Java Security Vulnerability Scanner - MCP Server

Project Purpose

This project is a Model Context Protocol (MCP) server implementation built with Quarkus that provides security vulnerability information and best practices for Java development. It demonstrates how to create a practical, domain-specific MCP server that can extend AI assistants like IBM Bob with actionable security intelligence.

Instead of returning simple data, this server provides real-world value by helping developers:

• 🔍 Identify common Java security vulnerabilities
• 📚 Learn about OWASP Top 10 security risks
• ✅ Get remediation steps with code examples
• 🛡️ Follow security best practices

📖 Want to understand more about MCP endpoint? See the MCP Endpoint Explanation for a detailed breakdown of the URL structure and transport mechanism.

🚀 Available MCP Tools

The MCP server exposes the following security-focused tools:

1. listVulnerabilities

Get a complete list of all detectable Java security vulnerabilities.

Parameters: None

Returns: List of vulnerabilities with:

• Vulnerability names
• Severity levels (CRITICAL, HIGH, MEDIUM, LOW)
• OWASP classifications
• Vulnerability IDs

Example usage in Bob:

"List all Java security vulnerabilities"
"What vulnerabilities can you detect?"

2. getVulnerabilityDetails

Get comprehensive information about a specific vulnerability including remediation steps.

Parameters:

• vulnerabilityId (required): The vulnerability ID (e.g., "SQL_INJECTION", "HARDCODED_CREDENTIALS")

Returns: Detailed information including:

• Full description
• Severity and category
• OWASP and CWE classifications
• Code examples showing the vulnerability
• Detailed remediation steps with secure code examples

Example usage in Bob:

"Get details about SQL_INJECTION vulnerability"
"Tell me about HARDCODED_CREDENTIALS security issue"
"How do I fix XSS_VULNERABILITY?"

3. getOwaspTop10

Get information about the OWASP Top 10 - 2021 security risks.

Parameters: None

Returns: Complete OWASP Top 10 list with:

• Risk descriptions
• Impact explanations
• Prevention strategies

Example usage in Bob:

"Show me the OWASP Top 10"
"What are the top security risks according to OWASP?"

4. searchBySeverity

Find vulnerabilities filtered by severity level.

Parameters:

• severity (required): CRITICAL, HIGH, MEDIUM, or LOW

Returns: Filtered list of vulnerabilities matching the severity level with descriptions.

Example usage in Bob:

"Show me all CRITICAL severity vulnerabilities"
"Find HIGH severity security issues"
"What are the MEDIUM severity risks?"

5. getSecurityBestPractices

Get comprehensive security best practices for Java development.

Parameters: None

Returns: Detailed guidelines covering:

• Input validation
• Authentication & authorization
• Data protection
• Secure coding principles
• Dependency management
• Logging & monitoring
• Code review & testing
• Configuration security

Example usage in Bob:

"What are Java security best practices?"
"Give me security recommendations for Java"
"How should I secure my Java application?"

📊 Vulnerability Database

The server includes information about these critical vulnerabilities:

Each vulnerability includes:

• ✅ Detailed description
• ✅ Severity classification
• ✅ OWASP Top 10 mapping
• ✅ CWE reference
• ✅ Remediation steps with code examples

🤖 Connecting to I

... View full README on GitHub