SAST MCP Server

SAST MCP Server

Static Application Security Testing (SAST) for AI agents. A production-ready MCP server that gives any AI agent the ability to scan code for security vulnerabilities.

Supports 11 industry-standard scanners:

Works with any MCP-compatible agent: Gemini CLI, Claude Desktop, OpenAI Agents, Cursor, Windsurf, and more.

---

Features

• 🔍 11 SAST/SCA/DAST scanners with a unified output format
• 🌳 AST-aware context — shows the full enclosing function, not just a line number
• 📊 Severity & confidence filtering — focus on what matters
• 🔀 Git diff mode — scan only modified files for incremental reviews
• 🙈 Ignore management — suppress false positives with audit trail
• 📄 Pagination — handle large codebases without overwhelming the agent
• 🌐 Dual transport — stdio (local) or Streamable HTTP (remote deployments)
• 🔐 JWT & API key authentication — secure remote deployments
• 📦 One command install — pip install sast-mcp-server
• 🚀 Multi-scanner mode — run all installed scanners in parallel with deduplication
• 📋 SARIF export — CI/CD integration with GitHub, GitLab, Azure DevOps
• 🏗️ IaC scanning — Terraform, Kubernetes, Docker security policies
• 🔑 Secret detection — find hardcoded API keys, tokens, and passwords in code and git history
• 📦 SCA / dependency CVEs — scan lock files for known vulnerabilities against the OSV database
• 🕷️ DAST — dynamic baseline scans of running apps via OWASP ZAP + Docker
• 📈 Baselines & trend tracking — cache scans and diff against a saved baseline
• 🤖 MCP Prompts & Resources — pre-built security workflows and live dashboards for agents
• 📤 Dashboard integrations — push SARIF results to DefectDojo or GitHub Code Scanning
• 🩹 AI-assisted remediation — generate fix prompts and apply agent-written patches via git apply

---

Quick Start

The server is only as useful as the scanners installed alongside it. Pick the install path that matches how much of the toolset you want out of the box.

Option 1 — Full container (recommended: 9 scanners, zero setup)

docker pull ghcr.io/skyrxin/sast-mcp-server:full

Bundles bandit, njsscan, bearer, semgrep, trivy, checkov, gitleaks, osv-scanner, and grype so scan_all works immediately. Or bring up an HTTP server with one command:

docker compose up          # serves http://localhost:8080/mcp + /health /ready /metrics

Option 2 — pip extra (4 pip-installable scanners)

pip install "sast-mcp-server[scanners]"   # adds bandit, njsscan, semgrep, checkov

Option 3 — minimal / custom

pip install sast-mcp-server               # server only — bring your own scanners

uvx sast-mcp-server # run without installing

Then install whichever scanners you need (binary scanners aren't pip packages):

pip install bandit njsscan semgrep checkov     # pip-installable

trivy: https://aquasecurity.github.io/trivy/latest/getting-started/installation/

grype: https://github.com/anchore/grype#installation

gitleaks: https://github.com/gitleaks/gitleaks#installing

osv-scanner: https://google.github.io/osv-scanner/installation/

bearer: https://docs.bearer.com/installation/

codeql: https://github.com/github/codeql-cli-binaries/releases

What ships where

At startup the server logs how many scanners it can actually see (e.g.

Scanners available: 9/11 (...)), and the list_scanners tool / /ready

endpoint report the same — so it's always obvious what you have.

---

Usage with AI Agents

Gemini CLI

Install as an extension:

gemini extensions install https://github.com/Skyrxin/sast-mcp-server

Or add to your ~/.gemini/settings.json:

{

"mcpServers": { "sast": { "command": "uvx", "args": ["sast-mcp-server"] } } }

Claude Desktop

Add to your claude_desktop_config.json:

{

"mcpServers": { "sast": { "command": "uvx", "args": ["sast-mcp-server"] } } }

See full Claude Desktop guide.

Cursor IDE

Add to Cursor Settings → MCP Servers:

{

"mcpServers": { "sast": { "command": "uvx", "args": ["sast-mcp-server"] } } }

See full Cursor guide.

OpenAI Agents SDK

from agents.mcp import MCPServerStdio

sast_server = MCPServerStdio(command="uvx", args=["sast-mcp-server"])

See full OpenAI guide.

---

Available MCP Tools

scan_vulnerabilities

Scan a directory for security vulnerabilities using a specific scanner.

scan_all

Run ALL installed scanners in parallel with automatic deduplication. Recommended for comprehensive security scanning.

scan_git_history

Scan the entire .git history for leaked secrets and credentials using Gitleaks.

run_active_scan

Run a dynamic (DAST) baseline scan with OWASP ZAP by orchestrating a Docker Compose stack.

export_sarif

Export scan results in SARIF 2.1.0 format for CI/CD integration.

list_scanners

List available scanners, their installation status, and supported languages.

ignore_vulnerability

Suppress a finding from future scans (with audit trail).

unignore_vulnerability

Re-enable a previously suppressed finding.

list_ignored_vulnerabilities

Show all currently suppressed findings for a project.

save_baseline

Run a scan and cache the results as a named baseline for future trend comparison.

compare_baseline

Compare a fresh scan against a saved baseline to highlight new and fixed findings.

upload_to_defectdojo

Import a SARIF export into a DefectDojo engagement. Requires DEFECTDOJO_URL and DEFECTDOJO_API_KEY environment variables.

upload_to_github

Upload a SARIF report to GitHub Code Scanning. Requires a GITHUB_TOKEN with security_events: write scope.

| sarif_path | string | *required