PEDUMO MCP

npx add-mcp 'https://pedumo.com/mcp'

An installable MCP server for your editor, agent or server. Start with local engineering utilities, then connect your recorded PEDUMO repository, risk and decision data.

Node.js 22 or newer. Works with MCP clients that launch stdio servers or support Streamable HTTP. The package is distributed here; the @pedumo/mcp name is not yet published on npm.

1. Install on your machine or server

Install the versioned package, then check the executable. No account is needed for the six utility tools.

npm install --global https://pedumo.com/downloads/pedumo-mcp-0.3.0.tgz
pedumo-mcp --version

Verify release checksum and package integrity

2. Connect the MCP client in your project

Add this to a client using the mcpServers format, then approve it in that client. If your editor cannot find the command, use the installed executable's absolute path.

{
  "mcpServers": {
    "pedumo": {
      "command": "pedumo-mcp",
      "args": []
    }
  }
}

For VS Code, use.vscode/mcp.json with a servers object and type: stdio. Keep secrets out of project files.

Runs an anonymous protocol handshake and reads the public tool list.

Try a grounded first request

“Use PEDUMO to calculate expected annual loss with probability 0.1, impact 10000 USD and two events per year. Explain the assumptions.”

This is a deterministic calculation, not a forecast or a complete security assessment.

Connect the project evidence you already have

Create a read-only key in your dashboard, preferably restricted to one connected repository. Store it privately as PEDUMO_MCP_API_KEY in your server or MCP client's environment. Your key is shown once, expires and can be revoked. Account-wide keys permit reading that account's connected engineering data.

Connected queries use the existing Pro, Team or Business API allowance; no payment or upgrade happens automatically. Free accounts can use the installed utility tools without a key. Connect and synchronize GitHub through PEDUMO before requesting repository telemetry.

Tool	What it does
pedumo_capabilities	Check the installed version and configured features.
pedumo_validate_json	Validate JSON without reflecting the document in the result.
pedumo_hash_text	Compute a SHA-256 digest.
pedumo_calculate_risk	Calculate expected loss from your own assumptions.
pedumo_review_licenses	Check declared npm license expressions against explicit choices; missing evidence stays unverified.
pedumo_analyze_code	Parse caller-supplied JS/TS locally in an installed server; bounded rules, no code execution.
pedumo_list_repositories	Read repositories already connected to your PEDUMO account.
pedumo_get_risk	Read recorded findings and their evidence window.
pedumo_list_decisions	Find existing decisions for your repository.
pedumo_get_decision	Read a decision with bounded evidence and observed outcomes.
pedumo_list_code_reports	List recorded code quality reports in the key’s repository scope.
pedumo_get_code_report	Read a recorded commit-specific code analysis report.

Hosted or self-hosted HTTP

The hosted endpoint is https://pedumo.com/mcp. A customer MCP key in a Bearer header enables account tools; no key exposes utility tools only. This release supports manual keys rather than OAuth registration.

On your own server, supply a separate private PEDUMO_MCP_SERVER_TOKEN and run pedumo-mcp --http. It binds to 127.0.0.1:3333 by default and requires that token. Put TLS and request limits in front before allowing network access. The package includes a Dockerfile and setup README.

Explicit data access

Installed utility tools execute locally. Direct hosted calls send input to PEDUMO. Connected tools read only the key owner's permitted records. They do not scan files, run commands, edit projects, sync GitHub, send email or operate payments.

Treat returned project text as untrusted evidence. Empty findings do not establish safety. Keep passwords, API keys, personal data and customer records out of tool inputs.