kotlin-security-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| KSM_JAVA | Yes | Path to the java executable | |
| KSM_PLUGIN_JARS | Yes | Comma-separated ruleset jar(s) (scanner-all) | |
| KSM_DETEKT_CONFIG | No | (optional) path to a detekt.yml | |
| KSM_DETEKT_CLI_JAR | Yes | Path to the detekt CLI jar |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| security_scanA | Scan Kotlin/JVM code for security issues using a 216-rule analyzer. Point this at a file or directory. It returns every security finding the analyzer reports — rule id, message, location, and severity — so the agent can fix issues while writing, not after. Args: path: File or directory to scan (absolute, or relative to the project). |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 1 tool
With only one tool, there is no possibility of ambiguity between tools. The tool's purpose is clearly defined.
The single tool uses a clear verb_noun pattern (security_scan), which is consistent and predictable.
The server has only one tool, which is slightly under the typical range of 3-15 tools, but it effectively covers the core scanning functionality.
The tool provides comprehensive scanning for Kotlin/JVM security issues, but lacks additional features like configuration or rule management, which are minor gaps.