Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

SAST MCP Server

PYPI · SAST-MCP-SERVER · SCANNED SEP 20

11-scanner SAST/DAST MCP server with closed-loop remediation, SBOM/SARIF, and CI integrations

Available components

−1 this week 68 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security50
  • Malware scan not yet available for this package.Unverified
  • No known CVEs affecting this package version or its production dependencies.Pass
  • Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
  • 1 of 25 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 88 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability85
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 3729 tokens (~128/item across 29 items; 27 tools + 2 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management83
  • Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "unignore_vulnerability" implies "remove" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 29 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
Install

How do I install the SAST MCP Server server?

SAST MCP Server runs locally as a PyPI package, launched with uvx sast-mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

pypi · sast-mcp-server

# add to Claude Code
claude mcp add skyrxin-sast-mcp-server -- uvx sast-mcp-server
// .cursor/mcp.json
{
  "mcpServers": {
    "skyrxin-sast-mcp-server": {
      "command": "uvx",
      "args": [
        "sast-mcp-server"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "skyrxin-sast-mcp-server": {
      "command": "uvx",
      "args": [
        "sast-mcp-server"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add skyrxin-sast-mcp-server -- uvx sast-mcp-server
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "skyrxin-sast-mcp-server": {
      "type": "local",
      "command": [
        "uvx",
        "sast-mcp-server"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add skyrxin-sast-mcp-server --command uvx --arg sast-mcp-server
# ~/.hermes/config.yaml
mcp_servers:
  skyrxin-sast-mcp-server:
    command: "uvx"
    args: ["sast-mcp-server"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "skyrxin-sast-mcp-server": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "sast-mcp-server"
      ]
    }
  }
}
# add to Vellum
assistant mcp add skyrxin-sast-mcp-server -t stdio -c uvx -a sast-mcp-server
// mcp.json
{
  "mcpServers": {
    "skyrxin-sast-mcp-server": {
      "command": "uvx",
      "args": [
        "sast-mcp-server"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 19 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 77 to 80. That category is still filling its 30-day observation window: 23 days of observed history at the previous scan, 24 at this one. The score rises as the window fills, whether or not the server changes.

  • 18 Sept 26 −3
    • Stability: pass → 0.77 functional
  • 17 Sept 26 0
    • Stability: 0.97 → pass security
  • 16 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 13 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 12 Sept 26 −2
    • Stability: pass → 0.83 functional
  • 11 Sept 26 0
    • Stability: 0.97 → pass security
  • 10 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed pypi/sast-mcp-server@0.8.3

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem pypi

Background: How many MCP packages publish verified provenance →

Install scripts 1 script
Hook Tier Command
build_backend allowlisted hatchling.build

Background: Why install scripts are a supply-chain risk →

Dependencies 25 packages
Packages resolved 25
Stale 1
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 27 exposed · ~3,554 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
apply_patch ~98

Apply an agent-generated unified diff to files under target_path. Uses `git apply`, which refuses paths that escape the target directory. Run with `check_only=True` first to verify the patch applies cleanly before writing changes.

NameTypeReqDescription
check_onlybooleanIf True, validate without modifying any files.
patchstringyesThe unified diff text to apply.
target_pathstringyesDirectory the patch paths are relative to.
NameTypeReqDescription
resultstringyes

No examples provided.

comment_on_pr ~143

Post a security summary comment on a GitHub PR or GitLab merge request. Credentials come from environment variables only: GITHUB_TOKEN for GitHub, or GITLAB_TOKEN (+ optional GITLAB_URL) for GitLab.

NameTypeReqDescription
bodystringyesMarkdown comment body (e.g. a scan summary or gate result).
pr_numberintegeryesPR number (GitHub) or merge request IID (GitLab).
providerstringyes'github' or 'gitlab'.
repostringyesFor GitHub, 'owner/name'. For GitLab, the numeric project ID or URL-encoded 'group/project' path.
NameTypeReqDescription
resultstringyes

No examples provided.

compare_baseline ~119

Compare current scan results against a saved baseline. Shows new vulnerabilities, fixed vulnerabilities, and severity trends.

NameTypeReqDescription
min_confidencestringMinimum confidence (LOW, MEDIUM, HIGH).
min_severitystringMinimum severity (LOW, MEDIUM, HIGH, CRITICAL).
scanner_namestringScanner to use. Defaults to 'bearer'.
tagstringThe baseline tag to compare against. Defaults to 'latest'.
target_pathstringyesThe absolute path to the directory to scan.
NameTypeReqDescription
resultstringyes

No examples provided.

compliance_report ~116

Map findings to a compliance framework and report the posture. Buckets all findings against OWASP Top 10, SANS CWE Top 25, PCI DSS, or CIS using each finding's CWE / OWASP metadata.

NameTypeReqDescription
frameworkstring'owasp' (default), 'sans', 'pci', or 'cis'.
min_severitystringMinimum severity to include.
output_pathstringOptional path to write the markdown report.
target_pathstringyesThe absolute path to scan.
NameTypeReqDescription
resultstringyes

No examples provided.

create_jira_issue ~92

Open a Jira issue for a security finding. Requires the JIRA_URL, JIRA_EMAIL, and JIRA_API_TOKEN environment variables.

NameTypeReqDescription
descriptionstringyesIssue description (plain text).
issue_typestringJira issue type name (default 'Bug').
project_keystringyesThe Jira project key (e.g. 'SEC').
summarystringyesIssue title.
NameTypeReqDescription
resultstringyes

No examples provided.

evaluate_policy ~259

Run all scanners and evaluate findings against a CI security policy. Returns an explicit PASS/FAIL verdict suitable for gating a pipeline. A threshold of ``-1`` means "no limit" for that severity. When ``fail_on_new`` is set, the result also fails if any finding is new relative to the named baseline (created with ``save_baseline``).

NameTypeReqDescription
baseline_tagstringBaseline tag to diff against when ``fail_on_new`` is set.
fail_on_newbooleanIf true, fail when findings are new vs. the baseline.
max_criticalintegerMax allowed CRITICAL findings (default 0). -1 = unlimited.
max_highintegerMax allowed HIGH findings. -1 = unlimited (default).
max_mediumintegerMax allowed MEDIUM findings. -1 = unlimited (default).
min_confidencestringMinimum confidence to include in the scan.
min_severitystringMinimum severity to include in the scan.
output_formatstring'markdown' (default) or 'json' (machine-readable verdict).
target_pathstringyesThe absolute path to the directory to scan.
NameTypeReqDescription
resultstringyes

No examples provided.

export_sarif ~199

Run a SAST scan and export results in SARIF 2.1.0 format for CI/CD integration. SARIF is the industry standard format consumed by GitHub Code Scanning, GitLab SAST, Azure DevOps, and other CI/CD platforms.

NameTypeReqDescription
min_confidencestringMinimum confidence to report (LOW, MEDIUM, HIGH).
min_severitystringMinimum severity to report (LOW, MEDIUM, HIGH, CRITICAL).
output_pathstringOptional path to write the SARIF file. If empty, returns the SARIF JSON as a string.
scanner_namestringThe scanner to use ('bandit', 'njsscan', 'bearer', 'semgrep', 'trivy', 'codeql', 'checkov'). Defaults to 'bearer'.
target_pathstringyesThe absolute path to the directory or file to scan.
NameTypeReqDescription
resultstringyes

No examples provided.

export_sbom ~173

Run all scanners and export an SBOM / vulnerability report. Produces the supply-chain artifact enterprises expect. In CycloneDX mode, if Syft is installed the component inventory is the *full* dependency list (not just vulnerable packages); otherwise components are derived from findings. SPDX mode emits an SPDX 2.3 document.

NameTypeReqDescription
formatstring'cyclonedx' (default) or 'spdx'.
min_severitystringMinimum severity to include.
output_pathstringFile path to write the SBOM (empty = return inline).
sca_onlybooleanInclude only dependency (SCA) findings (default). Set False to include every finding as a vulnerability entry.
target_pathstringyesThe absolute path to scan.
NameTypeReqDescription
resultstringyes

No examples provided.

generate_fix_prompt ~139

Build an LLM-ready prompt to fix a cached finding as a unified diff. Recovers the finding (by hash) from the scan cache, extracts an expanded window of the vulnerable source, and returns a prompt engineered to make an LLM emit a strict unified diff. After generating the patch, apply it with `apply_patch`.

NameTypeReqDescription
context_windowintegerSource lines to include before/after the finding.
finding_hashstringyesHash of the finding to remediate (shown in scan output).
target_pathstringyesRoot of the scanned project (must have a `.sast-mcp-cache`).
NameTypeReqDescription
resultstringyes

No examples provided.

generate_report ~115

Run all scanners and render an executive security report (HTML or PDF).

NameTypeReqDescription
formatstring'html' (default) or 'pdf'. PDF requires the optional [pdf] extra (`pip install "sast-mcp-server[pdf]"`).
min_severitystringMinimum severity to include.
output_pathstringFile path to write the report (empty = return inline HTML; required for PDF since it is binary).
target_pathstringyesThe absolute path to scan.
NameTypeReqDescription
resultstringyes

No examples provided.

ignore_vulnerability ~80

Ignore a specific vulnerability finding so it won't appear in future scans.

NameTypeReqDescription
finding_hashstringyesThe unique hash of the finding to ignore (shown in scan results).
reasonstringOptional justification for ignoring the vulnerability.
target_pathstringyesThe root directory of the project (where .sast-mcp-ignore.json lives).
NameTypeReqDescription
resultstringyes

No examples provided.

import_sarif ~162

Ingest an external SARIF file into the normalized finding pipeline. Lets results from any SARIF-producing tool (Snyk, Veracode, CodeQL, a CI job, etc.) join the same dedup / baseline / dashboard flow as native scans. The findings are re-enriched with AST context and stable hashes on import.

NameTypeReqDescription
sarif_pathstringyesPath to a SARIF 2.1.0 JSON file.
savebooleanCache the imported findings so compare_baseline / dashboards see them (default True).
scanner_namestringName to record as the source scanner (default 'external').
target_pathstringyesProject root the SARIF results belong to (for caching).
NameTypeReqDescription
resultstringyes

No examples provided.

list_ignored_vulnerabilities ~36

List all currently ignored vulnerability findings for a project.

NameTypeReqDescription
target_pathstringyesThe root directory of the project.
NameTypeReqDescription
resultstringyes

No examples provided.

list_scanners ~50

List all available SAST scanners, their status, and supported languages. Returns information about each scanner including whether it is installed and ready to use, what languages it supports, and how to install it.

Input schema present but exposes no named parameters.

NameTypeReqDescription
resultstringyes

No examples provided.

notify_slack ~45

Send a notification to the configured Slack incoming webhook. Requires the SLACK_WEBHOOK_URL environment variable.

NameTypeReqDescription
messagestringyesThe message text (Slack mrkdwn supported).
NameTypeReqDescription
resultstringyes

No examples provided.

notify_teams ~52

Send a notification to the configured Microsoft Teams incoming webhook. Requires the TEAMS_WEBHOOK_URL environment variable.

NameTypeReqDescription
messagestringyesThe message body (Markdown supported).
titlestringCard title.
NameTypeReqDescription
resultstringyes

No examples provided.

remediate_and_verify ~221

Apply a fix and prove it worked: scan → patch → re-scan → confirm gone. The closed remediation loop. Recovers the finding by hash, dry-runs the patch, re-scans the affected file before and after applying it, and returns PASS only if the finding's hash disappears **and** no new finding of equal or higher severity is introduced. On failure (and when ``auto_rollback``), the patch is reverted so the working tree is left clean.

NameTypeReqDescription
auto_rollbackbooleanRevert the patch if verification fails (default True).
finding_hashstringyesHash of the finding to fix (from earlier scan output).
patchstringyesThe unified diff to apply (e.g. produced via generate_fix_prompt).
scanner_namestringScanner to re-scan with. Defaults to the finding's originating scanner, falling back to all scanners.
target_pathstringyesRoot of the scanned project (with a `.sast-mcp-cache`).
NameTypeReqDescription
resultstringyes

No examples provided.

run_active_scan ~135

Run an active dynamic scan (DAST) using OWASP ZAP. Unlike SAST which only looks at code, this orchestrates spinning up the application via Docker Compose, waiting for it to be ready, and then running a ZAP dynamic baseline scan against the running instance.

NameTypeReqDescription
docker_compose_filestringyesThe name of the docker-compose file (e.g. docker-compose.yml).
target_pathstringyesPath to the directory containing the docker-compose file.
target_urlstringyesThe URL of the target application once it's up (e.g. http://localhost:8080).
NameTypeReqDescription
resultstringyes

No examples provided.

save_baseline ~161

Run a scan and save the results as a named baseline for future comparison.

NameTypeReqDescription
min_confidencestringMinimum confidence to include (LOW, MEDIUM, HIGH).
min_severitystringMinimum severity to include (LOW, MEDIUM, HIGH, CRITICAL).
scanner_namestringScanner to use, or 'scan_all' to baseline the deduplicated results of every installed scanner (recommended for policy gating with `evaluate_policy(fail_on_new=True)`). Defaults to 'bearer'.
tagstringA name for this baseline (e.g., 'main', 'pre-release'). Defaults to 'latest'.
target_pathstringyesThe absolute path to the directory to scan.
NameTypeReqDescription
resultstringyes

No examples provided.

scan_all ~239

Scan with ALL installed scanners in parallel, returning deduplicated results. Automatically detects which scanners are installed, runs them concurrently, and deduplicates findings across scanners using content-based hashing. This is the recommended tool for comprehensive security scanning.

NameTypeReqDescription
git_diff_onlybooleanIf true, only reports findings in files modified in git diff.
limitintegerMaximum number of findings to return (for pagination).
min_confidencestringMinimum confidence to report (LOW, MEDIUM, HIGH).
min_severitystringMinimum severity to report (LOW, MEDIUM, HIGH, CRITICAL). Defaults to MEDIUM to reduce noise from multiple scanners.
offsetintegerPagination offset.
output_formatstring'markdown' (human-readable, default) or 'json' (machine-readable list of findings for agents / CI).
target_pathstringyesThe absolute path to the directory or file to scan.
use_cachebooleanIf true, reuse the last cached scan_all when the target's files are unchanged (incremental scan). Ignored with git_diff_only.
NameTypeReqDescription
resultstringyes

No examples provided.

scan_git_history ~135

Scan the entire git history for leaked secrets and credentials using Gitleaks. Traditional SAST only scans the current state of files. This tool deeply analyzes the `.git` directory to find API keys, passwords, and tokens that were committed in the past but may still be valid.

NameTypeReqDescription
min_severitystringMinimum severity threshold (defaults to LOW).
output_formatstring'markdown' (human-readable, default) or 'json' (machine-readable list of findings for agents / CI).
target_pathstringPath to the repository root (must contain a .git directory).
NameTypeReqDescription
resultstringyes

No examples provided.

scan_image ~139

Scan a container image for vulnerabilities and secrets. Pulls and analyzes a container image reference (e.g. `nginx:1.25`, `ghcr.io/org/app@sha256:...`) with Trivy or Grype, returning the same normalized findings as a source scan.

NameTypeReqDescription
image_refstringyesThe image reference to scan.
min_severitystringMinimum severity to report (LOW, MEDIUM, HIGH, CRITICAL).
output_formatstring'markdown' (default) or 'json'.
scanner_namestring'trivy' (default) or 'grype'.
NameTypeReqDescription
resultstringyes

No examples provided.

scan_vulnerabilities ~231

Scan a target directory for security vulnerabilities using a SAST tool.

NameTypeReqDescription
git_diff_onlybooleanIf true, only reports findings in files modified in git diff.
limitintegerMaximum number of findings to return (for pagination).
min_confidencestringMinimum confidence to report (LOW, MEDIUM, HIGH).
min_severitystringMinimum severity to report (LOW, MEDIUM, HIGH, CRITICAL).
offsetintegerPagination offset.
output_formatstring'markdown' (human-readable, default) or 'json' (machine-readable list of findings for agents / CI).
scanner_namestringThe scanner to use ('bandit', 'njsscan', 'bearer', 'semgrep'). Defaults to 'bearer'.
target_pathstringyesThe absolute path to the directory or file to scan.
use_cachebooleanIf true, reuse the last cached scan when the target's files are unchanged (incremental scan). Ignored when git_diff_only is set.
NameTypeReqDescription
resultstringyes

No examples provided.

triage_finding ~110

Triage a finding: get an exploitability prompt, or record a VEX decision.

NameTypeReqDescription
dispositionstringVEX state keyword (empty = return a triage prompt instead).
finding_hashstringyesHash of the finding to triage.
justificationstringRationale (CycloneDX justification keyword for not_affected, otherwise free text).
target_pathstringyesRoot of the scanned project (with a `.sast-mcp-cache`).
NameTypeReqDescription
resultstringyes

No examples provided.

unignore_vulnerability ~56

Remove a vulnerability from the ignore list so it appears in future scans again.

NameTypeReqDescription
finding_hashstringyesThe unique hash of the finding to unignore.
target_pathstringyesThe root directory of the project.
NameTypeReqDescription
resultstringyes

No examples provided.

upload_to_defectdojo ~122

Upload a SARIF report to a DefectDojo engagement. Requires the DEFECTDOJO_URL and DEFECTDOJO_API_KEY environment variables. Generate the SARIF file first with `export_sarif(output_path=...)`.

NameTypeReqDescription
activebooleanMark imported findings as active.
engagement_idintegeryesNumeric ID of the target DefectDojo engagement.
sarif_pathstringyesPath to a SARIF file produced by `export_sarif`.
verifiedbooleanMark imported findings as verified.
NameTypeReqDescription
resultstringyes

No examples provided.

upload_to_github ~127

Upload a SARIF report to GitHub Code Scanning. Requires a GITHUB_TOKEN environment variable with `security_events: write` scope. Generate the SARIF file first with `export_sarif(output_path=...)`.

NameTypeReqDescription
commit_shastringyesFull SHA of the commit the results apply to.
refstringyesFully qualified ref, e.g. `refs/heads/main`.
repostringyesRepository in `owner/name` form.
sarif_pathstringyesPath to a SARIF file produced by `export_sarif`.
NameTypeReqDescription
resultstringyes

No examples provided.

Common questions

What is the SAST MCP Server server?

SAST MCP Server is listed in the public MCP registry as io.github.Skyrxin/sast-mcp-server. 11-scanner SAST/DAST MCP server with closed-loop remediation, SBOM/SARIF, and CI integrations. This page covers its PyPI package (sast-mcp-server).

Is the SAST MCP Server server safe to use?

SAST MCP Server scores 68 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the SAST MCP Server server expose?

SAST MCP Server exposes 27 tools: scan_vulnerabilities, ignore_vulnerability, unignore_vulnerability, list_scanners, list_ignored_vulnerabilities, and 22 more. Their descriptions and schemas cost roughly 3,554 tokens of context every time the server is loaded.

Is the SAST MCP Server server still maintained?

SAST MCP Server is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the SAST MCP Server server under?

SAST MCP Server declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.