SAST MCP Server

Overview

SAST MCP Server brings static and dynamic application security scanning into your AI workflow. It integrates 11 different security scanners for SAST and DAST analysis, generates SBOMs and SARIF reports, and closes the loop with built-in remediation guidance and CI pipeline hooks. Rather than switching between tools, your AI assistant can invoke these capabilities directly through the Model Context Protocol.

The server runs locally on your machine as the Python package sast-mcp-server, installed via uvx. It communicates with MCP clients over stdio and requires an API key for authentication. Version v0.8.3 is the current release, published under the MIT license with full source code available at Skyrxin/sast-mcp-server on GitHub.

SAST MCP Server is listed in the Development category on mcp.site and works with any MCP-compatible client, including Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, and Zed. If you maintain this server, claim your listing to earn a Verified badge and keep information up to date.

Installation

// claude_desktop_config.json
{
  "mcpServers": {
    "sast_mcp_server": {
      "command": "uvx",
      "args": [
        "sast-mcp-server"
      ]
    }
  }
}