Tool Positioning
Bugsy is a command-line interface (CLI) tool that provides automatic remediation of code security vulnerabilities. It is the community edition of Mobb, which is described as the first vendor-agnostic automatic security vulnerability remediation tool. Bugsy is designed to help developers quickly identify and fix security vulnerabilities in code.
Main Capabilities
Mobb can ingest SAST results from Checkmarx, CodeQL (GitHub Advanced Security), OpenText Fortify, and Snyk, and generate code fixes for developers to review and commit.
Bugsy has two modes:
- Scan mode (no SAST report required): Uses the Checkmarx or Snyk CLI tools to run a SAST scan on a specified open-source GitHub/GitLab/ADO repository; analyzes the vulnerability report to identify issues that can be automatically remediated; generates code fixes, and redirects the user to the remediation report page on the Mobb platform.
- Analyze mode (requires a user-provided pre-generated SAST report): Analyzes Checkmarx/CodeQL/Fortify/Snyk vulnerability reports to identify issues that can be automatically remediated.
It should be specifically noted that: Bugsy itself does not detect any vulnerabilities in code; it uses the results detected by the above SAST tools. The community edition only analyzes public GitHub repositories; private repositories are only allowed to be analyzed for a limited time.
Usage
Bugsy can be run directly from the command line using npx, and after running it will display its usage help.
To run a new SAST scan and get fixes, use the Bugsy Scan command.
To get fixes for a pre-generated SAST report, use the Bugsy Analyze command. Example:
npx mobbdev analyze --scan-file sast_results.json --repo https://github.com/mobb-dev/simple-vulnerable-java-project
Bugsy automatically generates fixes for each supported vulnerability identified in the results, and guides developers to review and commit these fixes into the code. Use the Scan or Analyze command with the -h option to view all options supported by Bugsy.
Using as an MCP Server
Bugsy can also be used as an MCP server, enabling AI assistants such as Claude to automatically scan and fix vulnerabilities in code repositories.
API key: Using the MCP server functionality requires a Mobb API key. Register at mobb.ai to get an API key, and set the API_KEY environment variable:
export API_KEY=your_api_key_here
Local Git repository: The MCP server analyzes git repositories with uncommitted changes. Ensure that the code is in a local git repository and that there are modified, added, or staged files available for analysis.
Run mobb-mcp from the command line.
Add Mobb MCP to the Cursor MCP client configuration. API_URL is only needed when not using https://app.mobb.ai .
Environment variables:
- API_KEY: Your Mobb API key (required)
- API_URL: Custom Mobb API URL (optional, defaults to https://app.mobb.ai）
- MVS_AUTO_FIX: Overrides the auto-fix setting—set to "true" or "false" to force enable/disable automatically applying fixes, regardless of the user database setting (optional)
After configuration is complete, you can use the MCP server through the AI assistant: have Claude scan for vulnerabilities (run a scan using mobb-mcp, or run the fix-vulnerabilities MCP tool).
The MCP server will: verify the repository path; check git changes (modified, added, or staged files); upload the changed files for analysis; generate automatic fixes for detected vulnerabilities; return detailed fix suggestions.
fix_vulnerabilities: scans the current code changes and returns fixes for potential vulnerabilities.
- Parameter: path (string)—the path to the local git repository
- Returns: detailed vulnerability fixes including code patches and explanations
MCP usage flow: make changes to the code; stage or modify files in git; ask the AI assistant: "Can you check my code for security vulnerabilities?"; the assistant will use the MCP server to analyze your changes; receive detailed fix suggestions including code patches.
Common error messages
- "API_KEY environment variable is not set": please confirm that the Mobb API key has been set
- "Path is not a valid git repository": please make sure it points to a valid git repository
- "No changed files found": please make sure there are modified, added, or staged files in the repository
Using in CI/CD pipelines
If your CI/CD pipeline includes SAST scanning, Bugsy can be easily integrated to provide instant fixes for each detected issue. Below is a simple command-line example of running Bugsy in a pipeline.
By default, Bugsy uses a WebSocket connection during analysis for real-time status updates. However, some proxy environments or firewalls may block WebSocket connections. In this case, you can use the --polling flag to switch to HTTP polling.
When to use --polling: the network blocks WebSocket connections (ws:// or wss://); you are behind a corporate proxy that does not support WebSocket; connection timeouts occur when using the default WebSocket mode.
Polling characteristics: polling interval of 5 seconds; timeout of 30 minutes; slightly higher latency than WebSocket mode, but it works in restricted environments.
Development and support
Install dependencies and run tests. If you use VSCode, you can debug the code using the launch.json file, and run the CLI tests configuration to continuously run and debug tests.
If you need support with Bugsy, or want to share ideas and learn more information, you are welcome to join the Discord server.
