Skip to main content

Quickstart — 60 seconds

The quickest way to evaluate the MCP is to try it for a minute and watch the AI client cite the Manual with IDs instead of paraphrasing it. There is nothing to clone and no credentials to configure — the server is published on npm and starts via npx.

Prior requirement​

Option 1 — Claude Code (CLI)​

claude mcp add sbd-toe -- npx -y @shiftleftpt/sbd-toe-mcp

And that is it. In a new Claude Code session, it is enough to ask:

"List the chapters of the SbD-ToE Manual."

The session should start with the tool list_sbd_toe_chapters returning the 15 chapters.

Option 2 — Cursor / Claude Desktop / Windsurf​

Add to the client's MCP configuration file:

{
  "mcpServers": {
    "sbd-toe": {
      "command": "npx",
      "args": ["-y", "@shiftleftpt/sbd-toe-mcp"]
    }
  }
}

After restarting the client, the sbd-toe.* tools become available automatically.

Option 3 — VS Code + GitHub Copilot​

.vscode/mcp.json in the repository:

{
  "servers": {
    "sbdToe": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@shiftleftpt/sbd-toe-mcp"]
    }
  }
}

Validating the connection​

To confirm that the session is really talking to the server (and not merely pretending to), it is enough to ask it for the identity of what it is serving:

read_sbd_toe_resource(uri="sbd://toe/version")

or, alternatively, list_sbd_toe_chapters(). A response with the package name, the version and the provenance (Manual, KG, ontology) — or with the chapter index, with real ids — confirms the connection. A vague response or one without ids indicates that the client is probably improvising; the configuration is worth reviewing before moving on.

In clients that expose MCP prompts, the prompt setup_sbd_toe_agent(riskLevel, projectRole) initialises the session: the response describes what each chapter demands at that level (for example, «predominantly mandatory at L2») and the rules of the role — no chapter is excluded. Clients without prompt support, such as Claude Desktop, do not expose it; for that reason it cannot serve as the only validation.

The first real call​

For a concrete task, the first call is the one the tool descriptions mark as START HERE: select_sbd_toe_requirements, with what the agent has read declared — risk_level, concerns, exposure, data_sensitivity, technologies, changed_files. exposure: "local" is valid but inert: declared on its own, it gives needs_input. The server does not guess from the task text: without a declaration, it returns needs_input with the accepted vocabulary (published in sbd://toe/activation-vocabulary). Details in the tools reference.

What next​

  • Unsure which risk level to apply? See Installation by client → section "Determining the project's risk level".
  • For the AI client to consult the Manual automatically without having to be asked: configure a skill / agent file.
  • Ready-made recipes (audit, codegen, threat model): Use cases.