Is io.github.Skyrxin/sast-mcp-server safe to use?

io.github.Skyrxin/sast-mcp-server has no known CVEs as of the latest MCPpedia security scan. Authentication requirements were not detected automatically - check the project's documentation before connecting in a shared environment. Licensed under MIT.

How do I install io.github.Skyrxin/sast-mcp-server?

io.github.Skyrxin/sast-mcp-server supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What can io.github.Skyrxin/sast-mcp-server do?

io.github.Skyrxin/sast-mcp-server provides 14 tools: Note, security_review, fix_vulnerability, pr_security_check, compliance_report and 9 more. See the full tools list on the server page for descriptions and parameters.

What AI clients work with io.github.Skyrxin/sast-mcp-server?

io.github.Skyrxin/sast-mcp-server is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.

Is io.github.Skyrxin/sast-mcp-server actively maintained?

io.github.Skyrxin/sast-mcp-server is less actively maintained - last commit was 119 days ago. It has 4 GitHub stars.

io.github.Skyrxin/sast-mcp-server

sast-mcp-server

11-scanner SAST/DAST MCP server with closed-loop remediation, SBOM/SARIF, and CI integrations

4 14 tools GitHub PyPI

No known CVEs

MIT license

Maintained

Last commit 119d ago

Works with most clients

Transport: stdio, sse, http

14 tools · ~407 tok

Grade A · 0.2% of 200K ctx

MCPpedia last refreshed this data 1d ago

Edit this pageView history

io.github.Skyrxin/sast-mcp-server is an MCP server that 11-scanner SAST/DAST MCP server with closed-loop remediation, SBOM/SARIF, and CI integrations. Its tool list has not been published yet over stdio, sse and http, requires no API key, and scores 79/100 on MCPpedia's security, maintenance and efficiency rubric.

Other

Step 1

Install in your client

Config is the same across clients - only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "sast": {
      "args": [
        "sast-mcp-server"
      ],
      "command": "uvx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-skyrxin-sast-mcp-server)](https://mcppedia.org/s/io-github-skyrxin-sast-mcp-server)

Read me

What io.github.Skyrxin/sast-mcp-server does

11-scanner SAST/DAST MCP server with closed-loop remediation, SBOM/SARIF, and CI integrations

Test This Server

This server supports HTTP transport. Be the first to test it - help the community know if it works.

Loading README…

Scored, not listed

Why this score

Five weighted categories - click any category to see the underlying evidence.

Score breakdown

79/100across 5 weighted dimensions

How we score →

0255075100

−21

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked sast-mcp-server against OSV.dev.

Inventory

Tools (14)

Click any tool to inspect its schema.

~407 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience - it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.Skyrxin/sast-mcp-server safe to use?: io.github.Skyrxin/sast-mcp-server has no known CVEs as of the latest MCPpedia security scan. Authentication requirements were not detected automatically - check the project's documentation before connecting in a shared environment. Licensed under MIT.
How do I install io.github.Skyrxin/sast-mcp-server?: io.github.Skyrxin/sast-mcp-server supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can io.github.Skyrxin/sast-mcp-server do?: io.github.Skyrxin/sast-mcp-server provides 14 tools: Note, security_review, fix_vulnerability, pr_security_check, compliance_report and 9 more. See the full tools list on the server page for descriptions and parameters.
What AI clients work with io.github.Skyrxin/sast-mcp-server?: io.github.Skyrxin/sast-mcp-server is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is io.github.Skyrxin/sast-mcp-server actively maintained?: io.github.Skyrxin/sast-mcp-server is less actively maintained - last commit was 119 days ago. It has 4 GitHub stars.

Similar servers

Others in other

View all →

io.github.sheawinkler/contextlattice95

Private-by-default, local-first memory/context/task orchestrator for MCP apps and agents.

156 4

Headroom95

Compress tool outputs, logs, files, and RAG chunks before they reach the LLM. 60-95% fewer tokens, same answers. Library, proxy, MCP server.

77.9k 3

Dexsql Release95

SQL for Android APK and DEX files: classes, methods, strings, references and smali.

234 2

System1 Agents95

System 1 decision models (Jev, Laya, Cua-S1) as brain for agents: Browser use, computer use, games and robotics

176 8

MCP Security Weekly

Get CVE alerts and security updates for io.github.Skyrxin/sast-mcp-server and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Other

Step 1

Install in your client

Config is the same across clients - only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "sast": {
      "args": [
        "sast-mcp-server"
      ],
      "command": "uvx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-skyrxin-sast-mcp-server)](https://mcppedia.org/s/io-github-skyrxin-sast-mcp-server)

Read me

What io.github.Skyrxin/sast-mcp-server does

11-scanner SAST/DAST MCP server with closed-loop remediation, SBOM/SARIF, and CI integrations

Test This Server

This server supports HTTP transport. Be the first to test it - help the community know if it works.

README

SAST MCP Server

Static Application Security Testing (SAST) for AI agents. A production-ready MCP server that gives any AI agent the ability to scan code for security vulnerabilities.

Supports 11 industry-standard scanners:

Scanner	Languages / Scope	Type
Bandit	Python	Security linter
njsscan	JavaScript, Node.js	Static analysis
Bearer	Python, JS, Ruby, Java, Go, PHP	Data-flow SAST
Semgrep	30+ languages	Rule-based SAST
Trivy	All (CVEs, Secrets, IaC, images)	Multi-scanner
CodeQL	Python, JS, Java, Go, C/C++, C#, Ruby, Swift	Semantic SAST
Checkov	Terraform, K8s, Docker, CloudFormation	IaC policy scanner
Gitleaks	All (.git history)	Deep secret scanning
OSV-Scanner	Multiple (lockfiles, sboms)	SCA
Grype	Containers, OS packages, lockfiles, SBOMs	SCA / image scanning
OWASP ZAP	RUNTIME	Dynamic (DAST) via Docker

Works with any MCP-compatible agent: Gemini CLI, Claude Desktop, OpenAI Agents, Cursor, Windsurf, and more.

Features

🔍 11 SAST/SCA/DAST scanners with a unified output format
🌳 AST-aware context — shows the full enclosing function, not just a line number
📊 Severity & confidence filtering — focus on what matters
🔀 Git diff mode — scan only modified files for incremental reviews
🙈 Ignore management — suppress false positives with audit trail
📄 Pagination — handle large codebases without overwhelming the agent
🌐 Dual transport — stdio (local) or Streamable HTTP (remote deployments)
🔐 JWT & API key authentication — secure remote deployments
📦 One command install — pip install sast-mcp-server
🚀 Multi-scanner mode — run all installed scanners in parallel with deduplication
📋 SARIF export — CI/CD integration with GitHub, GitLab, Azure DevOps
🏗️ IaC scanning — Terraform, Kubernetes, Docker security policies
🔑 Secret detection — find hardcoded API keys, tokens, and passwords in code and git history
📦 SCA / dependency CVEs — scan lock files for known vulnerabilities against the OSV database
🕷️ DAST — dynamic baseline scans of running apps via OWASP ZAP + Docker
📈 Baselines & trend tracking — cache scans and diff against a saved baseline
🤖 MCP Prompts & Resources — pre-built security workflows and live dashboards for agents
📤 Dashboard integrations — push SARIF results to DefectDojo or GitHub Code Scanning
🩹 AI-assisted remediation — generate fix prompts and apply agent-written patches via git apply

Quick Start

The server is only as useful as the scanners installed alongside it. Pick the install path that matches how much of the toolset you want out of the box.

Option 1 — Full conta

... View full README on GitHub

Loading README…

Scored, not listed

Why this score

Five weighted categories - click any category to see the underlying evidence.

Score breakdown

79/100across 5 weighted dimensions

How we score →

0255075100

−21

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked sast-mcp-server against OSV.dev.

Inventory

Tools (14)

Click any tool to inspect its schema.

~407 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience - it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.Skyrxin/sast-mcp-server safe to use?: io.github.Skyrxin/sast-mcp-server has no known CVEs as of the latest MCPpedia security scan. Authentication requirements were not detected automatically - check the project's documentation before connecting in a shared environment. Licensed under MIT.
How do I install io.github.Skyrxin/sast-mcp-server?: io.github.Skyrxin/sast-mcp-server supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can io.github.Skyrxin/sast-mcp-server do?: io.github.Skyrxin/sast-mcp-server provides 14 tools: Note, security_review, fix_vulnerability, pr_security_check, compliance_report and 9 more. See the full tools list on the server page for descriptions and parameters.
What AI clients work with io.github.Skyrxin/sast-mcp-server?: io.github.Skyrxin/sast-mcp-server is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is io.github.Skyrxin/sast-mcp-server actively maintained?: io.github.Skyrxin/sast-mcp-server is less actively maintained - last commit was 119 days ago. It has 4 GitHub stars.

Similar servers

Others in other

View all →

io.github.sheawinkler/contextlattice95

Private-by-default, local-first memory/context/task orchestrator for MCP apps and agents.

156 4

Headroom95

Compress tool outputs, logs, files, and RAG chunks before they reach the LLM. 60-95% fewer tokens, same answers. Library, proxy, MCP server.

77.9k 3

Dexsql Release95

SQL for Android APK and DEX files: classes, methods, strings, references and smali.

234 2

System1 Agents95

System 1 decision models (Jev, Laya, Cua-S1) as brain for agents: Browser use, computer use, games and robotics

176 8

MCP Security Weekly

Get CVE alerts and security updates for io.github.Skyrxin/sast-mcp-server and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?