# HefestoAI

Reviews AI-written code before release: finds secrets and injection risks, and flags where dependencies, README and CI disagree.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 7
- Author: artvepa80
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/artvepa80/Agents-Hefesto
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/hefestoai

## What it does

HefestoAI runs once your assistant has finished writing and before anything ships. It cross-checks what the project claims about itself (dependencies, `pyproject.toml`, README, CHANGELOG, `action.yml`, `Dockerfile`, CI) against what is really there. On top of that it looks for hardcoded secrets and injection patterns, and measures function complexity.

A typical catch: a Python import with no matching entry in `pyproject.toml`, or a version that differs between `pyproject.toml`, CHANGELOG and the README badges. No single file shows these, so a per-file linter stays quiet. The GitHub Action runs the same checks and writes SARIF for Code scanning.

The MCP server is a remote HTTP endpoint at `https://hefestoai.narapallc.com/api/mcp-protocol`. If your code is TypeScript or Go, the Action won't cover it: you need the CLI with `pip install "hefesto-ai[multilang]"`.

## Requirements
- Needs: Python and uv (commands run via uvx)
- Remote server: `https://hefestoai.narapallc.com/api/mcp-protocol`

## Install

### Claude Code (native platform)

**Platform CLI: remote server**
```bash
claude mcp add --transport http hefestoai https://hefestoai.narapallc.com/api/mcp-protocol
```

### Codex

**Platform CLI: remote server**
```bash
codex mcp add hefestoai --url https://hefestoai.narapallc.com/api/mcp-protocol
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "hefestoai": {
            "url": "https://hefestoai.narapallc.com/api/mcp-protocol"
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "hefestoai": {
            "type": "http",
            "url": "https://hefestoai.narapallc.com/api/mcp-protocol"
        }
    }
}
```

### Gemini CLI

**Platform CLI: remote server**
```bash
gemini mcp add -t http hefestoai https://hefestoai.narapallc.com/api/mcp-protocol
```

## When to use it
- find a Python import missing from `pyproject.toml`
- catch a password or API key hardcoded in source
- spot SQL injection in an f-string query
- compare versions across `pyproject.toml`, CHANGELOG and README badges
- confirm CI uses the same Python version and flake8 config as local

## Example prompts
- Run HefestoAI on the code you just wrote before I commit
- Use hefestoai to scan this project and show findings at MEDIUM or higher
- Ask hefestoai to compare versions in `pyproject.toml`, CHANGELOG and README

## Similar
- [Front-End Checklist](https://affpapa.org/en/nevibecode/mcp/front-end-checklist.md) — MCP server · ★ 74559
- [Codebase Memory](https://affpapa.org/en/nevibecode/mcp/codebase-memory.md) — MCP server · ★ 47392
- [Serena MCP: the IDE for your agent](https://affpapa.org/en/nevibecode/mcp/serena-mcp-the-ide-for-your-agent.md) — MCP server · ★ 30677
- [Repomix](https://affpapa.org/en/nevibecode/mcp/repomix.md) — MCP server · ★ 29027
- [Repowise](https://affpapa.org/en/nevibecode/mcp/repowise.md) — MCP server · ★ 7891
- [sem](https://affpapa.org/en/nevibecode/mcp/sem.md) — MCP server · ★ 3422

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md