Log inSubmit server
Sast MCP Server logo

Sast MCP Server

by Skyrxin

MCP server for multi-scanner SAST, DAST, secret detection, reporting, integrations, and verified remediation.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Sast MCP Server

Pick your client, then add it in one click or paste the config.

STDIOPython
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "skyrxin-sast-mcp-server": {
      "command": "uvx",
      "args": [
        "sast-mcp-server"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Install not yet sandbox-tested— the server itself is confirmed live (we called its tools/list endpoint). The stdio install command is a separate, ongoing check.

Overview

Skyrxin/sast-mcp-server MCP server exposes security scanning and remediation workflows through MCP, covering source code, dependencies, infrastructure-as-code, container images, Git history, and running applications. It detects installed scanners, normalizes and deduplicates findings, and supports SARIF, SBOM, baseline, compliance, and policy outputs. Remediation tools can generate unified-diff prompts, apply patches safely, and re-scan to verify fixes. Reach for it when an MCP-compatible agent needs local or remotely hosted security analysis tied to CI or issue-tracking workflows.

Use cases

  • Scan modified files during an AI-assisted code review
  • Find secrets committed in a repository's Git history
  • Gate CI with severity thresholds and baseline comparisons
  • Export findings for GitHub Code Scanning or DefectDojo
  • Apply and verify agent-generated security patches

Key features

  • Parallel multi-scanner scans with deduplication
  • SAST, SCA, secret, IaC, image, and DAST analysis
  • SARIF, SBOM, HTML, PDF, and compliance reporting
  • Baseline comparison and policy evaluation
  • Unified-diff remediation with verification and rollback
  • GitHub, GitLab, DefectDojo, Slack, Teams, and Jira workflows

Tools27

What Sast MCP Server lets your agent do. Expand a tool for its parameters.

Verified live~5.1k tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked Today

Recent health check succeeded.

22/23 checks healthy over the last 90d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 5d ago via OSV.dev · sast-mcp-server (PyPI)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars4Stargazers on the source repository.
Last commit4mo agoMost recent push to the default branch.
Tools exposed27Callable tools this server registers over MCP.
Directory activity5 viewsConfig copies, upvotes, and views on AllMCPs.

How Sast MCP Server works

What Skyrxin/sast-mcp-server MCP server does

Skyrxin/sast-mcp-server MCP server connects AI agents to a collection of security scanners through the Model Context Protocol. It supports Bandit, njsscan, Bearer, Semgrep, Trivy, CodeQL, Checkov, Gitleaks, OSV-Scanner, Grype, and OWASP ZAP. The available coverage includes application code, dependencies, secrets, infrastructure-as-code, container images, Git history, and dynamic scans of applications running through Docker Compose.

Results are returned in a normalized finding format. The server can filter by severity and confidence, restrict scans to Git-modified files, paginate large result sets, and deduplicate findings when multiple scanners report the same issue. list_scanners reports which scanners are installed, their supported languages or scopes, and installation guidance.

How it works

Install the Python package or run it with uvx, then make the scanner executables available in the same environment. The full container image bundles nine scanners; CodeQL is supplied separately because of its size, while OWASP ZAP runs through Docker when an active scan is requested. The server reports the scanners it can find at startup and through its readiness information.

Local deployments use stdio. The project also supports Streamable HTTP for remote deployments, with JWT and API-key authentication described as available server features. Gemini CLI, Claude Desktop, Cursor, Windsurf, and OpenAI Agents usage are documented in the project material.

Setup and configuration

The minimal installation is pip install sast-mcp-server; the [scanners] extra adds Bandit, njsscan, Semgrep, and Checkov. The full image is available as ghcr.io/skyrxin/sast-mcp-server:full, and Docker Compose can expose an HTTP endpoint on port 8080. Binary tools such as Trivy, Grype, Gitleaks, OSV-Scanner, and Bearer require their own installation paths when they are not supplied by the image.

Optional environment variables configure external destinations rather than basic local scanning. GitHub uploads use GITHUB_TOKEN, DefectDojo uses DEFECTDOJO_URL and DEFECTDOJO_API_KEY, Slack uses SLACK_WEBHOOK_URL, Teams uses TEAMS_WEBHOOK_URL, and Jira uses JIRA_URL, JIRA_EMAIL, and JIRA_API_TOKEN. GitLab merge-request comments use GITLAB_TOKEN and may use GITLAB_URL.

Tools and capabilities

The Skyrxin/sast-mcp-server MCP server provides focused and aggregate scan operations. scan_vulnerabilities runs one selected scanner, while scan_all runs every installed scanner in parallel and removes duplicate findings. scan_image examines container images, and scan_git_history uses Gitleaks against committed history. run_active_scan starts a Docker Compose application and runs an OWASP ZAP baseline scan.

Results can be exported as SARIF 2.1.0, CycloneDX or SPDX SBOM output, HTML or PDF reports, and compliance views for OWASP Top 10, SANS CWE Top 25, PCI DSS, or CIS. Baselines support comparisons of new and fixed findings, while evaluate_policy returns a pipeline-oriented pass or fail result with severity thresholds and optional new-finding checks.

Operational tools include ignore-list management, SARIF import, DefectDojo and GitHub uploads, GitHub or GitLab review comments, Slack and Teams notifications, and Jira issue creation. Remediation uses generate_fix_prompt, apply_patch, and remediate_and_verify; the latter can dry-run and roll back a patch, then confirms that the original finding disappeared without introducing an equal-or-higher severity issue. triage_finding supports exploitability prompts and VEX decisions.

Limitations and notes

Scanner coverage depends on which executables are installed and available to the server. CodeQL is not included in the full image, and OWASP ZAP requires Docker for active scans. Upload and notification tools require the corresponding credentials and destination configuration. Active scanning also requires an application stack that can be started with Docker Compose. Patch application is limited to files under the selected target directory and uses git apply validation.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Sast MCP Server

Skyrxin/sast-mcp-server is an MCP server that connects AI agents to security scanners including Bandit, Semgrep, Trivy, CodeQL, Checkov, Gitleaks, OSV-Scanner, Grype, and OWASP ZAP. Its main tools scan code, images, Git history, and running applications, then export, triage, or verify findings.

Install it with `pip install sast-mcp-server`, run it with `uvx sast-mcp-server`, or pull the full Docker image. The `[scanners]` extra adds four pip-installable scanners; other scanners may require separate binary installation.

Yes, Cursor is documented as a supported client. Add the server to Cursor Settings → MCP Servers using a stdio configuration that runs `uvx` with `sast-mcp-server` as its argument.

Generate a SARIF file with `export_sarif`, then use `upload_to_github` with a `GITHUB_TOKEN` that has the `security_events: write` scope.

Use `remediate_and_verify` to dry-run the patch, scan before and after applying it, and confirm that the target finding is gone without a new finding of equal or higher severity. Failed changes can be rolled back when enabled.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewSast MCP Server AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/skyrxin-sast-mcp-server?style=directory)](https://allmcps.com/mcp/skyrxin-sast-mcp-server)
HTML Embed
<a href="https://allmcps.com/mcp/skyrxin-sast-mcp-server"><img src="https://allmcps.com/api/badge/skyrxin-sast-mcp-server?style=directory" alt="Sast MCP Server on AllMCPs" /></a>