HefestoAI checks AI-generated code before you ship it.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Runs the open-source hefesto-ai engine (`hefesto analyze --no-config`, free tier) on the files you send to the hosted analyzer and returns its findings: rule id, severity, file, line, message and the SARIF hefestoFingerprint/v1 fingerprint (format "sarif" adds the full SARIF 2.1.0 log). Use it to check a file or snippet the user shares (for example "analyze this file") for security and quality issues before committing. Minimum call: {"code": "<file contents>"}. Add path (e.g. "app/run.py") so the language comes from the extension; without path or language the language is inferred from the content, else python. For several files send files=[{"path", "content"}] instead. severity and format are optional. Covers Python, COBOL, the DevOps/IaC formats hefesto analyze routes, and TypeScript, JavaScript, Java, Go, Rust and C# through the multilang tree-sitter grammars (the first such request on a fresh server instance downloads the grammars and can take a few seconds longer). Limits: 20 files, 100 KB per file, 256 KB in total, 20 seconds, 10 requests per minute per IP, shared across server instances. No .hefesto.yaml is read. Files are deleted after the run; nothing is stored. For a whole repository, run `hefesto analyze .` locally.
Contents of one file or snippet, used when files is omitted. At most 100 KB. This is the only argument a first call needs.
Optional file name for code, e.g. "app/run.py" or "Dockerfile". The extension picks the language. Same rules as files[].path. Ignored when files is set.
Several files to analyze. Used instead of code when present. path: relative POSIX, at most 200 characters and 8 levels; each segment is letters, digits, "_", "." or "-" and must not start with "-"; no "..", no absolute paths, no ".git" or ".hefesto.yaml". content: UTF-8 text, no NUL bytes, at most 100 KB.
Optional. json (default): findings only; sarif: also the full SARIF 2.1.0 log.
Optional language of code. Ignored when files or path is set. When omitted it is inferred from the content (python if unsure). An unknown language is rejected; send path or files instead.
Optional minimum severity to report (default LOW).
Tool list last changed Oct 25, 2026.
Runs the open-source hefesto-ai engine (`hefesto analyze --no-config`, free tier) on the files you send to the hosted analyzer and returns its findings: rule id, severity, file, line, message and the SARIF hefestoFingerprint/v1 fingerprint (format "sarif" adds the full SARIF 2.1.0 log). Use it to check a file or snippet the user shares (for example "analyze this file") for security and quality issues before committing. Minimum call: {"code": "<file contents>"}. Add path (e.g. "app/run.py") so the language comes from the extension; without path or language the language is inferred from the content, else python. For several files send files=[{"path", "content"}] instead. severity and format are optional. Covers Python, COBOL, the DevOps/IaC formats hefesto analyze routes, and TypeScript, JavaScript, Java, Go, Rust and C# through the multilang tree-sitter grammars (the first such request on a fresh server instance downloads the grammars and can take a few seconds longer). Limits: 20 files, 100 KB per file, 256 KB in total, 20 seconds, 10 requests per minute per IP, shared across server instances. No .hefesto.yaml is read. Files are deleted after the run; nothing is stored. For a whole repository, run `hefesto analyze .` locally.
| Argument | Type | Description |
|---|---|---|
| code | string | Contents of one file or snippet, used when files is omitted. At most 100 KB. This is the only argument a first call needs. |
| path | string | Optional file name for code, e.g. "app/run.py" or "Dockerfile". The extension picks the language. Same rules as files[].path. Ignored when files is set. |
| files | array | Several files to analyze. Used instead of code when present. path: relative POSIX, at most 200 characters and 8 levels; each segment is letters, digits, "_", "." or "-" and must not start with "-"; no "..", no absolute paths, no ".git" or ".hefesto.yaml". content: UTF-8 text, no NUL bytes, at most 100 KB. |
| format | string | Optional. json (default): findings only; sarif: also the full SARIF 2.1.0 log. |
| language | string | Optional language of code. Ignored when files or path is set. When omitted it is inferred from the content (python if unsure). An unknown language is rejected; send path or files instead. |
| severity | string | Optional minimum severity to report (default LOW). |
{
"type": "object",
"examples": [
{
"code": "import subprocess\n\ndef run(cmd):\n return subprocess.call(cmd, shell=True)\n"
},
{
"code": "import subprocess\n\ndef run(cmd):\n return subprocess.call(cmd, shell=True)\n",
"path": "app/run.py",
"severity": "MEDIUM"
},
{
"files": [
{
"path": "src/run.py",
"content": "import subprocess\n\ndef run(cmd):\n return subprocess.call(cmd, shell=True)\n"
}
]
}
],
"properties": {
"code": {
"type": "string",
"description": "Contents of one file or snippet, used when files is omitted. At most 100 KB. This is the only argument a first call needs."
},
"path": {
"type": "string",
"description": "Optional file name for code, e.g. \"app/run.py\" or \"Dockerfile\". The extension picks the language. Same rules as files[].path. Ignored when files is set."
},
"files": {
"type": "array",
"items": {
"type": "object",
"required": [
"path",
"content"
],
"properties": {
"path": {
"type": "string",
"maxLength": 200,
"description": "Relative POSIX path. The extension picks the language."
},
"content": {
"type": "string",
"description": "UTF-8 source text. At most 100 KB. No NUL bytes."
}
},
"additionalProperties": false
},
"maxItems": 20,
"description": "Several files to analyze. Used instead of code when present. path: relative POSIX, at most 200 characters and 8 levels; each segment is letters, digits, \"_\", \".\" or \"-\" and must not start with \"-\"; no \"..\", no absolute paths, no \".git\" or \".hefesto.yaml\". content: UTF-8 text, no NUL bytes, at most 100 KB."
},
"format": {
"enum": [
"json",
"sarif"
],
"type": "string",
"description": "Optional. json (default): findings only; sarif: also the full SARIF 2.1.0 log."
},
"language": {
"enum": [
"python",
"py",
"cobol",
"yaml",
"yml",
"dockerfile",
"docker",
"terraform",
"hcl",
"shell",
"bash",
"sh",
"sql",
"javascript",
"js",
"typescript",
"ts",
"java",
"go",
"rust",
"csharp",
"c#"
],
"type": "string",
"description": "Optional language of code. Ignored when files or path is set. When omitted it is inferred from the content (python if unsure). An unknown language is rejected; send path or files instead."
},
"severity": {
"enum": [
"LOW",
"MEDIUM",
"HIGH",
"CRITICAL"
],
"type": "string",
"description": "Optional minimum severity to report (default LOW)."
}
},
"description": "Send code (one file; path and language optional) or files (several). Everything else is optional.",
"additionalProperties": false
}Return a short static comparison of HefestoAI with one named tool. Use it when the user asks how HefestoAI differs from another scanner. No live lookup and no code is inspected. All arguments are optional: {} compares with sonarqube. Known values: sonarqube (the default when tool is omitted), snyk, github-advanced-security, semgrep, claude-code-security, coderabbit, qodo. Any other value is answered as sonarqube.
| Argument | Type | Description |
|---|---|---|
| tool | string | Optional. Tool to compare with: sonarqube (default), snyk, github-advanced-security, semgrep, claude-code-security, coderabbit, or qodo. |
{
"type": "object",
"examples": [
{},
{
"tool": "semgrep"
}
],
"properties": {
"tool": {
"type": "string",
"description": "Optional. Tool to compare with: sonarqube (default), snyk, github-advanced-security, semgrep, claude-code-security, coderabbit, or qodo."
}
},
"additionalProperties": false
}Return install commands for the open-source package (pip install hefesto-ai, Python 3.10+). Use it when the user wants to run HefestoAI locally, in a pre-commit hook or on a whole repository. Does not install anything on the caller's machine. No parameters: call it with {}.
No arguments.
{
"type": "object",
"additionalProperties": false
}Return current HefestoAI prices (Free $0, PRO $8/month per user, OMEGA $19/month). Use it when the user asks what HefestoAI costs. Static text. Does not look up or change a subscription. No parameters: call it with {}.
No arguments.
{
"type": "object",
"additionalProperties": false
}