superbox push

Publish MCP server to SuperBox registry with comprehensive security scanning

Usage

superbox push [--name NAME] [--force]

Description

Publish an MCP server to the R2-backed registry with comprehensive security scanning.

Requires authentication - run superbox auth login first

Options

--name · string

MCP server name (reads from superbox.json if not provided)

--force · boolean

Force overwrite if server already exists in registry

What It Does

1. SonarCloud Analysis

   Runs SonarCloud static analysis and waits for the quality gate result.

2. Tool Discovery

   Clones the repository to a temp directory and discovers MCP tools via regex (finds @*.tool() decorated functions).

3. Snyk Dependency Scan

   Scans Python dependencies for known CVEs.

4. GitGuardian Scan

   Scans for exposed secrets and credentials in the repository.

5. Bandit Security Scan

   Python-specific security vulnerability analysis.

6. Upload to R2

   Uploads server metadata and security report to the R2 registry as {name}.json.

Security Pipeline

The 5-step security check includes:

• SonarCloud: Code quality, bugs, code smells, security hotspots
• Tool Discovery: Validates MCP tool definitions exist in source code
• Snyk: Dependency vulnerability detection
• GitGuardian: Secret detection (API keys, tokens, credentials)
• Bandit: Python security issues (SQL injection, XSS, etc.)

Prerequisites

superbox.json

Run superbox init first

Environment Variables

Configure .env with Cloudflare R2, SonarCloud, Snyk, and GitGuardian credentials

Examples

Basic Push

superbox push --name my-mcp

Example Output

$ superbox push --name weather-mcp
Pushing server: weather-mcp
Running SonarCloud analysis...
SonarCloud scan complete
Discovering tools...
Found 3 tools
Running Snyk dependency scan...
No vulnerabilities found
Running GitGuardian scan...
No secrets detected
Running Bandit scan...
Security checks passed
Uploading to R2 registry...
Push complete

Next Steps

View Server

Inspect published server

Test Server

Test before publishing