Gomboc MCP Server

The hosted Gomboc Model Context Protocol (MCP) server gives AI coding agents access to Gomboc rules, classifications, and channels. The Gomboc Community Skills and Gomboc Enterprise Skills use MCP when it is available and fall back to the ORL runtime or local references when it is not.

The hosted endpoint is:

https://mcp.app.gomboc.ai/mcp

Capabilities

The available tools are discovered by your MCP client and may change over time. Current capabilities include:

• Looking up channels and listing the rules in a channel

• Searching for and retrieving rules

• Looking up and searching policy classifications

• Searching channels

• Reporting an external ORL run

Code remediation, AST walking, rule tests, and publishing rules continue to use the ORL runtime rather than MCP.

Prerequisites

Before configuring the server:

1. Install an MCP-compatible AI coding agent, such as Cursor.

2. Generate a Gomboc Personal Access Token.

3. Make the token available to the process that launches your agent:

Treat your personal access token as a secret. Do not add it directly to an MCP configuration file, commit it to source control, or print it in logs.

Configure Cursor

Add the following server definition to your global ~/.cursor/mcp.json file or your project's MCP configuration:

Restart Cursor after setting the environment variable or changing the configuration. If you install the Gomboc Enterprise Skills plugin, Cursor may offer to add this server definition automatically.

Verify the connection

Use the verification command provided by your Gomboc skills package:

Package	Command
Gomboc Community Skills	/gomboc-community:verify-mcp
Gomboc Enterprise Skills	/gomboc:verify-mcp

Verification succeeds when the gomboc server is ready, its tools can be listed, and a read-only get_channels request for the default channel completes successfully.

You can also verify the connection in your agent's MCP settings. The gomboc server should appear as connected with its tools available.

Troubleshooting

If verification fails:

• Confirm that GOMBOC_PAT is set in the environment that launches your agent.

• Confirm that the server URL is exactly https://mcp.app.gomboc.ai/mcp.

• Check that the authorization header uses Bearer ${env:GOMBOC_PAT}.

• Confirm that the personal access token is active.

• Restart the agent after changing the environment or MCP configuration.

An unavailable MCP connection does not block Gomboc skills. They fall back to the Rules Service, Docker-based ORL runtime, or local references as appropriate.