Sast MCP Server vs Agentward — MCP Server Comparison | AllMCPs
Side-by-Side Model Context Protocol Comparison
Sast MCP Server vs Agentward
In-depth architectural comparison of the Sast MCP Server and Agentward MCP servers. Compare execution transports, security boundaries, tool capabilities, quality scores, and ready-to-paste client installation snippets for Claude, Cursor, Windsurf, and VS Code.
At a Glance & Executive Verdict
Sast MCP Server
Security · Local stdio
Quality: 57/100 (Good) | Auth: API Key required
Agentward
Security · Local stdio
Quality: 63/100 (Good) | Auth: No auth required
Verdict Summary: Choose Sast MCP Server if you need specialized Security tools running via a local process. Choose Agentward if your workspace requires Security integration with local subprocess execution. Both servers can be configured concurrently in your client's mcpServers manifest.
Which MCP Server Should You Choose?
Choose Sast MCP Server when:
You need dedicated capabilities in the Security domain.
You prefer local stdio subprocess transport architecture.
Your security boundary fits: API Key required (Free / Open Source).
You have access to required keys: DEFECTDOJO_URL, GITHUB_TOKEN, JIRA_URL, JIRA_EMAIL, JIRA_API_TOKEN.
SAST/DAST server exposing 11 security scanners (Bandit, Semgrep, Trivy, CodeQL, Checkov, Gitleaks, OSV-Scanner, Grype, OWASP ZAP, and more) with closed-loop remediation (scan→patch→re-scan→verify), SARIF/SBOM/VEX export, compliance reporting, and CI integrations (GitHub Advanced Security, DefectDojo, Slack, Jira).
Permission control plane for AI agents. MCP proxy that enforces least-privilege YAML policies on every tool call, classifies sensitive data (PII/PHI), detects dangerous skill chains, and generates compliance audit trails. Supports stdio and HTTP proxy modes.
Category & Scope
Tools & Capabilities Breakdown
Sast MCP Server Tools (27)
scan_vulnerabilities
Scan a target directory for security vulnerabilities using a SAST tool.
ignore_vulnerability
Ignore a specific vulnerability finding so it won't appear in future scans.
unignore_vulnerability
Remove a vulnerability from the ignore list so it appears in future scans again.
list_scanners
List all available SAST scanners, their status, and supported languages.
Returns information about each scanner including whether it is installed
and ready to use, what languages it supports, and how to install it.
list_ignored_vulnerabilities
List all currently ignored vulnerability findings for a project.
Ready-to-Paste Client Configurations
Paste either (or both) of these JSON server blocks into your client config file (e.g. claude_desktop_config.json or ~/.cursor/mcp.json).
Sast MCP Server is categorized under Security and uses a local stdio subprocess. In contrast, Agentward belongs to Security using local stdio subprocess. Select Sast MCP Server when you need capabilities focused on security and Agentward when you require tools for security.
Scan the entire git history for leaked secrets and credentials using Gitleaks.
Traditional SAST only scans the current state of files. This tool deeply
analyzes the `.git` directory to find API keys, passwords, and tokens
that were committed in the past but may still be valid.
run_active_scan
Run an active dynamic scan (DAST) using OWASP ZAP.
Unlike SAST which only looks at code, this orchestrates spinning up the
application via Docker Compose, waiting for it to be ready, and then
running a ZAP dynamic baseline scan against the running instance.
export_sarif
Run a SAST scan and export results in SARIF 2.1.0 format for CI/CD integration.
SARIF is the industry standard format consumed by GitHub Code Scanning,
GitLab SAST, Azure DevOps, and other CI/CD platforms.
scan_all
Scan with ALL installed scanners in parallel, returning deduplicated results.
Automatically detects which scanners are installed, runs them concurrently,
and deduplicates findings across scanners using content-based hashing.
This is the recommended tool for comprehensive security scanning.
scan_image
Scan a container image for vulnerabilities and secrets.
Pulls and analyzes a container image reference (e.g. `nginx:1.25`,
`ghcr.io/org/app@sha256:...`) with Trivy or Grype, returning the same
normalized findings as a source scan.
save_baseline
Run a scan and save the results as a named baseline for future comparison.
compare_baseline
Compare current scan results against a saved baseline.
Shows new vulnerabilities, fixed vulnerabilities, and severity trends.
+15 more tools listed on main page
Agentward Tools (14)
read_file
Read the complete contents of a file as text. DEPRECATED: Use read_text_file instead.
read_text_file
Read the complete contents of a file from the file system as text. Handles various text encodings and provides detailed error messages if the file cannot be read. Use this tool when you need to examine the contents of a single file. Use the 'head' parameter to read only the first N lines of a file, or the 'tail' parameter to read only the last N lines of a file. Operates on the file as text regardless of extension. Only works within allowed directories.
read_media_file
Read a file and return it as a base64-encoded content block with its MIME type. Image and audio files are returned as image/audio content; any other file type is returned as an embedded resource. Only works within allowed directories.
read_multiple_files
Read the contents of multiple files simultaneously. This is more efficient than reading files one by one when you need to analyze or compare multiple files. Each file's content is returned with its path as a reference. Failed reads for individual files won't stop the entire operation. Only works within allowed directories.
write_file
Create a new file or completely overwrite an existing file with new content. Use with caution as it will overwrite existing files without warning. Handles text content with proper encoding. Only works within allowed directories.
edit_file
Make line-based edits to a text file. Each edit replaces exact line sequences with new content. Returns a git-style diff showing the changes made. Only works within allowed directories.
create_directory
Create a new directory or ensure a directory exists. Can create multiple nested directories in one operation. If the directory already exists, this operation will succeed silently. Perfect for setting up directory structures for projects or ensuring required paths exist. Only works within allowed directories.
list_directory
Get a detailed listing of all files and directories in a specified path. Results clearly distinguish between files and directories with [FILE] and [DIR] prefixes. This tool is essential for understanding directory structure and finding specific files within a directory. Only works within allowed directories.
list_directory_with_sizes
Get a detailed listing of all files and directories in a specified path, including sizes. Results clearly distinguish between files and directories with [FILE] and [DIR] prefixes. This tool is useful for understanding directory structure and finding specific files within a directory. Only works within allowed directories.
directory_tree
Get a recursive tree view of files and directories as a JSON structure. Each entry includes 'name', 'type' (file/directory), and 'children' for directories. Files have no children array, while directories always have a children array (which may be empty). The output is formatted with 2-space indentation for readability. Only works within allowed directories.
move_file
Move or rename files and directories. Can move files between directories and rename them in a single operation. If the destination exists, the operation will fail. Works across different directories and can be used for simple renaming within the same directory. Both source and destination must be within allowed directories.
search_files
Recursively search for files and directories matching a pattern. The patterns should be glob-style patterns that match paths relative to the working directory. Use pattern like '*.ext' to match files in current directory, and '**/*.ext' to match files in all subdirectories. Returns full paths to all matching items. Great for finding files when you don't know their exact location. Only searches within allowed directories.