DevSecOps

You have a DevSecOps MCP server that consolidates security tooling (SAST, DAST, SCA) to automate AI-powered DevSecOps workflows. It enables security scanning, vulnerability analysis, and professional reports, and is designed to integrate with MCP clients to orchestrate security actions inside your development processes.

How to use

To use this MCP server with an MCP client, connect to the server’s MCP endpoint or run the local MCP process, and then issue security tools requests through the client. You can chain SAST, SCA, and DAST scans, then generate consolidated security reports and validate policies. The workflow enables you to automate security checks as part of your development pipeline, adapt thresholds and policies, and receive structured results suitable for remediation planning.

How to install

Prerequisites You need Node.js 18 or later, Python 3.8 or later for security tooling, and Docker with Docker Compose for container deployments.

Install the required security tools and utilities as shown below. These steps are demonstrated in the original setup but translated for direct execution.

# Install SAST tools
pip3 install semgrep bandit

# Pull DAST tooling (Docker-based)
docker pull ghcr.io/zaproxy/zaproxy:stable

# Install optional OSV Scanner
wget -qO- https://github.com/google/osv-scanner/releases/latest/download/osv-scanner_linux_amd64.tar.gz | tar -xz -C /usr/local/bin

# Install optional Trivy
wget -qO- https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh

# Optional: verify Node and Python versions
node --version
python3 --version

Additional setup steps

Development local setup includes cloning the repository, installing dependencies, configuring environment variables, building, and starting the server.

# 1. Clone the repository
git clone <repository-url>
cd DevSecOps-MCP

# 2. Install dependencies
npm install

# 3. Configure environment
cp .env.example .env
# Edit .env with your tool credentials

# 4. Build the project
npm run build

# 5. Start the MCP server locally
npm run start:mcp

Deployment with Docker

You can deploy using Docker Compose or run a standalone Docker container. The commands below show the straightforward paths to bring up the MCP server with configured credentials.

# Using Docker Compose (recommended)
cp .env.example .env
# Edit .env with your credentials

docker-compose up -d

# Alternatively, using Docker directly
# Build image
docker build -t devsecops-mcp .

# Run container
docker run -p 3000:3000 --env-file .env devsecops-mcp

Configuring the MCP client

To connect Claude Desktop or other MCP clients, configure the client with a server entry that points to either the HTTP MCP endpoint or the local stdio MCP process.

Claude Desktop configuration example (stdio) uses a Node command to launch the MCP server bundle and sets environment variables for production use.

module config example for Claude Desktop
{"mcpServers": {
  "devsecops": {
    "command": "node",
    "args": ["dist/src/mcp/server.js"],
    "cwd": "/path/to/DevSecOps-MCP",
    "env": {
      "NODE_ENV": "production",
      "MCP_PORT": "3000",
      "LOG_LEVEL": "info",
      "SECURITY_STRICT_MODE": "true"
    }
  }
}}

Alternative client configuration

If you prefer a pre-provisioned configuration file, you can copy the provided MCP client configuration and adapt the cwd path to your installation.

# Copy and adjust the client config
cp .mcprc.json ~/Library/Application Support/Claude/claude_desktop_config.json
# Edit the path for cwd to match your installation

Environment and security configuration

Ensure the required environment variables are defined for basic functionality and optional variables for extended security tooling. The following are commonly used examples.

# Core server configuration
NODE_ENV=production
MCP_PORT=3000
SECURITY_STRICT_MODE=true

# Tool integrations
SONARQUBE_TOKEN=your-token
ZAP_API_KEY=your-api-key
OSV_SCANNER_PATH=osv-scanner
TRIVY_PATH=trivy
TRIVY_CACHE_DIR=/tmp/trivy-cache

MCP tools overview

This server provides a set of security tools for automated workflows, including SAST, DAST, SCA, and IAST, plus reporting and policy validation capabilities.

Security features and notes

Security quality gates ensure vulnerabilities are tracked across scans, with policy checks and remediation guidance. Pre-commit hooks can enforce standards, and CI/CD integrations help embed security into your pipelines.

Troubleshooting and notes

If you encounter issues during installation or run, review common problems such as tool installation permissions, TypeScript compilation, Docker permissions, port conflicts, or vulnerable dependency setups. Apply the recommended fixes to restore normal operation.

Examples of usage

You can run security scans in a pipeline by issuing the appropriate MCP tool calls via the client, then request a comprehensive report once multiple scans complete.

Available tools

run_sast_scan

Execute a security SAST scan against the target codebase with configurable rules and severity threshold.

run_dast_scan

Execute a dynamic application security test against the target URL with optional authentication.

run_sca_scan

Execute a software composition analysis to identify vulnerable dependencies.

run_iast_scan

Perform an interactive security analysis against the running application.

generate_security_report

Generate a comprehensive security report from scan results in the desired format.

validate_security_policy

Validate scan results against a security policy file.