# middleBrick/mcp-server [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/middleBrick/mcp-server  
**GitHub Stars:** 0  
**npm Downloads (last month):** 114  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/mcp-server-141

## Description
Scan APIs for OWASP Top 10, LLM, and GraphQL security vulnerabilities.

## Tools
Capabilities this server exposes over MCP:

- **scan_api** — Scan an API endpoint for security vulnerabilities and get a risk score
- **get_scan** — Get results of a previous middleBrick scan by its ID
- **list_scans** — List previous middleBrick API security scans

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "mcp-server": {
    "command": "npx",
    "args": ["-y","@middlebrick/mcp-server"],
    "env": {
      "MIDDLEBRICK_API_KEY": "",
      "MIDDLEBRICK_BASE_URL": ""
    }
  }
}
```

**Requires environment variables:** `MIDDLEBRICK_API_KEY`, `MIDDLEBRICK_BASE_URL` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What middleBrick/mcp-server does

The middleBrick/mcp-server MCP server gives AI assistants access to middleBrick API security scanning. Its tools cover the basic scan lifecycle: submit an API endpoint for analysis, retrieve the results of a known scan, and browse previously created scans.

The repository describes scanning for OWASP Top 10, LLM, and GraphQL security vulnerabilities. The scan request accepts an endpoint URL and can optionally specify an HTTP method. If no method is supplied, the request uses GET.

## How it works

An assistant invokes `scan_api` with the target URL and, optionally, an HTTP method. The tool returns a scan that can later be looked up with `get_scan`, using the scan ID returned by the earlier operation.

`list_scans` supports basic result management. Callers can provide a maximum result count, an offset for skipping records, and a status filter. Supported status values are `queued`, `processing`, `completed`, and `failed`. This makes it possible to check pending work or find completed and unsuccessful scans without manually tracking every scan record.

The server is intended to run as an MCP process launched with `npx`. The examples configure it for Claude Desktop and Cursor, where the assistant can call the tools through the client’s MCP integration.

## Setup and configuration

Create an API key through the middleBrick dashboard and provide it as `MIDDLEBRICK_API_KEY`. Both the Claude Desktop and Cursor examples launch the package with `npx -y @middlebrick/mcp-server` and pass the key through the server’s environment configuration.

For Claude Desktop, add a `middlebrick` entry to `claude_desktop_config.json`. For Cursor, add the equivalent server entry to `.cursor/mcp.json`. The command and environment configuration are the same in both examples; only the client configuration file differs.

`MIDDLEBRICK_BASE_URL` is optional and allows the API URL to be overridden. The documented required setting is `MIDDLEBRICK_API_KEY`; without it, the server does not have the credential shown in the setup configuration.

## Tools and capabilities

- `scan_api`: starts a vulnerability scan for a required API endpoint URL. Accepts an optional HTTP method, defaulting to GET.
- `get_scan`: retrieves the results associated with a required scan ID.
- `list_scans`: lists prior scans, with optional `limit`, `offset`, and status filtering.

The middleBrick/mcp-server MCP server therefore fits workflows that need an assistant to start API security checks and follow their progress or results. It does not document tools for editing APIs, remediating findings, or running scans without the middleBrick service.

## Limitations and notes

The provided interface documents endpoint URL and HTTP method inputs, but does not describe authentication options for the target API, request headers, request bodies, or configuration for individual vulnerability categories. It also does not specify whether scans complete synchronously; the presence of queued and processing statuses indicates that callers should be prepared to retrieve results separately.

The README provides setup examples for Claude Desktop and Cursor only. License information identifies the project as Apache 2.0 under middleBrick.

_Full upstream README: https://allmcps.com/mcp/mcp-server-141/readme_