Shamash

You can run a dedicated security audit and compliance workflow within defined project boundaries. This MCP server orchestrates multiple security tools, enforces strict scope, and provides comprehensive audit logging so you can validate compliance, detect vulnerabilities, and keep operations within safe limits.

How to use

You integrate the MCP server with your client and request scans or tests that run inside the project boundary. Choose from the available actions to perform a full project security assessment, a network-focused check, application pentesting, or a compliance validation. All results are processed with boundary checks and are cached for performance.

How to install

Prerequisites: you need Node.js and npm installed on your system.

# Install dependencies
npm install

# Build the MCP Shamash server
npm run build

Run the server in production mode or development mode depending on your workflow.

# Production start
npm start

# Development mode
npm run dev

Optionally, try the interactive demo to experience all features in a safe sandbox.

node demo.js

Configuration and usage notes

You can configure the MCP Shamash server through the MCP client by referencing the integration example provided. This enables you to run the server as a local process and issue commands for project scans, network checks, and compliance validation.

Environment variables control token limits and audit logging. You’ll commonly set per-scan and hourly token caps and designate where audit logs are stored.

Configuration snippets and integration

{
  "mcpServers": {
    "shamash": {
      "command": "node",
      "args": ["/path/to/mcp_shamash/dist/index.js"]
    }
  }
}

Available MCP actions

Use dedicated actions to perform security checks and validation across your codebase and deployments. Each action is designed to run within project boundaries and to provide structured results for auditing and reporting.

Available tools

scan_project

Comprehensive security scan of the project directory using integrated tools like Semgrep, Trivy, and Gitleaks with configurable profiles and timeouts.

scan_network

Network scanning within project boundaries to assess exposed services, ports, and surface area while enforcing scope controls.

pentest_application

Penetration testing of deployed applications to identify common flaws such as injection, XSS, and CSRF within the permitted scope.

check_compliance

Validation against security and compliance frameworks such as OWASP, CIS, and NIST to generate formal compliance evidence.