How do I install the sast mcp server?

Use a recorded configuration for your client, replace example credential values and paths, and verify the documented runtime. Restart or reconnect the client, then inspect the available tools.

What credentials does it need?

It reads `SAST_MCP_JWT_SECRET`, `SAST_MCP_API_KEY`, `DEFECTDOJO_URL`, `DEFECTDOJO_API_KEY`, `GITHUB_TOKEN`, `GITLAB_TOKEN`, `GITLAB_URL`, `SLACK_WEBHOOK_URL` from the environment. Store these in your client's env block or a secrets manager — never commit them to a repository — and grant the narrowest scope that still covers your use case.

SSyncDev

Start a project

SAST MCP Server

11-scanner SAST/DAST MCP server with closed-loop remediation, SBOM/SARIF, and CI integrations

Remote serverstreamable-httpPython

What is the SAST MCP Server?

11-scanner SAST/DAST MCP server with closed-loop remediation, SBOM/SARIF, and CI integrations

What it actually does

Works with any MCP-compatible agent: Gemini CLI, Claude Desktop, OpenAI Agents, Cursor, Windsurf, and more.

🔍 11 SAST/SCA/DAST scanners with a unified output format
🌳 AST-aware context — shows the full enclosing function, not just a line number
📊 Severity & confidence filtering — focus on what matters
🔀 Git diff mode — scan only modified files for incremental reviews
🙈 Ignore management — suppress false positives with audit trail
📄 Pagination — handle large codebases without overwhelming the agent

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.

Recorded tools

Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.

Tool	What it does
scan_vulnerabilities	Scan a directory for security vulnerabilities using a specific scanner.
scan_all	Run ALL installed scanners in parallel with automatic deduplication. Recommended for comprehensive security scanning.
scan_git_history	Scan the entire .git history for leaked secrets and credentials using Gitleaks.
run_active_scan	Run a dynamic (DAST) baseline scan with OWASP ZAP by orchestrating a Docker Compose stack.
export_sarif	Export scan results in SARIF 2.1.0 format for CI/CD integration.
list_scanners	List available scanners, their installation status, and supported languages.
ignore_vulnerability
unignore_vulnerability
list_ignored_vulnerabilities
save_baseline	Run a scan and cache the results as a named baseline for future trend comparison.
compare_baseline	Compare a fresh scan against a saved baseline to highlight new and fixed findings.
upload_to_defectdojo	Import a SARIF export into a DefectDojo engagement. Requires DEFECTDOJO_URL and DEFECTDOJO_API_KEY environment variables.
upload_to_github	Upload a SARIF report to GitHub Code Scanning. Requires a GITHUB_TOKEN with security_events: write scope.
generate_fix_prompt	Package a cached finding's vulnerable code and context into an LLM-ready prompt that asks for a strict unified diff fix.

How to install the SAST MCP Server

{
  "mcpServers": {
    "sast": {
      "command": "uvx",
      "args": ["sast-mcp-server"],
      "env": {
        "SAST_MCP_JWT_SECRET": "your-value",
        "SAST_MCP_API_KEY": "your-value",
        "DEFECTDOJO_URL": "your-value",
        "DEFECTDOJO_API_KEY": "your-value",
        "GITHUB_TOKEN": "your-value",
        "GITLAB_TOKEN": "your-value",
        "GITLAB_URL": "your-value",
        "SLACK_WEBHOOK_URL": "your-value"
      }
    }
  }
}

Add to claude_desktop_config.json, then restart Claude Desktop.

Configuration

Variable	Description	Required
SAST_MCP_JWT_SECRET	Credential the server authenticates with.	Yes
SAST_MCP_API_KEY	Credential the server authenticates with.	Yes
DEFECTDOJO_URL	Endpoint or connection string the server talks to.	Yes
DEFECTDOJO_API_KEY	Credential the server authenticates with.	Yes
GITHUB_TOKEN	Credential the server authenticates with.	Yes
GITLAB_TOKEN	Credential the server authenticates with.	Yes
GITLAB_URL	Endpoint or connection string the server talks to.	Yes
SLACK_WEBHOOK_URL	Endpoint or connection string the server talks to.	Yes

Example prompts to try

“Use SAST to scan vulnerabilities.”
“Use SAST to scan all.”
“Use SAST to scan git history.”

Frequently asked questions

11-scanner SAST/DAST MCP server with closed-loop remediation, SBOM/SARIF, and CI integrations Confirm the tools offered by your installed version in the connected client. Tool availability and permissions depend on the server and account configuration.