StackHawk MCP Server

Current Version: 1.2.5 Requires Python 3.10 or higher

A Model Context Protocol (MCP) server for integrating with StackHawk's security scanning platform. Helps developers set up StackHawk, run security scans, and triage findings to fix vulnerabilities — all from within an LLM-powered IDE or chat.

Table of Contents

• Features
• Installation
• Usage
• Configuration
• Available Tools
• Testing & Development
• Example Configurations
• Integrating with LLMs and IDEs
• Contributing
• License

Features

• Setup: Detect your project, create a StackHawk application, and generate a ready-to-scan stackhawk.yml
• Scan: Run StackHawk scans directly from your IDE or chat (with install help if the CLI is missing)
• Triage: Get actionable findings at or above your failure threshold for remediation
• Validate: Check YAML configs against the official schema and validate field paths to prevent hallucination
• Custom User-Agent: All API calls include a versioned User-Agent header

Installation

1. Install via pip (make sure you have write permission to your current python environment):

   > pip install stackhawk-mcp
   # Requires Python 3.10 or higher
   

Or Install via pip in a virtual env:

> python3 -m venv ~/.virtualenvs/mcp
> source ~/.virtualenvs/mcp/bin/activate
> (mcp) pip install stackhawk-mcp
# Requires Python 3.10 or higher

Or Install via pip using pyenv:

> pyenv shell 3.10.11
> pip install stackhawk-mcp
# Requires Python 3.10 or higher

Or Install locally from this repo:

> pip install --user .
# Run this command from the root of the cloned repository

2. Set your StackHawk API key:

   > export STACKHAWK_API_KEY="your-api-key-here"
   

Usage

Running the MCP Server

python -m stackhawk_mcp.server

Running the HTTP Server (FastAPI)

python -m stackhawk_mcp.http_server

Running Tests

pytest

Integrating with LLMs and IDEs

StackHawk MCP can be used as a tool provider for AI coding assistants and LLM-powered developer environments, enabling security scanning setup, YAML validation, and vulnerability triage directly in your workflow.

Cursor (AI Coding Editor)

• Setup:
  • Follow the installation instructions above to install stackhawk-mcp in your python environment.
  • In Cursor, go to Cursor Settings->Tools & Integrations->MCP Tools
  • Add a "New MCP Server" with the following json, depending on your setup:
    • Using a virtual env at ~/.virtualenvs/mcp:

      {
        "mcpServers": {
          "stackhawk": {
            "command": "/home/bobby/.virtualenvs/mcp/bin/python",
            "args": ["-m", "stackhawk_mcp.server"],
            "env": {
              "STACKHAWK_API_KEY": "${env:STACKHAWK_API_KEY}"
            },
            "disabled": false
          }
        }
      }
      

    • Using pyenv:

      {
        "mcpServers": {
          "stackhawk": {
            "command": "/home/bobby/.pyenv/versions/3.10.11/bin/python3",
            "args": ["-m", "stackhawk_mcp.server"],
            "env": {
              "STACKHAWK_API_KEY": "${env:STACKHAWK_API_KEY}"
            },
            "disabled": false
          }
        }
      }
      

    • Or use python directly:

      {
        "mcpServers": {
          "stackhawk": {
            "command": "python3",
            "args": ["-m", "stackhawk_mcp.server"],
            "env": {
              "STACKHAWK_API_KEY": "${env:STACKHAWK_API_KEY}"
            }
          }
        }
      }
      

    • Then make sure the "stackhawk" MCP Tool is enabled
• Usage:

... View full README on GitHub