Cursor, Claude Code & VS Code MCP + GitHub Actions: scan for unwrapped AI calls

spurvik-mcp-server (version 1.0.4, MIT, Node 20+) is a local stdio Model Context Protocol server and CLI with zero runtime npm sub-dependencies (@modelcontextprotocol/sdk 1.32.1 is bundled in dist/index.js). It runs inside your IDE and pull requests with zero network calls and no Spurvik account required:

1. spurvik_find_unwrapped_calls (and spurvik-mcp check . --ci): scans TypeScript and JavaScript files for OpenAI, Anthropic, Google GenAI, Vercel AI SDK, Mastra, OpenAI Agents and LangGraph calls that are not wrapped with spurvik@1.0.8.
2. spurvik_setup_snippet (and spurvik-mcp snippet <framework> [runtime]): returns exact wrapper snippets for openai, anthropic, google-genai, vercel-ai-sdk, mastra, openai-agents and langgraph across node, next, vercel and supabase-edge.
3. spurvik_explain_receipt: explains each field of an HMAC-SHA256 provenance receipt and what a valid signature does and does not show.
4. spurvik_marking_hooks (and spurvik-mcp marking-hooks [text|media|both]): prints where to plug your own Article 50(2) marking tool into config.marking.

Install & scan in 15 seconds

Run both commands in your project root (a folder with package.json or .git):

npm i -D spurvik-mcp-server@1.0.4

./node_modules/.bin/spurvik-mcp check . --ci

Pass --json instead of --ci if another script consumes the file and line findings as JSON.

Wire into Cursor, VS Code & Claude Code

In Cursor, save .cursor/mcp.json in your repository root:

{
  "mcpServers": {
    "spurvik": {
      "type": "stdio",
      "command": "node",
      "args": ["${workspaceFolder}/node_modules/spurvik-mcp-server/dist/index.js", "--root", "${workspaceFolder}"]
    }
  }
}

In VS Code (GitHub Copilot agent mode), save .vscode/mcp.json (note the top-level "servers" key):

{
  "servers": {
    "spurvik": {
      "type": "stdio",
      "command": "node",
      "args": ["${workspaceFolder}/node_modules/spurvik-mcp-server/dist/index.js", "--root", "${workspaceFolder}"]
    }
  }
}

In Claude Code, either install the Spurvik plugin from GitHub or register the local stdio server in your project:

claude mcp add spurvik -- node ./node_modules/spurvik-mcp-server/dist/index.js --root .
# Or inside an interactive Claude Code session:
# /plugin marketplace add spurvik/spurvik
# /plugin install spurvik@spurvik-marketplace

Gate pull requests with GitHub Actions

Drop the workflow template (download github-action-spurvik-check.yml) into .github/workflows/spurvik-check.yml so pull requests with detectable unwrapped openai.chat.completions.create(...), generateText(...), or agent calls fail before merge:

mkdir -p .github/workflows && curl -fsSL https://spurvik.com/r/github-action-spurvik-check.yml -o .github/workflows/spurvik-check.yml

Scope & heuristic boundaries

• Heuristic file scan, not an AST proof: check inspects .ts, .tsx, .js, .jsx, .mjs, .cjs, .mts and .cts files under your root (skipping node_modules, .git, dist, build, .next, coverage and files larger than 1 MB). Custom wrapper functions can be over-reported, and dynamically constructed calls can be missed.
• Safe root policy: --root refuses /, your home directory, OS system paths, and dot-directories directly inside $HOME (such as ~/.config). Run it inside a normal project repository.
• Not legal compliance or Art. 50(2) marking: wrapping calls with spurvik@1.0.8 records keyed HMAC-SHA256 digests (0 bytes of prompt text in default keyed mode) and wires Art. 50(1) notice and human approval hooks. You still classify riskTier yourself and plug your own marking tool into config.marking where Art. 50(2) applies.

From local CI check to EU-hosted DPO & Annex IV exports

Local checks catch unwrapped calls before merge. When your service runs in staging or production and your DPO, enterprise buyer or counsel asks for retained audit evidence, connect your wrapped SDK to the Frankfurt (fra1) control plane:

• Free (€0/mo): 10,000 events/mo, 30-day log retention in Frankfurt (fra1), live project API keys.
• Pro (€19/mo or €190/yr, excl. VAT · B2B only): 250,000 events/mo, 90-day log retention, hosted human oversight review queue, Plain English Obligations Map, downloadable DPO Engineering Summary (.md & .json), and Annex IV technical documentation draft (Markdown, HTML, PDF).

npm i -D spurvik-mcp-server@1.0.4 && ./node_modules/.bin/spurvik-mcp check . --ci

FAQ

Does spurvik-mcp-server send my source code over the network?

No. The local stdio server and the spurvik-mcp check CLI run on your machine or CI runner and make zero network calls. Only npm install downloads the package itself.

Do I need a Spurvik account or API key to use the MCP server or CI check?

No. spurvik-mcp-server 1.0.4 is MIT licensed and runs without an account or API key. You only create a console.spurvik.com workspace when you want hosted Frankfurt (fra1) event storage, the human review queue, or DPO and Annex IV exports.

Is spurvik-mcp check a full AST or runtime compliance guarantee?

No. It is a fast heuristic pattern scan across TypeScript and JavaScript source files (.ts, .tsx, .js, .jsx, .mjs, .cjs, .mts, .cts). Custom wrapper helpers can be over-reported, dynamic calls can be missed, and passing the check does not make a system compliant with the EU AI Act.

Why did spurvik-mcp exit with code 2 and say the workspace root is not allowed?

For safety, the server refuses filesystem roots such as /, your home directory, system directories, and hidden dot-directories directly under your home folder. Run it inside a normal project directory that contains package.json or .git.

Can I call the MCP tools over HTTP without installing a local binary?

Yes, for read-only snippet, receipt, and marking-hook lookups at https://console.spurvik.com/api/mcp (MCP protocol 2025-06-18, no API key required). Scanning local repository files with spurvik_find_unwrapped_calls requires the local stdio server.

Sources

• npm: https://www.npmjs.com/package/spurvik-mcp-server (1.0.4; MIT, Node 20+, inspected 12 Nov 2026)
• Source (MIT): https://github.com/spurvik/spurvik/tree/main/packages/mcp
• Remote MCP discovery: https://spurvik.com/.well-known/mcp.json
• Article 50 dates & checklist: https://spurvik.com/art50-deadline-checklist

Reviewed 12 November 2026. Not legal advice. Supports parts of your EU AI Act engineering work; responsibility stays with you. EyeTea Solutions ApS · Trekantområdet, Denmark