by tests against your custom thresholds. ## Use Cases ### Security Audit A security lead asks the agent to find all critical CVEs in the 'frontend' repo. The agent uses list_vulnerabilities and summarizes the fixable risks. ### PR Review A developer wants to know if their new code increased complexity. They ask the agent to check get_repository_metrics for the 'auth-service' repo. ### Manager Overview An engineering manager asks for a summary of all repository grades. The agent uses get_report_card for every repo in the organization. ### Repo Cleanup A DevOps lead needs to rotate keys for a specific project. They ask the agent to regenerate_dsn for the production database repo. ## Benefits - Stop hunting for bugs manually. Use list_issues to see exactly where anti-patterns exist in your files without opening a browser. - Prioritize security fixes faster. Use list_vulnerabilities to see which CVEs are actually reachable so you don't waste time on non-risks. - Track progress with report cards. Use get_report_card to see how your repository health grade changes over time as you ship features. - Keep metrics consistent. Use get_repository_metrics to monitor cyclomatic complexity and maintainability across different teams. - Manage repos at scale. Use activate_repository and deactivate_repository to control your analysis scope without manual dashboard clicks. - Verify your coverage. Use get_test_coverage to ensure new features meet your team's testing standards before they hit production. ## How It Works The bottom line is that it puts your entire code quality dashboard into a simple chat interface. 1. Subscribe to the Connector and provide your DeepSource Personal Access Token. 2. Connect your preferred AI client like Cursor, Claude, or Windsurf. 3. Ask your agent to summarize your code quality, list issues, or check for vulnerabilities. ## Frequently Asked Questions **How does the DeepSource MCP help with security?** It connects your security scan data to your AI agent. You can ask it to list all active vulnerabilities, check for specific CVE IDs, and see which risks are actually reachable in your code so you can prioritize fixes. **Can I use DeepSource MCP to see my code's cyclomatic complexity?** Yes, the Connector can pull specific metrics like cyclomatic complexity and maintainability index. You can ask your agent to check these for any repository to identify complex functions that need refactoring. **Does DeepSource MCP work with my existing DeepSource account?** It does. You just need to provide your DeepSource Personal Access Token when connecting the Connector to your AI client. This allows your agent to access the data from your existing projects. **How do I see my repository's health grade?** You can simply ask your AI agent for the report card of any repository. It will pull the overall grade, the score breakdown, and a summary of the health trends for you. **Can the DeepSource MCP manage my repository settings?** Yes, it can handle several management tasks. You can ask your agent to activate or deactivate repositories, update default branches, or even rotate your DSN tokens without leaving your chat. **Will DeepSource MCP show me which files have the most code smells?** Yes, it can list all code quality issues and include the specific file paths and line numbers for each. This makes it easy to see exactly where the most problematic code lives. **How do I get a DeepSource Personal Access Token and where do I find it?** Log in to your DeepSource account, go to **Account Settings** → **Personal Access Tokens**, and click **Create New Token**. Give it a descriptive name (e.g., 'Vinkius MCP') and copy the token immediately — it won't be shown again. Paste this token into the API key field below. The token is used as a Bearer token in the Authorization header for all GraphQL requests to `https://api.deepsource.com/graphql/`. **What types of code issues can DeepSource detect and how are they categorized?** DeepSource detects various code quality issues including code smells, anti-patterns, performance issues, security vulnerabilities, and bugs. Issues are categorized by severity (CRITICAL, HIGH, MEDIUM, LOW) and by analyzer type (e.g., PYTHON for Python issues, JS-A1 for JavaScript anti-patterns, GO for Go issues). Each issue includes a shortcode, title, category, and file locations with line numbers. You can filter issues by analyzer short code when querying repositories. **How does DeepSource detect dependency vulnerabilities and what information is provided?** DeepSource uses Supply Chain Analysis (SCA) to scan dependency manifest files (package.json, requirements.txt, Gemfile, etc.) for known vulnerabilities. Each vulnerability includes: CVE ID, CVSS score (0-10), severity level, description, affected package name and version, ecosystem (npm, pip, etc.), reachability status (whether the vulnerable code is actually called), and fixability (whether a fix version is available). This helps prioritize which vulnerabilities to address first based on real risk rather than just theoretical severity. **What is the API rate limit and how many requests can I make per hour?** DeepSource enforces a rate limit of 5,000 requests per hour per user account. This limit covers both read (queries) and write (mutations) operations. If you exceed this limit, the API will return HTTP 429 (Too Many Requests). For most code review and monitoring workflows, this limit is more than sufficient. If you need higher limits for large-scale analysis, contact DeepSource support.