SAST MCP Server
PYPI · SAST-MCP-SERVER
11-scanner SAST/DAST MCP server with closed-loop remediation, SBOM/SARIF, and CI integrations
Available components
Last scanned (2 hours ago)
Scores higher than 94% of PyPI servers
Category Security
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- 1 of 24 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to Skyrxin/sast-mcp-server). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 134 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability85
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3729 tokens (~128/item across 29 items; 27 tools + 2 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management67
- Stability observed for 20 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "unignore_vulnerability" implies "remove" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 29 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +15
- Malware scan: unverified → pass ▲ security
- 4 Nov 26 −20
- Malware scan: pass → unverified ▼ security
- Stability: pass → 0.63 functional
- 3 Nov 26 +15
- Malware scan: unverified → pass ▲ security
- 31 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- 29 Oct 26 +16
- Malware scan: unverified → pass ▲ security
- Stability: 0.97 → pass security
- 28 Oct 26 −1
- Stability: pass → 0.97 functional
- 25 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- 22 Oct 26 +1
- Stability: 0.97 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed pypi/sast-mcp-server@0.8.3
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | pypi |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | Skyrxin/sast-mcp-server |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/Skyrxin/sast-mcp-server/.github/workflows/ci.yml@refs/tags/v0.8.3 |
| Rekor log index | 1927206796 |
| Predicate type | PyPI publish attestation https://docs.pypi.org/attestations/publish/v1 |
| Subject digest | sha256:bbaf224dd178e94fdb7269ca7618cecc09f172ba50ccced8dea0d75a9778d89a |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 24 packages
| Packages resolved | 24 |
|---|---|
| Stale | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
apply_patch Apply Patch ~98
Apply an agent-generated unified diff to files under target_path. Uses `git apply`, which refuses paths that escape the target directory. Run with `check_only=True` first to verify the patch applies cleanly before writing changes.
| Name | Type | Req | Description |
|---|---|---|---|
| check_only | boolean | – | If True, validate without modifying any files. |
| patch | string | yes | The unified diff text to apply. |
| target_path | string | yes | Directory the patch paths are relative to. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
comment_on_pr Comment On Pr ~143
Post a security summary comment on a GitHub PR or GitLab merge request. Credentials come from environment variables only: GITHUB_TOKEN for GitHub, or GITLAB_TOKEN (+ optional GITLAB_URL) for GitLab.
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | yes | Markdown comment body (e.g. a scan summary or gate result). |
| pr_number | integer | yes | PR number (GitHub) or merge request IID (GitLab). |
| provider | string | yes | 'github' or 'gitlab'. |
| repo | string | yes | For GitHub, 'owner/name'. For GitLab, the numeric project ID or URL-encoded 'group/project' path. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
compare_baseline Compare Baseline ~119
Compare current scan results against a saved baseline. Shows new vulnerabilities, fixed vulnerabilities, and severity trends.
| Name | Type | Req | Description |
|---|---|---|---|
| min_confidence | string | – | Minimum confidence (LOW, MEDIUM, HIGH). |
| min_severity | string | – | Minimum severity (LOW, MEDIUM, HIGH, CRITICAL). |
| scanner_name | string | – | Scanner to use. Defaults to 'bearer'. |
| tag | string | – | The baseline tag to compare against. Defaults to 'latest'. |
| target_path | string | yes | The absolute path to the directory to scan. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
compliance_report Compliance Report ~116
Map findings to a compliance framework and report the posture. Buckets all findings against OWASP Top 10, SANS CWE Top 25, PCI DSS, or CIS using each finding's CWE / OWASP metadata.
| Name | Type | Req | Description |
|---|---|---|---|
| framework | string | – | 'owasp' (default), 'sans', 'pci', or 'cis'. |
| min_severity | string | – | Minimum severity to include. |
| output_path | string | – | Optional path to write the markdown report. |
| target_path | string | yes | The absolute path to scan. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
create_jira_issue Create Jira Issue ~92
Open a Jira issue for a security finding. Requires the JIRA_URL, JIRA_EMAIL, and JIRA_API_TOKEN environment variables.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | yes | Issue description (plain text). |
| issue_type | string | – | Jira issue type name (default 'Bug'). |
| project_key | string | yes | The Jira project key (e.g. 'SEC'). |
| summary | string | yes | Issue title. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
evaluate_policy Evaluate Policy ~259
Run all scanners and evaluate findings against a CI security policy. Returns an explicit PASS/FAIL verdict suitable for gating a pipeline. A threshold of ``-1`` means "no limit" for that severity. When ``fail_on_new`` is set, the result also fails if any finding is new relative to the named baseline (created with ``save_baseline``).
| Name | Type | Req | Description |
|---|---|---|---|
| baseline_tag | string | – | Baseline tag to diff against when ``fail_on_new`` is set. |
| fail_on_new | boolean | – | If true, fail when findings are new vs. the baseline. |
| max_critical | integer | – | Max allowed CRITICAL findings (default 0). -1 = unlimited. |
| max_high | integer | – | Max allowed HIGH findings. -1 = unlimited (default). |
| max_medium | integer | – | Max allowed MEDIUM findings. -1 = unlimited (default). |
| min_confidence | string | – | Minimum confidence to include in the scan. |
| min_severity | string | – | Minimum severity to include in the scan. |
| output_format | string | – | 'markdown' (default) or 'json' (machine-readable verdict). |
| target_path | string | yes | The absolute path to the directory to scan. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
export_sarif Export Sarif ~199
Run a SAST scan and export results in SARIF 2.1.0 format for CI/CD integration. SARIF is the industry standard format consumed by GitHub Code Scanning, GitLab SAST, Azure DevOps, and other CI/CD platforms.
| Name | Type | Req | Description |
|---|---|---|---|
| min_confidence | string | – | Minimum confidence to report (LOW, MEDIUM, HIGH). |
| min_severity | string | – | Minimum severity to report (LOW, MEDIUM, HIGH, CRITICAL). |
| output_path | string | – | Optional path to write the SARIF file. If empty, returns the SARIF JSON as a string. |
| scanner_name | string | – | The scanner to use ('bandit', 'njsscan', 'bearer', 'semgrep', 'trivy', 'codeql', 'checkov'). Defaults to 'bearer'. |
| target_path | string | yes | The absolute path to the directory or file to scan. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
export_sbom Export Sbom ~173
Run all scanners and export an SBOM / vulnerability report. Produces the supply-chain artifact enterprises expect. In CycloneDX mode, if Syft is installed the component inventory is the *full* dependency list (not just vulnerable packages); otherwise components are derived from findings. SPDX mode emits an SPDX 2.3 document.
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | 'cyclonedx' (default) or 'spdx'. |
| min_severity | string | – | Minimum severity to include. |
| output_path | string | – | File path to write the SBOM (empty = return inline). |
| sca_only | boolean | – | Include only dependency (SCA) findings (default). Set False to include every finding as a vulnerability entry. |
| target_path | string | yes | The absolute path to scan. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
generate_fix_prompt Generate Fix Prompt ~139
Build an LLM-ready prompt to fix a cached finding as a unified diff. Recovers the finding (by hash) from the scan cache, extracts an expanded window of the vulnerable source, and returns a prompt engineered to make an LLM emit a strict unified diff. After generating the patch, apply it with `apply_patch`.
| Name | Type | Req | Description |
|---|---|---|---|
| context_window | integer | – | Source lines to include before/after the finding. |
| finding_hash | string | yes | Hash of the finding to remediate (shown in scan output). |
| target_path | string | yes | Root of the scanned project (must have a `.sast-mcp-cache`). |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
generate_report Generate Report ~115
Run all scanners and render an executive security report (HTML or PDF).
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | 'html' (default) or 'pdf'. PDF requires the optional [pdf] extra (`pip install "sast-mcp-server[pdf]"`). |
| min_severity | string | – | Minimum severity to include. |
| output_path | string | – | File path to write the report (empty = return inline HTML; required for PDF since it is binary). |
| target_path | string | yes | The absolute path to scan. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
ignore_vulnerability Ignore Vulnerability ~80
Ignore a specific vulnerability finding so it won't appear in future scans.
| Name | Type | Req | Description |
|---|---|---|---|
| finding_hash | string | yes | The unique hash of the finding to ignore (shown in scan results). |
| reason | string | – | Optional justification for ignoring the vulnerability. |
| target_path | string | yes | The root directory of the project (where .sast-mcp-ignore.json lives). |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
import_sarif Import Sarif ~162
Ingest an external SARIF file into the normalized finding pipeline. Lets results from any SARIF-producing tool (Snyk, Veracode, CodeQL, a CI job, etc.) join the same dedup / baseline / dashboard flow as native scans. The findings are re-enriched with AST context and stable hashes on import.
| Name | Type | Req | Description |
|---|---|---|---|
| sarif_path | string | yes | Path to a SARIF 2.1.0 JSON file. |
| save | boolean | – | Cache the imported findings so compare_baseline / dashboards see them (default True). |
| scanner_name | string | – | Name to record as the source scanner (default 'external'). |
| target_path | string | yes | Project root the SARIF results belong to (for caching). |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_ignored_vulnerabilities List Ignored Vulnerabilities ~36
List all currently ignored vulnerability findings for a project.
| Name | Type | Req | Description |
|---|---|---|---|
| target_path | string | yes | The root directory of the project. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_scanners List Scanners ~50
List all available SAST scanners, their status, and supported languages. Returns information about each scanner including whether it is installed and ready to use, what languages it supports, and how to install it.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
notify_slack Notify Slack ~45
Send a notification to the configured Slack incoming webhook. Requires the SLACK_WEBHOOK_URL environment variable.
| Name | Type | Req | Description |
|---|---|---|---|
| message | string | yes | The message text (Slack mrkdwn supported). |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
notify_teams Notify Teams ~52
Send a notification to the configured Microsoft Teams incoming webhook. Requires the TEAMS_WEBHOOK_URL environment variable.
| Name | Type | Req | Description |
|---|---|---|---|
| message | string | yes | The message body (Markdown supported). |
| title | string | – | Card title. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
remediate_and_verify Remediate And Verify ~221
Apply a fix and prove it worked: scan → patch → re-scan → confirm gone. The closed remediation loop. Recovers the finding by hash, dry-runs the patch, re-scans the affected file before and after applying it, and returns PASS only if the finding's hash disappears **and** no new finding of equal or higher severity is introduced. On failure (and when ``auto_rollback``), the patch is reverted so the working tree is left clean.
| Name | Type | Req | Description |
|---|---|---|---|
| auto_rollback | boolean | – | Revert the patch if verification fails (default True). |
| finding_hash | string | yes | Hash of the finding to fix (from earlier scan output). |
| patch | string | yes | The unified diff to apply (e.g. produced via generate_fix_prompt). |
| scanner_name | string | – | Scanner to re-scan with. Defaults to the finding's originating scanner, falling back to all scanners. |
| target_path | string | yes | Root of the scanned project (with a `.sast-mcp-cache`). |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
run_active_scan Run Active Scan ~135
Run an active dynamic scan (DAST) using OWASP ZAP. Unlike SAST which only looks at code, this orchestrates spinning up the application via Docker Compose, waiting for it to be ready, and then running a ZAP dynamic baseline scan against the running instance.
| Name | Type | Req | Description |
|---|---|---|---|
| docker_compose_file | string | yes | The name of the docker-compose file (e.g. docker-compose.yml). |
| target_path | string | yes | Path to the directory containing the docker-compose file. |
| target_url | string | yes | The URL of the target application once it's up (e.g. http://localhost:8080). |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
save_baseline Save Baseline ~161
Run a scan and save the results as a named baseline for future comparison.
| Name | Type | Req | Description |
|---|---|---|---|
| min_confidence | string | – | Minimum confidence to include (LOW, MEDIUM, HIGH). |
| min_severity | string | – | Minimum severity to include (LOW, MEDIUM, HIGH, CRITICAL). |
| scanner_name | string | – | Scanner to use, or 'scan_all' to baseline the deduplicated results of every installed scanner (recommended for policy gating with `evaluate_policy(fail_on_new=True)`). Defaults to 'bearer'. |
| tag | string | – | A name for this baseline (e.g., 'main', 'pre-release'). Defaults to 'latest'. |
| target_path | string | yes | The absolute path to the directory to scan. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
scan_all Scan All ~239
Scan with ALL installed scanners in parallel, returning deduplicated results. Automatically detects which scanners are installed, runs them concurrently, and deduplicates findings across scanners using content-based hashing. This is the recommended tool for comprehensive security scanning.
| Name | Type | Req | Description |
|---|---|---|---|
| git_diff_only | boolean | – | If true, only reports findings in files modified in git diff. |
| limit | integer | – | Maximum number of findings to return (for pagination). |
| min_confidence | string | – | Minimum confidence to report (LOW, MEDIUM, HIGH). |
| min_severity | string | – | Minimum severity to report (LOW, MEDIUM, HIGH, CRITICAL). Defaults to MEDIUM to reduce noise from multiple scanners. |
| offset | integer | – | Pagination offset. |
| output_format | string | – | 'markdown' (human-readable, default) or 'json' (machine-readable list of findings for agents / CI). |
| target_path | string | yes | The absolute path to the directory or file to scan. |
| use_cache | boolean | – | If true, reuse the last cached scan_all when the target's files are unchanged (incremental scan). Ignored with git_diff_only. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
scan_git_history Scan Git History ~135
Scan the entire git history for leaked secrets and credentials using Gitleaks. Traditional SAST only scans the current state of files. This tool deeply analyzes the `.git` directory to find API keys, passwords, and tokens that were committed in the past but may still be valid.
| Name | Type | Req | Description |
|---|---|---|---|
| min_severity | string | – | Minimum severity threshold (defaults to LOW). |
| output_format | string | – | 'markdown' (human-readable, default) or 'json' (machine-readable list of findings for agents / CI). |
| target_path | string | – | Path to the repository root (must contain a .git directory). |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
scan_image Scan Image ~139
Scan a container image for vulnerabilities and secrets. Pulls and analyzes a container image reference (e.g. `nginx:1.25`, `ghcr.io/org/app@sha256:...`) with Trivy or Grype, returning the same normalized findings as a source scan.
| Name | Type | Req | Description |
|---|---|---|---|
| image_ref | string | yes | The image reference to scan. |
| min_severity | string | – | Minimum severity to report (LOW, MEDIUM, HIGH, CRITICAL). |
| output_format | string | – | 'markdown' (default) or 'json'. |
| scanner_name | string | – | 'trivy' (default) or 'grype'. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
scan_vulnerabilities Scan Vulnerabilities ~231
Scan a target directory for security vulnerabilities using a SAST tool.
| Name | Type | Req | Description |
|---|---|---|---|
| git_diff_only | boolean | – | If true, only reports findings in files modified in git diff. |
| limit | integer | – | Maximum number of findings to return (for pagination). |
| min_confidence | string | – | Minimum confidence to report (LOW, MEDIUM, HIGH). |
| min_severity | string | – | Minimum severity to report (LOW, MEDIUM, HIGH, CRITICAL). |
| offset | integer | – | Pagination offset. |
| output_format | string | – | 'markdown' (human-readable, default) or 'json' (machine-readable list of findings for agents / CI). |
| scanner_name | string | – | The scanner to use ('bandit', 'njsscan', 'bearer', 'semgrep'). Defaults to 'bearer'. |
| target_path | string | yes | The absolute path to the directory or file to scan. |
| use_cache | boolean | – | If true, reuse the last cached scan when the target's files are unchanged (incremental scan). Ignored when git_diff_only is set. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
triage_finding Triage Finding ~110
Triage a finding: get an exploitability prompt, or record a VEX decision.
| Name | Type | Req | Description |
|---|---|---|---|
| disposition | string | – | VEX state keyword (empty = return a triage prompt instead). |
| finding_hash | string | yes | Hash of the finding to triage. |
| justification | string | – | Rationale (CycloneDX justification keyword for not_affected, otherwise free text). |
| target_path | string | yes | Root of the scanned project (with a `.sast-mcp-cache`). |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
unignore_vulnerability Unignore Vulnerability ~56
Remove a vulnerability from the ignore list so it appears in future scans again.
| Name | Type | Req | Description |
|---|---|---|---|
| finding_hash | string | yes | The unique hash of the finding to unignore. |
| target_path | string | yes | The root directory of the project. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
upload_to_defectdojo Upload To Defectdojo ~122
Upload a SARIF report to a DefectDojo engagement. Requires the DEFECTDOJO_URL and DEFECTDOJO_API_KEY environment variables. Generate the SARIF file first with `export_sarif(output_path=...)`.
| Name | Type | Req | Description |
|---|---|---|---|
| active | boolean | – | Mark imported findings as active. |
| engagement_id | integer | yes | Numeric ID of the target DefectDojo engagement. |
| sarif_path | string | yes | Path to a SARIF file produced by `export_sarif`. |
| verified | boolean | – | Mark imported findings as verified. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
upload_to_github Upload To Github ~127
Upload a SARIF report to GitHub Code Scanning. Requires a GITHUB_TOKEN environment variable with `security_events: write` scope. Generate the SARIF file first with `export_sarif(output_path=...)`.
| Name | Type | Req | Description |
|---|---|---|---|
| commit_sha | string | yes | Full SHA of the commit the results apply to. |
| ref | string | yes | Fully qualified ref, e.g. `refs/heads/main`. |
| repo | string | yes | Repository in `owner/name` form. |
| sarif_path | string | yes | Path to a SARIF file produced by `export_sarif`. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
How do I install the SAST MCP Server server?
SAST MCP Server runs locally as a PyPI package, launched with uvx sast-mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · sast-mcp-server
claude mcp add skyrxin-sast-mcp-server -- uvx sast-mcp-server
What is the SAST MCP Server server?
SAST MCP Server is listed in the public MCP registry as io.github.Skyrxin/sast-mcp-server. 11-scanner SAST/DAST MCP server with closed-loop remediation, SBOM/SARIF, and CI integrations. This page covers its PyPI package (sast-mcp-server).
Is the SAST MCP Server server safe to use?
SAST MCP Server scores 91 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the SAST MCP Server server expose?
SAST MCP Server exposes 27 tools: scan_vulnerabilities, ignore_vulnerability, unignore_vulnerability, list_scanners, list_ignored_vulnerabilities, and 22 more. Their descriptions and schemas cost roughly 3,554 tokens of context every time the server is loaded.
Is the SAST MCP Server server still maintained?
SAST MCP Server is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the SAST MCP Server server under?
SAST MCP Server declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.