VA-MCP

This is an MCP designed to check for OWASP Top 10 vulnerabilities during functional unit testing in the development phase. This MCP receives API information, analyzes it, and returns the analysis output.

Scope (MVP)

• MCP stdio server execution

• Basic tools provided:

  • ping

  • list_supported_checks

• Future expansion of OWASP Top 10 scenarios

Related MCP server: MCP-QA

Prerequisites

Team members must have the following installed before starting development:

• Git

• uv

• (Recommended) Python 3.11+

Verify installation:

git --version
uv --version
python3 --version

Quick Start

# 1) 저장소 클론
git clone <repo-url>
cd VA-MCP

# 2) 의존성/가상환경 동기화
uv sync

# 3) 테스트 확인
uv run pytest -q

# 4) MCP 서버 실행
uv run va-mcp

Since va-mcp operates via stdio transport, it is used by connecting to the server from an MCP client (IDE/Agent).

Development Rules

Refer to dev-guide.md for team development rules (branch strategy, testing, PR, commit rules).

Test Guide

After developing a feature, test it in the following order:

# 1) 의존성 동기화
uv sync

# 2) 테스트 실행
uv run pytest -q

• Write test code in the root tests/ folder.

• When adding a new feature, you must also add the corresponding tests.

• Minimum criteria:

  • At least 1 functional unit test

  • tests/test_smoke.py must continue to pass

Directory Roles

• src/va_mcp/: Application source code root

• src/va_mcp/server.py: MCP server entry point (file started when running va-mcp)

• src/va_mcp/app.py: FastMCP app creation and initialization

• src/va_mcp/config.py: Environment variable loading, output directory configuration

• src/va_mcp/registry/: Place to register which features (tools) and data (resources) to expose to MCP

• src/va_mcp/tools/: Functional functions actually executed by MCP (e.g., ping, execution of checks)

• src/va_mcp/resources/: Collection of common reference data used by features (e.g., list of supported checks)

• tests/: Test code (must be executed after development is complete)

• outputs/: Storage for execution result outputs

Notes

• Currently designed based on local integration (stdio).

• We plan to switch to HTTP mode during the future AWS deployment phase.