SD Elements

You run an MCP server to access and manage SD Elements API v2 from MCP clients. This server supports STDIO for local operation and HTTP for a long-running service with per-request credentials, letting you manage projects, surveys, countermeasures, scans, reports, diagrams, and users through MCP clients.

How to use

You can run the STDIO server locally and connect MCP clients to it, or start an HTTP server for long-running use with per-request credentials. The STDIO setup uses a local process that you launch and control from your MCP client configuration. The HTTP setup runs a network service that clients talk to over HTTP, with credentials supplied per request.

Key capabilities you can access include creating and managing projects, surveys, and countermeasures, running scans and generating reports, and handling users and diagrams. Per-request authentication for HTTP mode requires you to pass credentials with each call, while STDIO uses environment variables within the local process. Use the provided client configuration examples to wire your MCP client to the server you choose.

How to install

Prerequisites: you need Node.js installed on your system. You will also rely on npm for dependency management and running the server. Make sure your environment is set up for local development.

Step 1: Install dependencies for the server and prepare the environment.

Step 2: Start the STDIO server from the repository setup shown below.

Configuration and usage notes

Required configuration for STDIO and HTTP modes is shown in the examples. You will set credentials and host information in your client configuration, or in environment variables when running the process locally.

For HTTP mode, you do not set global credentials in the server process. Instead, provide credentials with each request. You also need an instance allowlist to restrict acceptable hosts.

If you are testing locally with HTTP, you may enable insecure HTTP hosts in trusted environments.

Additional notes

Build and start commands are shown as part of the setup. You may run a build before starting the server in the local checkout scenario.

The server supports a default compact toolset, with an option to expose legacy tools when you set the appropriate toolset flag.

Troubleshooting and tips

If a required environment variable is missing, tools may fail to run. Ensure all shown environment variables are provided in your client configuration or in the server’s startup environment.

Examples and quick-start snippets

npm ci
npm run start

npm run start:http

{
  "mcpServers": {
    "sdelements": {
      "command": "npm",
      "args": ["run", "start"]
    }
  }
}

{
  "mcpServers": {
    "sdelements-http": {
      "url": "http://127.0.0.1:3000/mcp",
      "type": "http",
      "args": []
    }
  }
}

{
  "mcpServers": {
    "sdelements": {
      "command": "node",
      "args": ["/absolute/path/to/sde-mcp/dist/main.js"],
      "env": {
        "SDE_HOST": "https://your-sdelements-instance.com",
        "SDE_API_KEY": "your-api-key-here"
      }
    }
  }
}
```"}]},

Note: You can also run the HTTP server and configure MCP clients to talk to http://127.0.0.1:3000/mcp with headers providing SDE_HOST and SDE_API_KEY for each request.

Build

npm run build

Local checkout build (for Option B)

npm ci
npm run build

Tools

Toolset offers a compact default with an option to enable a full legacy toolset. The server exposes a range of tools to interact with projects, libraries, countermeasures, surveys, scans, and users.

Notes

Missing environment variables will cause tools to fail. Ensure you provide the shown environment variables for the server and client configurations.

Available tools

test_connection

Test connectivity to the SD Elements MCP server and validate basic communication with the configured SDE host and API key.

api_request

Send a generic API request through the MCP bridge to the SD Elements API and return the response.

project

Interact with projects: create, read, update, and manage project-specific data.

library_search

Search the SD Elements library for countermeasures, threats, components, weaknesses, profiles, risk policies, and related items.

project_survey

Access and manage surveys tied to a project, including answers and findings.

project_countermeasures

Work with countermeasures linked to projects, including status and notes.

applications

Manage applications associated with projects or libraries as supported by the API.

business_unit

Handle business units related to projects and countermeasures.

get_countermeasure

Retrieve detailed information about a specific countermeasure.

list_projects

List all projects available in your SD Elements workspace.

get_project

Fetch details for a specific project by identifier.

update_project

Update properties of an existing project.

create_project

Create a new project in the workspace.

create_project_from_code

Create a project using a code-based import flow.

test_connection

Verify that the MCP connection to the SD Elements API is functioning.