菜单
Install and verify the harness-code-security-mcp npm MCP server. Use when sl_* MCP tools are missing, setup is requested, or Qwiet auth needs diagnosis.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Request or fetch Qwiet recommended fixes and branch autofixes. Invoke when the user runs /autofix-vuln or asks for autofix, recommended fix, or remediation after triage. Do NOT satisfy autofix by calling sl_get_recommended_fix* without this skill active; run /autofix-vuln first.
Run code analysis via sl analyze or look up package CVEs (Intelligent SCA) via Qwiet. Invoke when the user runs /run-security-scan or asks to scan code or run sl analyze. Do NOT use for triage or autofix — those require /triage-vuln and /autofix-vuln.
List and explain findings from a scan with data flow. Invoke when the user runs /triage-vuln or says triage, review findings, or investigate finding ids after a scan. Do NOT satisfy triage by calling sl_* tools without this skill active; run /triage-vuln first.
| name | setup-harness-code-security-mcp |
| description | Install and verify the harness-code-security-mcp npm MCP server. Use when sl_* MCP tools are missing, setup is requested, or Qwiet auth needs diagnosis. |
| argument-hint | [--install] [--package harness-code-security-mcp] [--version latest] |
Install and connect the harness-code-security-mcp npm package (sl_whoami, sl_analyze, triage, AutoFix).
node scripts/doctor.mjs
Install the npm launcher if missing:
node scripts/doctor.mjs --install
sl auth → ~/.shiftleft/config.json with orgId and accessTokenharness-code-security-mcp configured in the agentTerminal or Bash inside a session:
claude mcp add harness-code-security-mcp -- npx -y harness-code-security-mcp
If -- parsing fails, use JSON:
claude mcp add-json harness-code-security-mcp '{"type":"stdio","command":"npx","args":["-y","harness-code-security-mcp"]}'
Run /mcp to verify. Tools are prefixed: mcp__harness-code-security-mcp__sl_whoami.
Windows: claude mcp add harness-code-security-mcp -- cmd /c npx -y harness-code-security-mcp
{
"mcpServers": {
"harness-code-security-mcp": {
"command": "harness-code-security-mcp"
}
}
}
Use npx -y harness-code-security-mcp instead of a global install if preferred. No env block required (defaults: app.shiftleft.io, ~/.shiftleft).
Reconnect MCP or start a new session, then call sl_whoami. Success → activeOrganizationId matches config orgId.