Skip to main content

Installation by client

The @shiftleftpt/sbd-toe-mcp server is distributed exclusively via npm (plus an alternative GitHub Release bundle) and runs as a stdio process — compatible with any standard MCP client.

Prior requirements​

RequirementDetail
Node.js≥ 20.9.0
Access to the npm registryPublic — no token needed
Disk spaceA few tens of MB (snapshot of the Manual, KG and ontology)
NetworkOnly on first start (npx does the fetch) or on upgrades
Offline / air-gapped mode

For environments without npm access, download the bundle from the GitHub Release, verify the .sha256 and reference the extracted dist/index.js via command: "node" (see the section GitHub Release Bundle).

Claude Code (CLI)​

The simplest form — one command, zero file editing:

claude mcp add sbd-toe -- npx -y @shiftleftpt/sbd-toe-mcp

To verify:

claude mcp list

To remove:

claude mcp remove sbd-toe

The configuration is stored in ~/.claude.json (global scope) or in .mcp.json (project scope, with --scope project).

Claude Desktop (macOS / Windows)​

Edit the file claude_desktop_config.json:

  • macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
  • Windows: %APPDATA%\Claude\claude_desktop_config.json
{
  "mcpServers": {
    "sbd-toe": {
      "command": "npx",
      "args": ["-y", "@shiftleftpt/sbd-toe-mcp"]
    }
  }
}

Restart Claude Desktop. The sbd-toe.* tools appear in the conversation's tools panel.

Cursor​

Edit ~/.cursor/mcp.json (global) or .cursor/mcp.json in the repository (per project):

{
  "mcpServers": {
    "sbd-toe": {
      "command": "npx",
      "args": ["-y", "@shiftleftpt/sbd-toe-mcp"]
    }
  }
}

Under Settings → Features → MCP, confirm that sbd-toe appears as running (green badge).

VS Code + GitHub Copilot​

Add .vscode/mcp.json to the repository (auto-detected by Copilot Chat in Agent mode):

{
  "servers": {
    "sbdToe": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@shiftleftpt/sbd-toe-mcp"]
    }
  }
}

Alternatively, global user configuration via Settings UI → Extensions → GitHub Copilot → MCP.

Windsurf (Codeium)​

Edit ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "sbd-toe": {
      "command": "npx",
      "args": ["-y", "@shiftleftpt/sbd-toe-mcp"]
    }
  }
}

Zed​

Edit ~/.config/zed/settings.json, section context_servers:

{
  "context_servers": {
    "sbd-toe": {
      "command": {
        "path": "npx",
        "args": ["-y", "@shiftleftpt/sbd-toe-mcp"]
      }
    }
  }
}

Other MCP clients​

Any client that supports the stdio transport of MCP uses the same pattern: command: "npx" + args: ["-y", "@shiftleftpt/sbd-toe-mcp"]. The client's documentation gives the location of the configuration file.

GitHub Release Bundle​

For environments without access to npm (air-gapped, self-hosted) or for pinning to a specific version:

  1. Download the bundle from github.com/SbD-ToE/sbd-toe-mcp/releases — sbd-toe-mcp-v<versão>-bundle.tar.gz (or .zip) — and its .sha256, and verify the checksum before extracting.
  2. Extract to a known path — /opt/sbd-toe-mcp/ for example.
  3. Reference dist/index.js instead of npx:
{
  "mcpServers": {
    "sbd-toe": {
      "command": "node",
      "args": ["/opt/sbd-toe-mcp/dist/index.js"]
    }
  }
}

Determining the project's risk level​

Without the correct risk level, MCP returns a set of controls that is needlessly broad or dangerously narrow. The level is computed with the Ch. 01 method (exposure, data and impact axes, E+D+I). The indicators below are illustrative hints, neither necessary nor sufficient, and the regulatory context is declared separately: a regime does not imply L3.

Indicator (illustrative)Typically
Internal application with low impact (even with personal data, if E+D+I ≤ 4)L1
Public APIs or processing of user dataL2
Public exposure with sensitive data and high impactL3

The level decision follows the method of Ch. 01 — no tool takes it on the project's behalf. The tool map_sbd_toe_applicability requires riskLevel and accepts technologies, hasPersonalData, isPublicFacing and projectRole: it does not decide the level, but it shows the effect of each level on the project, which helps compare the alternatives when in doubt.

Final verification​

Whatever the client, validate with:

list_sbd_toe_chapters()

It should return 15 chapters (00-fundamentos to 14-governanca-contratacao). If so — it is operational.

Next​

Configure a skill / agent file so that the AI client consults the Manual automatically instead of requiring the user to ask explicitly.