DevSecOps Mcp

by jmstar85

287 downloads

Not rated

GitHub

Other

About

A comprehensive Model Context Protocol (MCP) server that integrates Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Interactive Application Security Testing (IAST), and Software Composition Analysis (SCA) tools for AI-powered DevSecOps aut

Details

Author: jmstar85
Downloads: 287
Categories: Other

- Execute SAST scans with rules and severity thresholds.
- Run DAST scans with configurable scan types and authentication.
- Perform SCA dependency scans across multiple package managers.
- Conduct IAST‑like security analysis in different environments.
- Generate comprehensive security reports in JSON, HTML, PDF, or SARIF.
- Validate security policies against scan results.
- Proven accuracy: SAST 95%+, DAST 100%, SCA 100%, IAST 90%+.
- OWASP Top 10 coverage and 20+ CWE types detected.

Setting up with Highlight

This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:

Download and install Highlight from highlightai.com/download
Navigate to the plugins tab and select "Add Custom Plugin"
Configure the plugin with the settings below

Plugin Name DevSecOps Mcp

Command (node, npx, python, etc.)

Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
Enable "Start Automatically" if you want the plugin to start when Highlight launches

Setting up with Cursor

Open Cursor's settings
Navigate to the MCP section
Click "Add new Global MCP server"
Copy and paste the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "devsecops mcp": {
            "devsecops": {
                "command": "node",
                "args": [
                    "dist/src/mcp/server.js"
                ],
                "cwd": "/path/to/DevSecOps-MCP",
                "env": {
                    "NODE_ENV": "production",
                    "MCP_PORT": "3000",
                    "LOG_LEVEL": "info",
                    "SECURITY_STRICT_MODE": "true"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "devsecops mcp": {
            "devsecops": {
                "command": "node",
                "args": [
                    "dist/src/mcp/server.js"
                ],
                "cwd": "/path/to/DevSecOps-MCP",
                "env": {
                    "NODE_ENV": "production",
                    "MCP_PORT": "3000",
                    "LOG_LEVEL": "info",
                    "SECURITY_STRICT_MODE": "true"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "devsecops mcp": {
            "devsecops": {
                "command": "node",
                "args": [
                    "dist/src/mcp/server.js"
                ],
                "cwd": "/path/to/DevSecOps-MCP",
                "env": {
                    "NODE_ENV": "production",
                    "MCP_PORT": "3000",
                    "LOG_LEVEL": "info",
                    "SECURITY_STRICT_MODE": "true"
                }
            }
        }
    }
}

Setting up with Claude Desktop

Open Claude Desktop's settings
Go to the Integrations tab
Click "Add MCP Server"
Use the configuration below based on your operating system

Note: Make sure Claude Desktop is running before attempting to connect.

JSON

{
    "mcpServers": {
        "devsecops mcp": {
            "devsecops": {
                "command": "node",
                "args": [
                    "dist/src/mcp/server.js"
                ],
                "cwd": "/path/to/DevSecOps-MCP",
                "env": {
                    "NODE_ENV": "production",
                    "MCP_PORT": "3000",
                    "LOG_LEVEL": "info",
                    "SECURITY_STRICT_MODE": "true"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "devsecops mcp": {
            "devsecops": {
                "command": "node",
                "args": [
                    "dist/src/mcp/server.js"
                ],
                "cwd": "/path/to/DevSecOps-MCP",
                "env": {
                    "NODE_ENV": "production",
                    "MCP_PORT": "3000",
                    "LOG_LEVEL": "info",
                    "SECURITY_STRICT_MODE": "true"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "devsecops mcp": {
            "devsecops": {
                "command": "node",
                "args": [
                    "dist/src/mcp/server.js"
                ],
                "cwd": "/path/to/DevSecOps-MCP",
                "env": {
                    "NODE_ENV": "production",
                    "MCP_PORT": "3000",
                    "LOG_LEVEL": "info",
                    "SECURITY_STRICT_MODE": "true"
                }
            }
        }
    }
}

Setting up with Windsurf

Open Windsurf's preferences
Go to the Integrations section
Click "Add MCP Integration"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "devsecops mcp": {
            "devsecops": {
                "command": "node",
                "args": [
                    "dist/src/mcp/server.js"
                ],
                "cwd": "/path/to/DevSecOps-MCP",
                "env": {
                    "NODE_ENV": "production",
                    "MCP_PORT": "3000",
                    "LOG_LEVEL": "info",
                    "SECURITY_STRICT_MODE": "true"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "devsecops mcp": {
            "devsecops": {
                "command": "node",
                "args": [
                    "dist/src/mcp/server.js"
                ],
                "cwd": "/path/to/DevSecOps-MCP",
                "env": {
                    "NODE_ENV": "production",
                    "MCP_PORT": "3000",
                    "LOG_LEVEL": "info",
                    "SECURITY_STRICT_MODE": "true"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "devsecops mcp": {
            "devsecops": {
                "command": "node",
                "args": [
                    "dist/src/mcp/server.js"
                ],
                "cwd": "/path/to/DevSecOps-MCP",
                "env": {
                    "NODE_ENV": "production",
                    "MCP_PORT": "3000",
                    "LOG_LEVEL": "info",
                    "SECURITY_STRICT_MODE": "true"
                }
            }
        }
    }
}

Setting up with Cline

Open Cline's settings
Navigate to the Integrations section
Click "Add MCP Server"
Copy and paste the configuration below based on your operating system

Note: Make sure to restart Cline after adding the configuration.

JSON

{
    "mcpServers": {
        "devsecops mcp": {
            "devsecops": {
                "command": "node",
                "args": [
                    "dist/src/mcp/server.js"
                ],
                "cwd": "/path/to/DevSecOps-MCP",
                "env": {
                    "NODE_ENV": "production",
                    "MCP_PORT": "3000",
                    "LOG_LEVEL": "info",
                    "SECURITY_STRICT_MODE": "true"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "devsecops mcp": {
            "devsecops": {
                "command": "node",
                "args": [
                    "dist/src/mcp/server.js"
                ],
                "cwd": "/path/to/DevSecOps-MCP",
                "env": {
                    "NODE_ENV": "production",
                    "MCP_PORT": "3000",
                    "LOG_LEVEL": "info",
                    "SECURITY_STRICT_MODE": "true"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "devsecops mcp": {
            "devsecops": {
                "command": "node",
                "args": [
                    "dist/src/mcp/server.js"
                ],
                "cwd": "/path/to/DevSecOps-MCP",
                "env": {
                    "NODE_ENV": "production",
                    "MCP_PORT": "3000",
                    "LOG_LEVEL": "info",
                    "SECURITY_STRICT_MODE": "true"
                }
            }
        }
    }
}

Setting up with Goose

Open Goose's preferences
Go to the Integrations tab
Select "MCP Servers"
Click "Add New Server"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "devsecops mcp": {
            "devsecops": {
                "command": "node",
                "args": [
                    "dist/src/mcp/server.js"
                ],
                "cwd": "/path/to/DevSecOps-MCP",
                "env": {
                    "NODE_ENV": "production",
                    "MCP_PORT": "3000",
                    "LOG_LEVEL": "info",
                    "SECURITY_STRICT_MODE": "true"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "devsecops mcp": {
            "devsecops": {
                "command": "node",
                "args": [
                    "dist/src/mcp/server.js"
                ],
                "cwd": "/path/to/DevSecOps-MCP",
                "env": {
                    "NODE_ENV": "production",
                    "MCP_PORT": "3000",
                    "LOG_LEVEL": "info",
                    "SECURITY_STRICT_MODE": "true"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "devsecops mcp": {
            "devsecops": {
                "command": "node",
                "args": [
                    "dist/src/mcp/server.js"
                ],
                "cwd": "/path/to/DevSecOps-MCP",
                "env": {
                    "NODE_ENV": "production",
                    "MCP_PORT": "3000",
                    "LOG_LEVEL": "info",
                    "SECURITY_STRICT_MODE": "true"
                }
            }
        }
    }
}

From the repository

The server exposes MCP tools that are invoked by an MCP client with the required input parameters (e.g., target path, scan type, tool selection). The README also includes test scripts (e.g., node test-all-security.js) for verifying functionality.

Claude Desktop / Cursor

Paste into your MCP client config file to install this server.

{
    "mcpServers": {
        "devsecops mcp": {
            "devsecops": {
                "command": "node",
                "args": [
                    "dist/src/mcp/server.js"
                ],
                "cwd": "/path/to/DevSecOps-MCP",
                "env": {
                    "NODE_ENV": "production",
                    "MCP_PORT": "3000",
                    "LOG_LEVEL": "info",
                    "SECURITY_STRICT_MODE": "true"
                }
            }
        }
    }
}

McpServers

{
    "devsecops": {
        "command": "node",
        "args": [
            "dist/src/mcp/server.js"
        ],
        "cwd": "/path/to/DevSecOps-MCP",
        "env": {
            "NODE_ENV": "production",
            "MCP_PORT": "3000",
            "LOG_LEVEL": "info",
            "SECURITY_STRICT_MODE": "true"
        }
    }
}

📊 MCP Tools
The server provides the following MCP tools:

1. SAST Scan
{
"name": "run_sast_scan",
"description": "Execute SAST security scan",
"inputSchema": {
"target": "string", // Source code path/repo
"rules": "array", // Security rules
"severity_threshold": "enum", // low|medium|high|critical
"tool": "enum" // sonarqube|semgrep|auto
}
}
2. DAST Scan
{
"name": "run_dast_scan",
"description": "Execute DAST security scan",
"inputSchema": {
"target_url": "string", // Application URL
"scan_type": "enum", // quick|baseline|full
"authentication": "object" // Login credentials
}
}
3. SCA Scan
{
"name": "run_sca_scan",
"description": "Execute SCA dependency scan",
"inputSchema": {
"project_path": "string", // Project directory
"package_manager": "enum", // npm|yarn|maven|gradle|pip
"tool": "enum", // osv-scanner|trivy|npm-audit|auto
"fix_vulnerabilities": "bool" // Auto-fix enabled
}
}
4. IAST Scan
{
"name": "run_iast_scan",
"description": "Execute IAST-like security analysis",
"inputSchema": {
"application_id": "string", // App identifier or path
"environment": "enum", // dev|staging|testing
"tool": "enum", // trivy|owasp-zap|auto
"test_suite": "string" // Test suite to run (optional)
}
}
5. Generate Security Report
{
"name": "generate_security_report",
"description": "Generate comprehensive security report",
"inputSchema": {
"scan_ids": "array", // Scan result IDs
"format": "enum", // json|html|pdf|sarif
"include_remediation": "bool" // Include fix guidance
}
}
6. Validate Security Policy
{
"name": "validate_security_policy",
"description": "Validate security policy compliance",
"inputSchema": {
"policy_file": "string", // Policy file path
"scan_results": "array" // Scan result IDs
}
}
🧪 Testing
✅ Verified Performance Metrics (Tested on 2025-07-06)
Security Test Vulnerabilities Detected Accuracy Tool Status Test Time
SAST 60+ issues 95%+ ✅ Verified ~5s
DAST 5+ types 100% ✅ Verified ~30s
SCA 20 issues 100% ✅ Verified ~3s
IAST Hybrid 90%+ ✅ Simulated ~10s
Real-World Vulnerability Detection
OWASP Top 10: 100% coverage confirmed
CWE Coverage: 20+ types actually detected
Language Support: JavaScript, Python fully verified
Run Tests

Comprehensive security test (actually verified)

node test-all-security.js

SAST testing

node test-sast.js

DAST testing with vulnerable web server

node test-vulnerable-server.js & curl "http://localhost:3001/search?q=<script>alert('XSS')</script>"

Unit tests

npm test

With coverage

npm run test:coverage

Integration tests

npm run test:integration Test Structure Real vulnerable samples: test-samples/ Vulnerable dependencies: test-vulnerable-dependencies/ Comprehensive test script: test-all-security.js Unit tests: tests/security/ Integration tests: tests/integration/

No reviews yet — be the first

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.

DevSecOps Mcp

About

Details

Jump to

Setting up with Highlight

Setting up with Cursor

JSON

JSON

JSON

Setting up with Claude Desktop

JSON

JSON

JSON

Setting up with Windsurf

JSON

JSON

JSON

Setting up with Cline

JSON

JSON

JSON

Setting up with Goose

JSON

JSON

JSON

From the repository

Claude Desktop / Cursor

McpServers

Comprehensive security test (actually verified)

SAST testing

DAST testing with vulnerable web server

Unit tests

With coverage

Integration tests

Install

About

Details

Jump to

Setting up with Highlight

From the repository

Claude Desktop / Cursor

McpServers

Comprehensive security test (actually verified)

SAST testing

DAST testing with vulnerable web server

Unit tests

With coverage

Integration tests

Install

More like this

Sequential Thinking

Filesystem

EverArt

Google Drive

Reactive Resume

FastMCP v2 🚀