Mycop MCP Server

AI Code Security Scanner — detect and auto-fix vulnerabilities in AI-generated code.

Local serverstdioPython

What is the Mycop MCP Server?

AI Code Security Scanner — detect and auto-fix vulnerabilities in AI-generated code.

What the server does

  • First SAST tool designed for AI-generated code — -- 200 rules targeting the exact vulnerability patterns that LLMs produce most often, covering OWASP Top 10 and CWE Top 25
  • AI-powered auto-fix, not just detection — -- mycop does not just find vulnerabilities, it fixes them. The mycop fix command rewrites insecure code using AI while preserving functionality
  • Multi-language with a single tool — -- scan Python, JavaScript, TypeScript, Go, and Java codebases without juggling Bandit, ESLint, and separate configs
  • Zero configuration — -- all 200 security rules are compiled into the binary. No rule downloads, no config files, no internet connection required. Just mycop scan . and go
  • MCP server for agentic workflows — -- plug mycop directly into Claude Code, Cursor, Windsurf, and other AI coding assistants via the Model Context Protocol
  • Free and open source — -- MIT licensed, forever

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.

How to install the Mycop MCP Server

{
  "mcpServers": {
    "mycop": {
      "command": "mycop",
      "args": [
        "mcp"
      ]
    }
  }
}

From the project documentation. Replace placeholders and example paths before connecting.

Example prompts to try

  • “Use Mycop to Homebrew.”
  • “Use Mycop to Cargo.”

Frequently asked questions

AI Code Security Scanner — detect and auto-fix vulnerabilities in AI-generated code. Confirm the tools offered by your installed version in the connected client. Tool availability and permissions depend on the server and account configuration.