Back to Home
Tetsukiba icon

MCP-demo-CSCI-435

Verified Safe

by Tetsukiba

Overview

Automates the end-to-end workflow from Figma design extraction and code generation, through SonarQube code quality analysis (with automated patching), to creating a GitHub Pull Request.

Installation

Run Command
python sonar.py

Environment Variables

  • GITHUB_TOKEN
  • SONAR_BASE_URL
  • SONAR_TOKEN
  • SONAR_ORGANIZATION
  • SONAR_PROJECT

Security Notes

The project correctly utilizes environment variables for sensitive tokens and implements secret redaction for logging. However, `sonar.py` executes `sonar-scanner` via `subprocess.Popen`, which, while necessary for its functionality, introduces an inherent risk if inputs (like `project_key` or `files` content) were not adequately sanitized or could be manipulated for shell injection. The current implementation appears to construct arguments safely, mitigating immediate shell injection concerns.

Similar Servers

Stats

Interest Score0
Security Score8
Cost ClassMedium
Avg Tokens1500
Stars0
Forks0
Last Update2025-12-06

Tags

Workflow AutomationCode QualityCI/CDDevOpsFigma Integration