Security Scanner AI MCP

What security-scanner-ai-mcp MCP server does

The security-scanner-ai-mcp MCP server provides an MCP interface for several application and software supply-chain security activities. The README describes support for vulnerability assessment, static application security testing (SAST), dynamic application security testing (DAST), dependency checking, and software bill of materials (SBOM) analysis.

The documented examples identify three tools by name: scan_dependencies, check_headers, and scan_secrets. These tools cover dependency scanning, HTTP header checks, and secret detection. The README does not provide detailed input schemas, output formats, supported languages, or scanner engines, so those details should be confirmed in the linked API reference before building an automated workflow around them.

How it works

The security-scanner-ai-mcp MCP server is configured as a local process using the stdio transport. An MCP client starts the server and communicates with it over standard input and output. After configuration, a user can ask an assistant to invoke a named tool, such as requesting a dependency scan or a header check.

This model suits development environments where the source, dependency files, or scan targets are available to the local MCP client. The supplied material does not document a hosted endpoint, OAuth flow, API token, database connection, or remote execution service.

The project also states that it is designed with EU AI Act compliance considerations, including risk management, transparency and instructions for use, bias detection and testing, FRIA support where applicable, and AI content watermarking where applicable. These are project claims; the excerpt does not explain how each requirement is implemented or produce compliance evidence automatically.

Setup and configuration

The package can be installed from PyPI with pip install security_scanner_ai_mcp, while the MCP configuration example uses the executable name security-scanner-ai-mcp through uvx. A Claude Desktop configuration can be added under the mcpServers object:

{
  "mcpServers": {
    "security-scanner-ai-mcp": {
      "command": "uvx",
      "args": ["security-scanner-ai-mcp"]
    }
  }
}

The README also says that installing the package with pip makes the security-scanner-ai-mcp command available for stdio use. No environment variables or credentials are listed in the provided material. Documentation links point to a project documentation site and an API reference, which should be consulted for tool parameters and operational requirements.

Tools and capabilities

The security-scanner-ai-mcp MCP server’s documented tool examples are:

• scan_dependencies for dependency scanning.
• check_headers for checking security-related headers.
• scan_secrets for detecting exposed secrets.

At the feature level, the project also identifies SAST, DAST, vulnerability assessment, and SBOM analysis. The excerpt does not establish whether each of those areas has a separate MCP tool or describe how targets are supplied. It is therefore best treated as a capability overview rather than a complete API specification.

Limitations and notes

The README does not specify supported operating systems, programming languages, file formats, scanner backends, network requirements, result severity models, or CI integrations. It also does not describe authentication, rate limits, data retention, or remediation features.

Installation is presented as free, but the project separately lists Pro and Enterprise offerings with additional services. The repository states that the code is MIT-licensed. Claude Desktop compatibility is shown explicitly; compatibility with other MCP clients is not established by the supplied excerpt.