README.md•3.65 kB
# ZeroPath MCP Server
Interact with your product security findings using natural language.
This open-source MCP server allows developers to query SAST issues, secrets, patches, and more from ZeroPath directly inside AI-assisted tools like Claude Desktop, Cursor, Windsurf, and other MCP-compatible environments.
No dashboards. No manual ticket triage. Just security context where you're already working.
---
## Blog Post
Learn more about why we built this and how it fits into the evolving AI development ecosystem:
**📄 [Chat With Your AppSec Scans: Introducing the ZeroPath MCP Server](https://zeropath.com/blog/chat-with-your-appsec-scans)**
---
## Installation
### 1. Generate API Key
Generate an API key from your ZeroPath organization settings at [https://zeropath.com/app/settings/api](https://zeropath.com/app/settings/api)
### 2. Configure Environment Variables
Set up your environment variables with the API key:
```bash
export ZEROPATH_TOKEN_ID=your_token_id
export ZEROPATH_TOKEN_SECRET=your_token_secret
```
### 3. Retrieve Your Organization ID
Run the following command to get your organization ID:
```bash
curl -X POST https://zeropath.com/api/v1/orgs/list \
-H "X-ZeroPath-API-Token-Id: $ZEROPATH_TOKEN_ID" \
-H "X-ZeroPath-API-Token-Secret: $ZEROPATH_TOKEN_SECRET" \
-H "Content-Type: application/json" \
-d '{}'
```
### 4. Install [`uv`](https://docs.astral.sh/uv/getting-started/installation/)
We use `uv` for dependency management:
```bash
curl -LsSf https://astral.sh/uv/install.sh | sh
```
### 5. Clone and Setup
```bash
git clone https://github.com/ZeroPathAI/zeropath-mcp-server.git
cd zeropath-mcp-server
uv sync
export ZEROPATH_ORG_ID=your_org_id
```
---
## Configuration
Add this entry to your MCP config (Claude Desktop, Cursor, etc.):
```json
{
"mcpServers": {
"zeropath-mcp-server": {
"command": "uv",
"args": [
"run",
"--project",
"<absolute cloned directory path>/zeropath-mcp-server",
"<absolute cloned directory path>/zeropath-mcp-server/main.py"
]
}
}
}
```
Replace `<absolute cloned directory path>` with the absolute path to the repo.
---
## Environment Variables
Before running the server, export the following:
```bash
export ZEROPATH_TOKEN_ID=your_token_id
export ZEROPATH_TOKEN_SECRET=your_token_secret
export ZEROPATH_ORG_ID=your_org_id
```
These can be generated from your ZeroPath dashboard.
---
## Available Tools
Once connected, the following tools are exposed to your AI assistant:
### `search_vulnerabilities(search_query: str)`
Query SAST issues by keyword.
**Prompt example:**
> "Show me all SSRF vulnerabilities in the user service."
---
### `get_issue(issue_id: str)`
Fetch full metadata, patch suggestions, and code context for a specific issue.
**Prompt example:**
> "Give me the details for issue `abc123`."
---
### `approve_patch(issue_id: str)`
Approve a patch (write action). Optional depending on your setup.
**Prompt example:**
> "Approve the patch for `xyz456`."
---
## Development Mode
Use `./dev_mode.bash` to test the tools locally without a client connection.
---
## Contributing
We welcome contributions from the security, AI, and developer tools communities.
- Found a bug? [Open an issue](https://github.com/ZeroPathAI/zeropath-mcp-server/issues)
- Want to improve a tool or add a new one? Submit a pull request
- Have feedback or questions? Join us on [Discord](https://discord.gg/Whukqkw3Qr)
---