{"name":"io.github.Skyrxin/sast-mcp-server","slug":"skyrxin-sast-mcp-server","title":"SAST MCP Server","description":"11-scanner SAST/DAST MCP server with closed-loop remediation, SBOM/SARIF, and CI integrations","url":"https://mcp.market/server/skyrxin-sast-mcp-server","rating":null,"grade":"B","score":78,"certified":false,"status":"active","category":"devtools","tags":["devtools"],"presence":{"score":30,"stars":3,"forks":0,"downloads_week":182,"last_push_at":"2026-06-29T14:08:19.000Z","license":"MIT"},"uptime":null,"claimed":false,"transport":"pypi","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/Skyrxin/sast-mcp-server","website":"https://github.com/Skyrxin/sast-mcp-server#readme","version":"0.8.3","remotes":[],"packages":[{"registryType":"pypi","registryBaseUrl":"https://pypi.org","identifier":"sast-mcp-server","version":"0.8.3","runtimeHint":"uvx","transport":{"type":"stdio"},"environmentVariables":[{"description":"Per-scan timeout in seconds (default: 300).","default":"300","name":"SAST_MCP_TIMEOUT"},{"description":"Logging level: DEBUG, INFO, WARNING, ERROR (default: INFO).","default":"INFO","name":"SAST_MCP_LOG_LEVEL"},{"description":"Optional static API key to require auth (legacy mode; HTTP transports).","isSecret":true,"name":"SAST_MCP_API_KEY"},{"description":"Optional HMAC secret to require JWT auth with scopes (HTTP transports).","isSecret":true,"name":"SAST_MCP_JWT_SECRET"}]}],"tools":[{"name":"apply_patch","description":"Apply an agent-generated unified diff to files under target_path.","write_action":true,"price_micros":0,"input_schema":null},{"name":"comment_on_pr","description":"Post a security summary comment on a GitHub PR or GitLab merge request.","write_action":true,"price_micros":0,"input_schema":null},{"name":"compare_baseline","description":"Compare current scan results against a saved baseline.","write_action":false,"price_micros":0,"input_schema":null},{"name":"compliance_report","description":"Map findings to a compliance framework and report the posture.","write_action":false,"price_micros":0,"input_schema":null},{"name":"create_jira_issue","description":"Open a Jira issue for a security finding.","write_action":true,"price_micros":0,"input_schema":null},{"name":"decorator","description":"","write_action":false,"price_micros":0,"input_schema":null},{"name":"evaluate_policy","description":"Run all scanners and evaluate findings against a CI security policy.","write_action":true,"price_micros":0,"input_schema":null},{"name":"export_sarif","description":"Run a SAST scan and export results in SARIF 2.1.0 format for CI/CD integration.","write_action":true,"price_micros":0,"input_schema":null},{"name":"export_sbom","description":"Run all scanners and export an SBOM / vulnerability report.","write_action":true,"price_micros":0,"input_schema":null},{"name":"generate_fix_prompt","description":"Build an LLM-ready prompt to fix a cached finding as a unified diff.","write_action":false,"price_micros":0,"input_schema":null},{"name":"generate_report","description":"Run all scanners and render an executive security report (HTML or PDF).","write_action":true,"price_micros":0,"input_schema":null},{"name":"ignore_vulnerability","description":"Ignore a specific vulnerability finding so it won't appear in future scans.","write_action":false,"price_micros":0,"input_schema":null},{"name":"import_sarif","description":"Ingest an external SARIF file into the normalized finding pipeline.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_ignored_vulnerabilities","description":"List all currently ignored vulnerability findings for a project.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_scanners","description":"List all available SAST scanners, their status, and supported languages.","write_action":false,"price_micros":0,"input_schema":null},{"name":"notify_slack","description":"Send a notification to the configured Slack incoming webhook.","write_action":true,"price_micros":0,"input_schema":null},{"name":"notify_teams","description":"Send a notification to the configured Microsoft Teams incoming webhook.","write_action":true,"price_micros":0,"input_schema":null},{"name":"remediate_and_verify","description":"Apply a fix and prove it worked: scan → patch → re-scan → confirm gone.","write_action":false,"price_micros":0,"input_schema":null},{"name":"run_active_scan","description":"Run an active dynamic scan (DAST) using OWASP ZAP.","write_action":true,"price_micros":0,"input_schema":null},{"name":"save_baseline","description":"Run a scan and save the results as a named baseline for future comparison.","write_action":true,"price_micros":0,"input_schema":null},{"name":"scan_all","description":"Scan with ALL installed scanners in parallel, returning deduplicated results.","write_action":false,"price_micros":0,"input_schema":null},{"name":"scan_git_history","description":"Scan the entire git history for leaked secrets and credentials using Gitleaks.","write_action":false,"price_micros":0,"input_schema":null},{"name":"scan_image","description":"Scan a container image for vulnerabilities and secrets.","write_action":false,"price_micros":0,"input_schema":null},{"name":"scan_vulnerabilities","description":"Scan a target directory for security vulnerabilities using a SAST tool.","write_action":false,"price_micros":0,"input_schema":null},{"name":"triage_finding","description":"Triage a finding: get an exploitability prompt, or record a VEX decision.","write_action":false,"price_micros":0,"input_schema":null},{"name":"unignore_vulnerability","description":"Remove a vulnerability from the ignore list so it appears in future scans again.","write_action":true,"price_micros":0,"input_schema":null},{"name":"upload_to_defectdojo","description":"Upload a SARIF report to a DefectDojo engagement.","write_action":true,"price_micros":0,"input_schema":null},{"name":"upload_to_github","description":"Upload a SARIF report to GitHub Code Scanning.","write_action":true,"price_micros":0,"input_schema":null}],"scan":{"score":78,"grade":"B","scanned_at":"2026-09-26T16:36:06.299Z","report":{"scannerVersion":"0.1.9","scannedAt":"2026-09-26T16:36:06.252Z","components":{"code":{"score":25,"max":25,"notes":["54 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":6,"max":15,"notes":["static API keys via environment variables"]},"maintenance":{"score":12,"max":15,"notes":["last push 89 days ago"]},"identity":{"score":8,"max":10,"notes":["registry namespace matches repository owner","GitHub account older than a year"]}},"findings":[],"inputs":{"packages":[{"registryType":"pypi","identifier":"sast-mcp-server","version":"0.8.3","found":true,"weeklyDownloads":182,"license":"MIT","dependencyCount":28,"publishedAt":"2026-06-23T13:44:57.300012Z","repositoryUrl":"https://github.com/Skyrxin/sast-mcp-server"}],"repo":{"found":true,"owner":"Skyrxin","repo":"sast-mcp-server","archived":false,"pushedAt":"2026-06-29T14:08:19Z","stars":3,"forks":0,"openIssues":5,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/92770522?v=4","ownerCreatedAt":"2021-10-19T03:06:35Z","license":"MIT"},"icon":{"url":"https://avatars.githubusercontent.com/u/92770522?v=4&s=128","source":"github"},"presence":{"stars":3,"forks":0,"downloadsWeek":182,"license":"MIT","lastPushAt":"2026-06-29T14:08:19.000Z","score":30}}}},"grade_history":[],"reviews":[]}