11-scanner SAST/DAST MCP server with closed-loop remediation, SBOM/SARIF, and CI integrations
11-scanner SAST/DAST MCP server with closed-loop remediation, SBOM/SARIF, and CI integrations. Exposed over MCP by the sast mcp server, that capability becomes something an assistant can invoke while it works, not something you go and do afterwards.
Works with any MCP-compatible agent: Gemini CLI, Claude Desktop, OpenAI Agents, Cursor, Windsurf, and more.
Being a remote server, there is no local install. You register the endpoint with your client, authorise it once, and the tools appear.
Everything the assistant can do here goes through one of these:
scan_vulnerabilities — Scan a directory for security vulnerabilities using a specific scannerscan_all — Run ALL installed scanners in parallel with automatic deduplication. Recommended for comprehensive security scanning.scan_git_history — Scan the entire .git history for leaked secrets and credentials using Gitleaksrun_active_scan — Run a dynamic (DAST) baseline scan with OWASP ZAP by orchestrating a Docker Compose stackexport_sarif — Export scan results in SARIF 2.1.0 format for CI/CD integrationlist_scanners — List available scanners, their installation status, and supported languagesignore_vulnerability — The ignore_vulnerability tool exposed by this serverunignore_vulnerability — The unignore_vulnerability tool exposed by this serverlist_ignored_vulnerabilities — The list_ignored_vulnerabilities tool exposed by this serversave_baseline — Run a scan and cache the results as a named baseline for future trend comparisoncompare_baseline — Compare a fresh scan against a saved baseline to highlight new and fixed findingsupload_to_defectdojo — Import a SARIF export into a DefectDojo engagement. Requires DEFECTDOJO_URL and DEFECTDOJO_API_KEY environment variablesYou will need 8 environment variables: SAST_MCP_JWT_SECRET, SAST_MCP_API_KEY, DEFECTDOJO_URL, DEFECTDOJO_API_KEY, GITHUB_TOKEN, GITLAB_TOKEN, GITLAB_URL, SLACK_WEBHOOK_URL. The server will not start without them, which is usually why the tools fail to appear on a first run. Keep credentials in your client's env block or a secrets manager rather than in a file you might commit.
Plenty of developer tooling servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. SAST's toolset — scan_vulnerabilities, scan_all, scan_git_history and 11 more — is a fair guide to whether it matches your workflow. It is maintained by Skyrxin; worth a glance at recent repository activity before you build anything load-bearing on it.
SyncDev reviews every entry in this directory against the project's own documentation before publishing, and revisits them as servers change.
| Tool | What it does |
|---|---|
| scan_vulnerabilities | Scan a directory for security vulnerabilities using a specific scanner. |
| scan_all | Run ALL installed scanners in parallel with automatic deduplication. **Recommended for comprehensive security scanning.** |
| scan_git_history | Scan the entire .git history for leaked secrets and credentials using Gitleaks. |
| run_active_scan | Run a dynamic (DAST) baseline scan with OWASP ZAP by orchestrating a Docker Compose stack. |
| export_sarif | Export scan results in SARIF 2.1.0 format for CI/CD integration. |
| list_scanners | List available scanners, their installation status, and supported languages. |
| ignore_vulnerability | The ignore_vulnerability tool exposed by this server. |
| unignore_vulnerability | The unignore_vulnerability tool exposed by this server. |
| list_ignored_vulnerabilities | The list_ignored_vulnerabilities tool exposed by this server. |
| save_baseline | Run a scan and cache the results as a named baseline for future trend comparison. |
| compare_baseline | Compare a fresh scan against a saved baseline to highlight new and fixed findings. |
| upload_to_defectdojo | Import a SARIF export into a DefectDojo engagement. Requires DEFECTDOJO_URL and DEFECTDOJO_API_KEY environment variables. |
| upload_to_github | Upload a SARIF report to GitHub Code Scanning. Requires a GITHUB_TOKEN with security_events: write scope. |
| generate_fix_prompt | Package a cached finding's vulnerable code and context into an LLM-ready prompt that asks for a strict unified diff fix. |
{
"mcpServers": {
"sast": {
"command": "uvx",
"args": ["sast-mcp-server"],
"env": {
"SAST_MCP_JWT_SECRET": "your-value",
"SAST_MCP_API_KEY": "your-value",
"DEFECTDOJO_URL": "your-value",
"DEFECTDOJO_API_KEY": "your-value",
"GITHUB_TOKEN": "your-value",
"GITLAB_TOKEN": "your-value",
"GITLAB_URL": "your-value",
"SLACK_WEBHOOK_URL": "your-value"
}
}
}
}Add to claude_desktop_config.json, then restart Claude Desktop.
| Variable | Description | Required |
|---|---|---|
| SAST_MCP_JWT_SECRET | Credential the server authenticates with. | Yes |
| SAST_MCP_API_KEY | Credential the server authenticates with. | Yes |
| DEFECTDOJO_URL | Endpoint or connection string the server talks to. | Yes |
| DEFECTDOJO_API_KEY | Credential the server authenticates with. | Yes |
| GITHUB_TOKEN | Credential the server authenticates with. | Yes |
| GITLAB_TOKEN | Credential the server authenticates with. | Yes |
| GITLAB_URL | Endpoint or connection string the server talks to. | Yes |
| SLACK_WEBHOOK_URL | Endpoint or connection string the server talks to. | Yes |
Kill hallucinated APIs — version-accurate, up-to-date library documentation injected straight into context.
Microsoft's official browser automation server — drive a real browser through the accessibility tree, no screenshots needed.
GitHub's official server — repos, issues, pull requests, Actions and code security, straight from your assistant.
Issue tracking at the speed of conversation — Linear's official hosted server with OAuth and zero install.
Local repository surgery — status, diffs, commits, branches and history for any repo on disk.
Timezone sanity for AI — current time anywhere and correct conversions, without the model doing date math.