> ## Documentation Index
> Fetch the complete documentation index at: https://acm-aa28ebf6.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# superbox push

> Publish MCP server to SuperBox registry with comprehensive security scanning

## Usage

```bash theme={null}
superbox push [--name NAME] [--force]
```

## Description

Publish an MCP server to the R2-backed registry with comprehensive security scanning.

<Warning>Requires authentication - run `superbox auth login` first</Warning>

## Options

<ParamField path="--name" type="string">
  MCP server name (reads from `superbox.json` if not provided)
</ParamField>

<ParamField path="--force" type="boolean">
  Force overwrite if server already exists in registry
</ParamField>

## What It Does

<Steps>
  <Step title="SonarCloud Analysis">
    Runs SonarCloud static analysis and waits for the quality gate result.
  </Step>

  <Step title="Tool Discovery">
    Clones the repository to a temp directory and discovers MCP tools via regex (finds `@*.tool()` decorated functions).
  </Step>

  <Step title="Snyk Dependency Scan">
    Scans Python dependencies for known CVEs.
  </Step>

  <Step title="GitGuardian Scan">
    Scans for exposed secrets and credentials in the repository.
  </Step>

  <Step title="Bandit Security Scan">
    Python-specific security vulnerability analysis.
  </Step>

  <Step title="Upload to R2">
    Uploads server metadata and security report to the R2 registry as `{name}.json`.
  </Step>
</Steps>

## Security Pipeline

The 5-step security check includes:

* **SonarCloud**: Code quality, bugs, code smells, security hotspots
* **Tool Discovery**: Validates MCP tool definitions exist in source code
* **Snyk**: Dependency vulnerability detection
* **GitGuardian**: Secret detection (API keys, tokens, credentials)
* **Bandit**: Python security issues (SQL injection, XSS, etc.)

## Prerequisites

<CardGroup cols={2}>
  <Card title="superbox.json" icon="file">
    Run `superbox init` first
  </Card>

  <Card title="Environment Variables" icon="key">
    Configure `.env` with Cloudflare R2, SonarCloud, Snyk, and GitGuardian credentials
  </Card>
</CardGroup>

## Examples

<CodeGroup>
  ```bash Basic Push theme={null}
  superbox push --name my-mcp
  ```

  ```bash Force Overwrite theme={null}
  superbox push --name my-mcp --force
  ```

  ```bash Using superbox.json theme={null}
  superbox push
  # Reads name from superbox.json
  ```
</CodeGroup>

## Example Output

```bash theme={null}
$ superbox push --name weather-mcp
Pushing server: weather-mcp
Running SonarCloud analysis...
SonarCloud scan complete
Discovering tools...
Found 3 tools
Running Snyk dependency scan...
No vulnerabilities found
Running GitGuardian scan...
No secrets detected
Running Bandit scan...
Security checks passed
Uploading to R2 registry...
Push complete
```

## Next Steps

<CardGroup cols={2}>
  <Card title="View Server" icon="eye" href="/cli/inspect">
    Inspect published server
  </Card>

  <Card title="Test Server" icon="flask" href="/cli/test">
    Test before publishing
  </Card>
</CardGroup>