MCP.Market

Stackhawk MCP server

by stackhawk.com·com.stackhawk/stackhawk·v1.1.1·10 stars
No reviews yet

An MCP server that provides interaction with StackHawk's security scanning platform.

B74/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B74/100

full report

Adoption
Growing

10 stars26 downloads/wk

Reviews

Write one

Nobody has reviewed Stackhawk yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Stackhawk tools (16, 2 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • check_repository_attack_surface

    Check if the current repository name exists in the StackHawk attack surface and get related security info.

  • check_repository_sensitive_data

    Check if the current repository name has sensitive data findings in StackHawk and get exposure details.

  • create_stackhawk_configwrite action

    Create a StackHawk configuration file

  • generate_security_dashboard

    Generate a security dashboard for an organization

  • get_app_findings_for_triage

    Get triage-worthy findings for a project or application at or above the configured failureThreshold (or High/Medium if not set). Accepts app_id, config_path, or config_content.

  • get_organization_info

    Get information about a StackHawk organization

  • get_sensitive_data_summary

    Get a comprehensive sensitive data summary for an organization, including trends, critical findings, and recommendations.

  • get_stackhawk_scan_instructions

    Get instructions for running StackHawk scans

  • get_stackhawk_schema

    Get the StackHawk YAML schema

  • list_application_repository_connections

    List connections between StackHawk applications and code repositories to understand the attack surface mapping.

  • list_applications

    List applications in a StackHawk organization

  • run_stackhawk_scanwrite action

    Run a StackHawk scan using the CLI and stream results back to the chat. Optionally specify a config path (default: stackhawk.yml).

  • search_vulnerabilities

    Search for vulnerabilities in a StackHawk organization

  • setup_stackhawk_for_project

    Set up StackHawk for a new project

  • validate_field_exists

    Validate that a field path exists in the StackHawk schema

  • validate_stackhawk_config

    Validate a StackHawk YAML configuration file

Public scan report

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

no findings
  • Code scan5 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 167 days ago8/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year9/10
Overall 74/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Stackhawk compares

Against every graded Security MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
74/100
higher than 39% of 915 Security servers
Tools
16
the typical Security server has 6
Tools that change things
13%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
10
more than 90% of 587 Security servers
Downloads a week
26
more than 13% of 248 Security servers with a package

What its tools let an agent do: 12 read · 2 create · 1 change · 1 run or deploy

Install Stackhawk in Claude Code, Cursor or VS Code

claude mcp add stackhawk -- uvx stackhawk-mcp
Add to Cursor

What the publisher says

From the Stackhawk repository's README, as published. We do not edit it. Read it on GitHub

StackHawk MCP Server

Current Version: 1.2.5 Requires Python 3.10 or higher

A Model Context Protocol (MCP) server for integrating with StackHawk's security scanning platform. Helps developers set up StackHawk, run security scans, and triage findings to fix vulnerabilities — all from within an LLM-powered IDE or chat.

Table of Contents

  • Features
  • Installation
  • Usage
  • Configuration
  • Available Tools
  • Testing & Development
  • Example Configurations
  • Integrating with LLMs and IDEs
  • Contributing
  • License

Features

  • Setup: Detect your project, create a StackHawk application, and generate a ready-to-scan stackhawk.yml
  • Scan: Run StackHawk scans directly from your IDE or chat (with install help if the CLI is missing)
  • Triage: Get actionable findings at or above your failure threshold for remediation
  • Validate: Check YAML configs against the official schema and validate field paths to prevent hallucination
  • Custom User-Agent: All API calls include a versioned User-Agent header

Installation

  1. Install via pip (make sure you have write permission to your current python environment):
> pip install stackhawk-mcp
   # Requires Python 3.10 or higher

Or Install via pip in a virtual env:

> python3 -m venv ~/.virtualenvs/mcp
   > source ~/.virtualenvs/mcp/bin/activate
   > (mcp) pip install stackhawk-mcp
   # Requires Python 3.10 or higher

Or Install via pip using pyenv:

> pyenv shell 3.10.11
   > pip install stackhawk-mcp
   # Requires Python 3.10 or higher

Or Install locally from this repo:

> pip install --user .
   # Run this command from the root of the cloned repository
  1. Set your StackHawk API key:
> export STACKHAWK_API_KEY="your-api-key-here"

Usage

Running the MCP Server

python -m stackhawk_mcp.server

Running the HTTP Server (FastAPI)

python -m stackhawk_mcp.http_server

Running Tests

pytest

Integrating with LLMs and IDEs

StackHawk MCP can be used as a tool provider for AI coding assistants and LLM-powered developer environments, enabling security scanning setup, YAML validation, and vulnerability triage directly in your workflow.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Stackhawk: common questions

Is Stackhawk MCP server safe?
Mostly: it is graded B (74/100). Read the Stackhawk safety report
How do I install Stackhawk?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Stackhawk need an API key?
Yes. The registry entry asks for STACKHAWK_API_KEY.
Is Stackhawk maintained?
The last commit was 205 days ago (2026-04-13). The latest release is v1.1.1.
What can I use instead of Stackhawk?
Servers from other publishers that do the same job: MCPProxy MCP server, MCP Safety Warden MCP server and Npm Sentinel MCP server.
How does Stackhawk compare with other Security MCP servers?
safety score 74/100 (higher than 39% of 915 Security servers); tools 16 (the typical Security server has 6); tools that change things 13% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Stackhawk

Same job from other publishers: the closest match first, then the best rated.

  • MCPProxy
    Local-first MCP proxy with BM25 tool discovery, security scanning, quarantine & ~99% token savings
    B
  • MCP Safety Warden
    MCP proxy adding security scanning, behavioral profiling, risk gating, and safe tool call execution.
    A
  • Npm Sentinel
    Advanced NPM analysis: Recursive security scanning, ecosystem awareness, and deep insights.
    A
  • MobiLoop
    Guarded AI mobile Appium testing, security scanning, verification, and fix-retest MCP tools.
    A
  • Skylos
    Dead code, security, secrets detection and code quality for Python, TypeScript, Go.
    C