MCP.Market

SAST MCP Server

by Skyrxin·io.github.Skyrxin/sast-mcp-server·v0.8.3·3 stars
No reviews yet

11-scanner SAST/DAST MCP server with closed-loop remediation, SBOM/SARIF, and CI integrations

B78/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B78/100

full report

Adoption
Growing

3 stars182 downloads/wk

Reviews

Write one

Nobody has reviewed SAST MCP Server yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

SAST MCP Server tools (28, 14 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • apply_patchwrite action

    Apply an agent-generated unified diff to files under target_path.

  • comment_on_prwrite action

    Post a security summary comment on a GitHub PR or GitLab merge request.

  • compare_baseline

    Compare current scan results against a saved baseline.

  • compliance_report

    Map findings to a compliance framework and report the posture.

  • create_jira_issuewrite action

    Open a Jira issue for a security finding.

  • decorator
  • evaluate_policywrite action

    Run all scanners and evaluate findings against a CI security policy.

  • export_sarifwrite action

    Run a SAST scan and export results in SARIF 2.1.0 format for CI/CD integration.

  • export_sbomwrite action

    Run all scanners and export an SBOM / vulnerability report.

  • generate_fix_prompt

    Build an LLM-ready prompt to fix a cached finding as a unified diff.

  • generate_reportwrite action

    Run all scanners and render an executive security report (HTML or PDF).

  • ignore_vulnerability

    Ignore a specific vulnerability finding so it won't appear in future scans.

  • import_sarif

    Ingest an external SARIF file into the normalized finding pipeline.

  • list_ignored_vulnerabilities

    List all currently ignored vulnerability findings for a project.

  • list_scanners

    List all available SAST scanners, their status, and supported languages.

  • notify_slackwrite action

    Send a notification to the configured Slack incoming webhook.

  • notify_teamswrite action

    Send a notification to the configured Microsoft Teams incoming webhook.

  • remediate_and_verify

    Apply a fix and prove it worked: scan → patch → re-scan → confirm gone.

  • run_active_scanwrite action

    Run an active dynamic scan (DAST) using OWASP ZAP.

  • save_baselinewrite action

    Run a scan and save the results as a named baseline for future comparison.

  • scan_all

    Scan with ALL installed scanners in parallel, returning deduplicated results.

  • scan_git_history

    Scan the entire git history for leaked secrets and credentials using Gitleaks.

  • scan_image

    Scan a container image for vulnerabilities and secrets.

  • scan_vulnerabilities

    Scan a target directory for security vulnerabilities using a SAST tool.

  • triage_finding

    Triage a finding: get an exploitability prompt, or record a VEX decision.

  • unignore_vulnerabilitywrite action

    Remove a vulnerability from the ignore list so it appears in future scans again.

  • upload_to_defectdojowrite action

    Upload a SARIF report to a DefectDojo engagement.

  • upload_to_githubwrite action

    Upload a SARIF report to GitHub Code Scanning.

Public scan report

scanner v0.1.9 · 2026-09-26 · same rubric, same numbers if you re-run it

no findings
  • Code scan54 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 89 days ago12/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 78/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How SAST MCP Server compares

Against every graded Developer tools MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
78/100
higher than 50% of 1,119 Developer tools servers
Tools
28
the typical Developer tools server has 7
Tools that change things
50%
typical: 5%. Fewer write tools means less an agent can break
GitHub stars
3
more than 75% of 855 Developer tools servers
Downloads a week
182
more than 70% of 436 Developer tools servers with a package

What its tools let an agent do: 12 read · 7 create · 3 change · 3 send or post · 3 run or deploy

Install SAST MCP Server in Claude Code, Cursor or VS Code

claude mcp add sast-mcp-server -- uvx sast-mcp-server
Add to Cursor

What the publisher says

From the SAST MCP Server repository's README, as published. We do not edit it. Read it on GitHub

<!-- mcp-name: io.github.Skyrxin/sast-mcp-server -->

SAST MCP Server

Static Application Security Testing (SAST) for AI agents. A production-ready MCP server that gives any AI agent the ability to scan code for security vulnerabilities.

Supports 11 industry-standard scanners:

Works with any MCP-compatible agent: Gemini CLI, Claude Desktop, OpenAI Agents, Cursor, Windsurf, and more.

Features

  • 🔍 11 SAST/SCA/DAST scanners with a unified output format
  • 🌳 AST-aware context — shows the full enclosing function, not just a line number
  • 📊 Severity & confidence filtering — focus on what matters
  • 🔀 Git diff mode — scan only modified files for incremental reviews
  • 🙈 Ignore management — suppress false positives with audit trail
  • 📄 Pagination — handle large codebases without overwhelming the agent
  • 🌐 Dual transport — stdio (local) or Streamable HTTP (remote deployments)
  • 🔐 JWT & API key authentication — secure remote deployments
  • 📦 One command install — pip install sast-mcp-server
  • 🚀 Multi-scanner mode — run all installed scanners in parallel with deduplication
  • 📋 SARIF export — CI/CD integration with GitHub, GitLab, Azure DevOps
  • 🏗️ IaC scanning — Terraform, Kubernetes, Docker security policies

Quick Start

The server is only as useful as the scanners installed alongside it. Pick the install path that matches how much of the toolset you want out of the box.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

SAST MCP Server: common questions

Is SAST MCP Server safe?
Mostly: it is graded B (78/100). Read the SAST MCP Server safety report
How do I install SAST MCP Server?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does SAST MCP Server need an API key?
Yes. The registry entry asks for SAST_MCP_API_KEY, SAST_MCP_JWT_SECRET.
Is SAST MCP Server maintained?
The last commit was 128 days ago (2026-06-29). The latest release is v0.8.3.
What can I use instead of SAST MCP Server?
Servers from other publishers that do the same job: Observatory MCP server and cloud-audit MCP server.
How does SAST MCP Server compare with other Developer tools MCP servers?
safety score 78/100 (higher than 50% of 1,119 Developer tools servers); tools 28 (the typical Developer tools server has 7); tools that change things 50% (typical: 5%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to SAST MCP Server

Same job from other publishers: the closest match first, then the best rated.

  • Observatory
    MCP security scanner. CI-native testing, attack simulation, health scoring, and SARIF.
    B
  • cloud-audit
    AWS security scanner with attack chain detection, IAM privilege escalation, and fixes
    A