Megalinter

MegaLinter MCP Server

Note: This is a community-maintained MCP server. It is not an official Model Context Protocol server, but it is sanctioned by Ox Security as a complement to their official MegaLinter tools.

A Model Context Protocol (MCP) server for running Ox Security MegaLinter through mega-linter-runner. Works with any CI/CD platform (GitHub Actions, GitLab CI, Azure DevOps, CircleCI, Jenkins) or locally.

Overview

This server provides 15 MCP tools in total: 10 core tools and 5 convenience aliases across execution, discovery, and analysis workflows.

• megalinter_quick_action for short, natural requests with sensible defaults.
• megalinter_run to execute MegaLinter with configurable runtime and runner options.
• megalinter_write_config to generate a minimal .mega-linter.yml file.
• megalinter_list_flavors to return common MegaLinter flavors.
• megalinter_get_linters to discover available linters by language, security focus, and auto-fix capability.
• megalinter_get_security_info to group security linters by threat category.
• megalinter_get_reporters to list supported report output formats and CI-targeted reporters.
• megalinter_parse_reports to parse JSON or SARIF report artefacts.
• megalinter_get_issue_summary to aggregate report issues by linter and severity.
• megalinter_get_security_recommendations to generate security-focused remediation guidance.

Quick Start (Short Prompts)

If you prefer short prompts, use megalinter_quick_action first:

• @megalinter quick scan this repository
• @megalinter security scan
• @megalinter summarise errors
• @megalinter list python security linters
• @megalinter write config

Or use ultra-short aliases for minimal typing:

• @megalinter scan — Quick scan with defaults
• @megalinter summary — Summarise last run's errors
• @megalinter parse — Parse JSON report
• @megalinter help_quick — Context-aware help for your project

Platform Compatibility

This MCP server is platform-agnostic and works universally:

• ✅ Locally — Run MegaLinter from your IDE or command line
• ✅ GitHub Actions — Integrate with workflows
• ✅ GitLab CI/CD — Use in GitLab pipelines
• ✅ Azure DevOps — Run in Azure Pipelines
• ✅ CircleCI, Jenkins, Bitbucket Pipelines — Any CI/CD platform with Docker support
• ✅ AI Agents & Copilot — Automated code quality checks via MCP

The only requirement is Docker (or a compatible container runtime like Colima).

Tool Matrix

Tools

megalinter_quick_action

Interactive shortcut that accepts a short request and routes it to the right workflow.

Inputs:

• request (string, optional): Short instruction. Default: quick scan.
• action (string, optional): Explicit quick action (scan, config, flavors, linters, security, reporters, parse, summary, recommendations).
• scanMode (string, optional): Scan preset (quick, full, security, fix).
• target (string, optional): Directory to scan. Default: ..
• workingDirectory (string, optional): Command working directory.
• reportsPath (string, optional): Reports directory. Default: megalinter-reports.
• reportType (string, optional): Parse format (json or sarif).
• severity (string, optional): Summary filter (error, warning, info).
• language (string, optional): Language filter for linter queries. For scans, maps to a flavor hint (python, javascript, terraform, and similar).
• securityOnly (boolean, optional): Return only security linters in linter queries. For scans, forces security flavor.
• autoFixOnly (boolean, optional): Return only auto-fix linters in linter queries.
• timeoutMinutes (number, optional): Timeout for scan actions. Default: 20.
• summaryOnly (boolean, optional): Return concise output for scans. Default: true.
• flavor (string, optional): Optional flavor override for scan actions.
• fix (boolean, optional): Force auto-fixes for scan actions.
• targetPath (string, optional): Config output path for write-config requests.

Examples:

• request: "quick scan" -> Runs ci_light against changed files.
• request: "full scan" -> Runs all flavor.
• request: "security scan" -> Runs security flavor.
• request: "summarise errors" -> Returns issue summary filtered to errors.
• request: "parse sarif report" -> Parses SARIF output.
• action: "summary", severity: "error" -> Deterministic summary with no phrase parsing.
• action: "scan", scanMode: "security" -> Deterministic security scan.

scan (Ultra-short alias)

Run a quick scan with minimal typing. Accepts optional parameters for customization.

Inputs:

• language (string, optional): Target language mapped to flavor (e.g., python, javascript, terraform).
• scanMode (string, optional): Scan preset (quick, full, security, fix). Default: quick.
• summaryOnly (boolean, optional): Return concise output. Default: true.

Example: @megalinter scan runs a quick scan with concise output.

summary (Ultra-short alias)

Summarise errors from the last MegaLinter run with minimal typing.

Inputs:

• severity (string, optional): Filter by severity (error, warning, info).
• linterFilter (string, optional): Filter by linter name.

Example: @megalinter summary shows all error/warning totals.

parse (Ultra-short alias)

Parse MegaLinter report files with minimal typing.

Inputs:

• reportType (string, optional): Report format (json or sarif). Default: json.
• reportsPath (string, optional): Reports directory path.

Example: @megalinter parse parses the JSON report.

megalinter_help_quick

Get context-aware help based on your current repository. Detects languages, frameworks, Docker, Terraform, and security files to suggest relevant commands.

No inputs required.

Example: @megalinter help_quick returns tailored suggestions for your project.

megalinter_run

Use this tool when you need full argument-level control. For short prompts, prefer megalinter_quick_action.

Runs mega-linter-runner via npx.

Inputs:

• workingDirectory (string, optional): Command working directory. Defaults to current process directory.
• path (string, optional): Directory path to lint.
• flavor (string, optional): MegaLinter flavor. Default: all.
• release (string, optional): MegaLinter image tag. Default: v9.
• image (string, optional): Full Docker image override.
• env (string, optional): Environment variable string passed to --env.
• fix (boolean, optional): Apply auto-fixes.
• help (boolean, optional): Show mega-linter-runner help.
• install (boolean, optional): Generate MegaLinter starter config.
• containerName (string, optional): Docker container name override.
• removeContainer (boolean, optional): Remove container after run.
• configFile (string, optional): Path to .mega-linter.yml.
• reportsPath (string, optional): Reports directory. Default: megalinter-reports.
• disableLinters (string, optional): Comma-separated list of linters to disable.
• lintChangedFilesOnly (boolean, optional): Sets VALIDATE_ALL_CODEBASE=false when true.
• runnerVersion (string, optional): npm version for mega-linter-runner (for example latest).
• timeoutSeconds (number, optional): Timeout in seconds. Default: 3600.
• summaryOnly (boolean, optional): Return concise logs. Default: false.
• extraArgs (string[], optional): Additional CLI arguments.

megalinter_write_config

Writes a minimal MegaLinter configuration.

Inputs:

• targetPath (string, optional): Output file path. Default: .mega-linter.yml.
• applyFixes (string, optional): Value for APPLY_FIXES. Default: none.
• showElapsedTime (boolean, optional): Value for SHOW_ELAPSED_TIME. Default: true.
• flavorSuggestions (boolean, optional): Value for FLAVOR_SUGGESTIONS. Default: false.
• disableLinters (string[], optional): Values for DISABLE_LINTERS.

megalinter_list_flavors

Returns the built-in list of common flavors (all, javascript, python, terraform, and others).

megalinter_get_linters

Returns linter metadata from the built-in catalogue and supports targeted filtering.

Inputs:

• language (string, optional): Filter by language (for example python, javascript, terraform).
• securityOnly (boolean, optional): Return only security-focused linters.
• autoFixOnly (boolean, optional): Return only linters with automatic fix capability.

megalinter_get_security_info

Returns security linters grouped into categories such as SAST, secrets, supply chain, container, and infrastructure.

Inputs:

• None.

megalinter_get_reporters

Returns available MegaLinter reporters, including CI-targeted formats.

Inputs:

• None.

megalinter_parse_reports

Parses MegaLinter report files from the reports directory.

Inputs:

• reportsPath (string, optional): Report directory path. Default: megalinter-reports.
• reportType (string, optional): Report type (json or sarif). Default: json.

megalinter_get_issue_summary

Summarises issues from megalinter-report.json and can apply severity/linter filters.

Inputs:

• reportsPath (string, optional): Report directory path. Default: megalinter-reports.
• severityFilter (string, optional): Filter results by severity (error, warning, info).
• linterFilter (string, optional): Filter results by linter name.

megalinter_get_security_recommendations

Generates security