Security

Provides a security-focused MCP server with secret detection, SCA, SAST, DAST tooling, and remediation guidance to support model-driven remediation workflows.

shell

0

GitHub Stars

shell

Language

7 months ago

First Indexed

3 months ago

Catalog Refreshed

Documentation & install

Readme and setup notes from the catalogue, plus a client-ready config you can copy for your MCP host.

Installation

Add the following to your MCP client configuration file.

Configuration

View docs

{
  "mcpServers": {
    "michoo-security_mcp": {
      "command": "uv",
      "args": [
        "run",
        "mcp_server.py"
      ]
    }
  }
}

You run a security-focused MCP server that lets a model interact with security tooling, run scans, and get remediation guidance. It’s designed to plug into MCP clients so you can orchestrate tooling from your AI-powered workflows and test remediation workflows within an IDE or similar environment.

How to use

Connect an MCP client to your local MCP server and start a scan by selecting the server you configured. Once connected, request security scans, SCA/SAST/DAST tools, or remediation suggestions. You can run local scans or integrate the server into your development workflow to automate testing and remediation tasks as part of your AI-assisted workflows.

How to install

Prerequisites you need before starting:

Python 3.12+
UV package manager (already configured)

Steps to install and run the MCP server locally:

mkdir .venv
uv sync

uv run mcp_server.py

or, activate the virtual environment and run directly:

source .venv/bin/activate
python mcp_server.py

After starting, the server will be available at:

http://127.0.0.1:8000/mcp

To connect a client, update its settings to point to the running MCP server.

## Additional sections

Security considerations are important when running MCP servers. Ensure you use secure connections for clients, apply the latest security patches, and monitor interactions between clients, servers, and tools.

## Configuration and tools

This server provides an array of security-focused tooling capabilities, including secret detection, software composition analysis, SAST, and DAST. The built-in remediation guidance leverages generative AI to help you prioritize fixes.

## Debugging with the MCP Inspector

If you want to inspect or debug the server, use the MCP Inspector tool. It provides a GUI to observe requests, responses, and tool invocations as you interact with the server.

## IDE compatibility and recommendations

Visual Studio Code, Cursor IDE, and other editors can work with MCP servers. Start the server from the IDE’s MCP server panel and connect the client to http://127.0.0.1:8000/mcp to begin issuing tool invocations.

## License

MIT License.

## Available tools

### secret\_detection\_nosey\_parker

Secret detection capability that scans code and configuration for exposed credentials or tokens.

### secret\_detection\_kingfisher

Secret detection (work-in-progress) for advanced secret leakage patterns.

### gitleaks

Gitleaks-based scanning to discover secrets in version control history and working trees.

### trivy

SCA scanner that detects vulnerabilities in dependencies and IaC assets.

### osv\_scanner

Open Source Vulnerability scanner for known vulnerabilities in dependencies.

### sca\_fixes

Remediation guidance and automated fixes for identified SCA findings.

### opengrep

Static application security testing using pattern-based search for potential issues.

### nuclei

DAST tool for dynamic testing and vulnerability probing of running services.

### zaproxy

OWASP ZAP-based dynamic security testing for web applications.