Armis Appsec MCP Server

Armis Appsec MCP MCP server exists for a simple reason — assistants are far more useful when they can act on Armis Appsec MCP directly instead of describing what you should do. Contact the Armis AppSec team if you don't have credentials.

What you get

• scan_code — — Scan a code snippet for vulnerabilities
• scan_file — — Scan a file on disk
• scan_diff — — Scan git changes (staged, unstaged, or diff against a branch)
• approve_findings — — Approve findings after user consent (for shipping with known risks)
• debug_config — — Check scanner configuration status
• Commit gate — — Git pre-commit hook that blocks commits until code is scanned

Setting it up

Setup follows the usual MCP pattern — install or clone the server, register it in your client's configuration file, restart the client.

What the assistant can call

Once Armis Appsec MCP is connected, these are the calls the assistant has available:

• Cursor — Run make setup CLIENT=cursor and copy the output to ~/.cursor/mcp.json (user-level) or .cursor/mcp.json (workspace-level)
• Cline — Add the MCP server via Cline's MCP settings panel. Then wire in the commit gate hook:

Configuration and credentials

You will need 3 environment variables: ARMIS_CLIENT_ID, ARMIS_CLIENT_SECRET, APPSEC_API_URL. The server will not start without them, which is usually why the tools fail to appear on a first run. Keep credentials in your client's env block or a secrets manager rather than in a file you might commit.

Before you rely on it

• It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
• Missing credentials fail quietly in some clients — if no tools show up, check the environment block first.
• MCP clients confirm each tool call by default. Leave that on until you have watched what the armis appsec mcp mcp server does with a few real requests.

Choosing this one

This sits in the developer tooling group, where several servers overlap in what they claim to do but differ sharply once you actually set them up. Armis Appsec MCP's toolset — Cursor, Cline — is a fair guide to whether it matches your workflow. It is maintained by armissecurity; worth a glance at recent repository activity before you build anything load-bearing on it.

This entry was verified against Armis Appsec MCP's own documentation before publication; SyncDev keeps the directory reviewed rather than auto-generated.