Skyrxin/sast-mcp-server

**Static Application Security Testing (SAST) for AI agents.** A production-ready MCP server that gives any AI agent the ability to scan code for security vulnerabilities.
Supports **11 industry-standard scanners**:
| Scanner | Languages / Scope | Type |
|---------|-------------------|------|
| **Bandit** | Python | Security linter |
| **njsscan** | JavaScript, Node.js | Static analysis |
| **Bearer** | Python, JS, Ruby, Java, Go, PHP | Data-flow SAST |
| **Semgrep** | 30+ languages | Rule-based SAST |
| **Trivy** | All (CVEs, Secrets, IaC, images) | Multi-scanner |
| **CodeQL** | Python, JS, Java, Go, C/C++, C#, Ruby, Swift | Semantic SAST |
| **Checkov** | Terraform, K8s, Docker, CloudFormation | IaC policy scanner |
| **Gitleaks** | All (.git history) | Deep secret scanning |
| **OSV-Scanner**| Multiple (lockfiles, sboms) | SCA |
| **Grype** | Containers, OS packages, lockfiles, SBOMs | SCA / image scanning |
| **OWASP ZAP** | RUNTIME | Dynamic (DAST) via Docker |
Works with **any MCP-compatible agent**: Gemini CLI, Claude Desktop, OpenAI Agents, Cursor, Windsurf, and more.
---
Features
- 🔍 **11 SAST/SCA/DAST scanners** with a unified output format
- 🌳 **AST-aware context** — shows the full enclosing function, not just a line number
- 📊 **Severity & confidence filtering** — focus on what matters
- 🔀 **Git diff mode** — scan only modified files for incremental reviews
- 🙈 **Ignore management** — suppress false positives with audit trail
- 📄 **Pagination** — handle large codebases without overwhelming the agent
- 🌐 **Dual transport** — stdio (local) or Streamable HTTP (remote deployments)
- 🔐 **JWT & API key authentication** — secure remote deployments
- 📦 **One command install** — pip install sast-mcp-server
- 🚀 **Multi-scanner mode** — run all installed scanners in parallel with deduplication
- 📋 **SARIF export** — CI/CD integration with GitHub, GitLab, Azure DevOps
- 🏗️ **IaC scanning** — Terraform, Kubernetes, Docker security policies
- 🔑 **Secret detection** — find hardcoded API keys, tokens, and passwords in code and git history
- 📦 **SCA / dependency CVEs** — scan lock files for known vulnerabilities against the OSV database
- 🕷️ **DAST** — dynamic baseline scans of running apps via OWASP ZAP + Docker
- 📈 **Baselines & trend tracking** — cache scans and diff against a saved baseline
- 🤖 **MCP Prompts & Resources** — pre-built security workflows and live dashboards for agents
- 📤 **Dashboard integrations** — push SARIF results to DefectDojo or GitHub Code Scanning
- 🩹 **AI-assisted remediation** — generate fix prompts and apply agent-written patches via git apply
---
Quick Start
The server is only as useful as the scanners installed alongside it. Pick the
install path that matches how much of the toolset you want out of the box.
Option 1 — Full container (recommended: 9 scanners, zero setup)
Bundles **bandit, njsscan, bearer, semgrep, trivy, checkov, gitleaks,
osv-scanner, and grype** so scan_all works immediately. Or bring up an HTTP
server with one command:
Option 2 — pip extra (4 pip-installable scanners)
Option 3 — minimal / custom
Then install whichever scanners you need (binary scanners aren't pip packages):
What ships where
| Scanner | :full image | [scanners] extra | Notes |
|---------|:---:|:---:|-------|
| Bandit | ✅ | ✅ | pip |
| njsscan | ✅ | ✅ | pip |
| Semgrep | ✅ | ✅ | pip |
| Checkov | ✅ | ✅ | pip |
| Bearer | ✅ | — | install script |
| Trivy | ✅ | — | binary |
| Gitleaks | ✅ | — | binary |
| OSV-Scanner | ✅ | — | binary |
| Grype | ✅ | — | binary |
| CodeQL | — | — | multi-GB bundle — mount at runtime |
| OWASP ZAP | — | — | runs via Docker on the host (run_active_scan) |
> At startup the server logs how many scanners it can actually see (e.g.
> Scanners available: 9/11 (...)), and the list_scanners tool / /ready
> endpoint report the same — so it's always obvious what you have.
---
Usage with AI Agents
Gemini CLI
Install as an extension:
Or add to your ~/.gemini/settings.json:
Claude Desktop
Add to your claude_desktop_config.json:
See full Claude Desktop guide.
Cursor IDE
Add to Cursor Settings → MCP Servers:
See full Cursor guide.
OpenAI Agents SDK
See full OpenAI guide.
---
Available MCP Tools
scan_vulnerabilities
Scan a directory for security vulnerabilities using a specific scanner.
| Parameter | Type | Default | Description |
|-----------|------|---------|-------------|
| target_path | string | *required* | Path to scan |
| scanner_name | string | "bearer" | Scanner: bandit, njsscan, bearer, semgrep, trivy, codeql, checkov |