Bugfender Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Bugfender Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
@bugfender/mcpBugfender MCP server for local stdio clients such as Cursor, Claude Code, Codex, and Gemini CLI.
bugfender/bugfender-skillsnpx -y @bugfender/mcpAfter adding or updating the MCP server in your IDE or agent, restart that client so it reloads the new MCP configuration cleanly.
If you are running from inside this repository checkout, do not use npx @bugfender/mcp or npx -p @bugfender/mcp bugfender-mcp. npm can resolve the current package instead of the published tarball and fail with bugfender-mcp: not found.
For local development, build and run the generated entrypoint directly:
pnpm build
pnpm startBUGFENDER_API_TOKEN: required access tokenBUGFENDER_REFRESH_TOKEN: recommended for automatic token refreshBUGFENDER_API_URL: optional override, defaults to https://dashboard.bugfender.com/api~/.bugfender/mcp.json: optional config file and local token store for rotated credentials{
"default": {
"apiToken": "YOUR_ACCESS_TOKEN",
"refreshToken": "YOUR_REFRESH_TOKEN",
"apiUrl": "https://dashboard.bugfender.com/api"
}
}When a refresh token is provided, the MCP stores rotated credentials in ~/.bugfender/mcp.json so automatic refresh survives restarts. Updating the IDE config with a newly generated refresh token resets that local state.
If you are using local or self-hosted Bugfender credentials, BUGFENDER_API_URL must point to the matching backend. For example, local credentials generated from https://dashboard:3000 will not work against https://dashboard.bugfender.com/api.
{
"mcpServers": {
"bugfender": {
"command": "npx",
"args": ["-y", "@bugfender/mcp"],
"env": {
"BUGFENDER_API_TOKEN": "YOUR_ACCESS_TOKEN",
"BUGFENDER_REFRESH_TOKEN": "YOUR_REFRESH_TOKEN",
"BUGFENDER_API_URL": "https://dashboard.bugfender.com/api"
}
}
}
}codex mcp add bugfender \
--env BUGFENDER_API_TOKEN='YOUR_ACCESS_TOKEN' \
--env BUGFENDER_REFRESH_TOKEN='YOUR_REFRESH_TOKEN' \
--env BUGFENDER_API_URL='https://dashboard.bugfender.com/api' \
-- npx -y @bugfender/mcpAfter running codex mcp add, restart the Codex session before testing who_am_i or list_apps.
gemini mcp add bugfender npx -y @bugfender/mcp \
--env BUGFENDER_API_TOKEN='YOUR_ACCESS_TOKEN' \
--env BUGFENDER_REFRESH_TOKEN='YOUR_REFRESH_TOKEN' \
--env BUGFENDER_API_URL='https://dashboard.bugfender.com/api'After running gemini mcp add, start a new Gemini CLI session or reload MCP servers before testing who_am_i or list_apps.
In the custom MCP server form:
Name: bugfenderCommand to launch: npxArgument 1: -yArgument 2: @bugfender/mcpBUGFENDER_API_TOKEN: YOUR_ACCESS_TOKENBUGFENDER_REFRESH_TOKEN: YOUR_REFRESH_TOKENBUGFENDER_API_URL: https://dashboard.bugfender.com/apiAdd the arguments as separate rows, not as one combined string.
After saving the server, restart the app before testing who_am_i or list_apps.
who_am_ilist_teamslist_appsget_applist_app_versionsget_sdk_snippetget_crashesget_crash_statsget_crash_device_statsget_crash_detailssearch_logscount_logscount_devices_with_logsget_network_aggregatesget_network_detailssearch_devicescount_deviceslist_issuesget_issueupdate_issue_statusget_issue_statsget_issue_device_statsget_issue_devicesget_feedbackget_app_summarybugfender://snippet/{app_id}/{platform}bugfender://app/{app_id}/logs?...bugfender://issue/{issue_id}?app_id={app_id}The companion skills now live in the separate bugfender/bugfender-skills repository. They encode opinionated workflows on top of the MCP tools:
The MCP package gives the agent raw Bugfender capabilities. The skill adds an opinionated investigation workflow on top of those capabilities.
Use the skill when you want Cursor, Codex, or Claude Code to do things like:
The investigation skill source lives in:
https://github.com/bugfender/bugfender-skills/tree/main/skills/bugfenderThe dedicated onboarding skill also lives in bugfender/bugfender-skills.
Use it when you want Cursor, Codex, or Claude Code to:
It also includes platform-specific references for:
The skill source lives in:
https://github.com/bugfender/bugfender-skills/tree/main/skills/bugfender-sdk-setupCursor, Codex, and Claude Code can install the skills directly from GitHub without cloning the repo manually.
In the agent chat inside your IDE, run this prompt with the built-in installer skill:
Use $skill-installer to install these skills from https://github.com/bugfender/bugfender-skills:
- skills/bugfender
- skills/bugfender-sdk-setupAfter installation, restart the client and use:
Use $bugfender-sdk-setup to set up Bugfender in this app with the minimum required changes.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.