This tool also acts as a **Model Context Protocol (MCP)** server, allowing IDEs such as **Cursor** or **Visual Studio Code** to query its results
This tool also acts as a Model Context Protocol (MCP) server, allowing IDEs such as Cursor or Visual Studio Code to query its results using natural language. For example, you can ask:. That is what the gothreatscope mcp server brings to an AI assistant: the same capability, reachable through the Model Context Protocol rather than a separate app or dashboard.
GoThreatScope performs an high-level security inspection of a project directory and organizes the results for both human and automated analysis.
The server publishes 5 tools. What each one is for:
analyzeRepo — Runs the full pipeline (SBOM → Vulnerabilities → Secrets)scanRepoSBOM — Generates an SBOM and returns its file URIvulnCheck — Checks for vulnerabilities and malicious packages using OSV.devsecretScan — Scans for secrets (using Gitleaks or the built-in engine)Prerequisites — The Prerequisites tool exposed by this serverBecause this one is hosted, setup is mostly authentication — you point your client at the endpoint and approve access. Nothing runs on your machine, so there is no runtime to keep patched.
Configuration is passed through the environment: GTS_MCP_MODE, GOTHREATSCOPE_METRICS_URL. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.
Among the developer tooling options, the useful question is rarely "what can it do" but "what does it cost you to run" — permissions, credentials, and how much of your context its toolset consumes. Gothreatscope's toolset — analyzeRepo, scanRepoSBOM, vulnCheck and 2 more — is a fair guide to whether it matches your workflow. It is maintained by anotherik; worth a glance at recent repository activity before you build anything load-bearing on it.
This entry was verified against Gothreatscope's own documentation before publication; SyncDev keeps the directory reviewed rather than auto-generated.
| Tool | What it does |
|---|---|
| analyzeRepo | Runs the full pipeline *(SBOM → Vulnerabilities → Secrets)*. |
| scanRepoSBOM | Generates an SBOM and returns its file URI. |
| vulnCheck | Checks for vulnerabilities and malicious packages using [OSV.dev](https://osv.dev). |
| secretScan | Scans for secrets *(using Gitleaks or the built-in engine)*. |
| Prerequisites | The Prerequisites tool exposed by this server. |
{
"mcpServers": {
"gothreatscope": {
"command": "/absolute/path/to/gothreatscope",
"args": ["--mcp"],
"env": {
"GTS_MCP_MODE": "1"
}
}
}
}Configuration as documented by the project. Restart the client after saving.
| Variable | Description | Required |
|---|---|---|
| GTS_MCP_MODE | Configuration value read at startup. | Optional |
| GOTHREATSCOPE_METRICS_URL | Endpoint or connection string the server talks to. | Yes |
Kill hallucinated APIs — version-accurate, up-to-date library documentation injected straight into context.
Microsoft's official browser automation server — drive a real browser through the accessibility tree, no screenshots needed.
GitHub's official server — repos, issues, pull requests, Actions and code security, straight from your assistant.
Issue tracking at the speed of conversation — Linear's official hosted server with OAuth and zero install.
Local repository surgery — status, diffs, commits, branches and history for any repo on disk.
Timezone sanity for AI — current time anywhere and correct conversions, without the model doing date math.