Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning with Cycode.
Cycode mcp server lets Claude, Cursor and other MCP clients work with Cycode directly. Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning with Cycode.
The Cycode Command Line Interface (CLI) is an application you can install locally to scan your repositories for secrets, infrastructure as code misconfigurations, software composition analysis vulnerabilities, and static application security testing issues.
Once connected, the assistant can call these 6 tools directly:
status — Show the CLI status and exitcycode_secret_scan — Scan for hardcoded secretscycode_sca_scan — Scan for Software Composition Analysis (SCA) - vulnerabilities and license issuescycode_iac_scan — Scan for Infrastructure as Code (IaC) misconfigurationscycode_sast_scan — Scan for Static Application Security Testing (SAST) - code quality and security flawscycode_status — Get Cycode CLI version, authentication status, and configuration informationThe server is distributed via PyPI as cycode, so most clients can run it without a manual build step. Add it to your MCP client's configuration and restart the client to pick it up — the copy-paste configs for Claude Desktop, Claude Code and Cursor are on this page.
Before the server will start you need to supply 3 environment variables: CYCODE_CLIENT_ID, CYCODE_CLIENT_SECRET, CYCODE_ID_TOKEN. Keep credentials in your client's env block or a secrets manager rather than committing them.
cycode auth command to authenticate to Cycode with the CLI - Alternatively, you can get a Cycode Client ID and Client Secret Key by following the stepsDeveloper-tool servers are usually the first ones people connect, because they turn "help me with this code" into an assistant that can actually read the repo and act on it. Cycode sits in that group, and the shape of its toolset — status, cycode_secret_scan, cycode_sca_scan among others — tells you what it is really for. Worth comparing against the other developer tools servers in this directory before you commit to one, since several overlap in scope but differ sharply in setup cost and permissions.
| Tool | What it does |
|---|---|
| status | Show the CLI status and exit. |
| cycode_secret_scan | Scan for hardcoded secrets |
| cycode_sca_scan | Scan for Software Composition Analysis (SCA) - vulnerabilities and license issues |
| cycode_iac_scan | Scan for Infrastructure as Code (IaC) misconfigurations |
| cycode_sast_scan | Scan for Static Application Security Testing (SAST) - code quality and security flaws |
| cycode_status | Get Cycode CLI version, authentication status, and configuration information |
{
"mcpServers": {
"cycode-cli": {
"command": "uvx",
"args": ["cycode"],
"env": {
"CYCODE_CLIENT_ID": "your-value",
"CYCODE_CLIENT_SECRET": "your-value",
"CYCODE_ID_TOKEN": "your-value"
}
}
}
}Add to claude_desktop_config.json, then restart Claude Desktop.
cycode auth command to authenticate to Cycode with the CLI - Alternatively, you can get a Cycode Client ID and Client Secret Key by following the steps| Variable | Description | Required |
|---|---|---|
| CYCODE_CLIENT_ID | Configuration value read at startup. | Optional |
| CYCODE_CLIENT_SECRET | Credential the server authenticates with. | Yes |
| CYCODE_ID_TOKEN | Credential the server authenticates with. | Yes |
Manage your whole Supabase project in conversation — database, auth, storage, Edge Functions and branches.
Stop letting your assistant hallucinate n8n node parameters — this server hands it the real schemas, templates and validation.
AWS Labs' official server suite — current AWS docs, CDK guidance, cost analysis and service tools.
Cloud browsers for AI agents — automation sessions that run in Browserbase's fleet, not on your machine.
Workers, KV, R2 and D1 by conversation — Cloudflare's official remote servers for building and observability.
Dashboards, Prometheus and Loki queries, incidents and alerts — observability by conversation.