@mhdd_24/api-security-mcp
# @mhdd_24/api-security-mcp
Identify API security weaknesses.
Same architecture as [@mhdd_24/sublime-mcp](https://github.com/Mhdd-24/Sublime-MCP).
**Full documentation:** [docs/WIKI.md](./docs/WIKI.md)
---
## How it works (30 seconds)
```
You (chat) → MCP client → api-security-mcp → API Security APIs / CLIs / local tools
```
---
## Prerequisites
| Requirement | Notes |
|-------------|--------|
| **Node.js 18+** | ESM TypeScript MCP server |
| **Credentials / CLIs** | See environment variables below |
---
## Install
### Option A — npm (after publish)
```bash
npm install -g @mhdd_24/api-security-mcp
```
### Option B — npx
```bash
npx @mhdd_24/api-security-mcp
```
### Option C — clone and build
```bash
git clone https://github.com/Mhdd-24/API-Security-MCP.git
cd API-Security-MCP
npm install
npm run build
node dist/index.js
```
---
## Configure Cursor
Edit `~/.cursor/mcp.json`:
```json
{
"mcpServers": {
"apisec": {
"command": "npx",
"args": ["-y", "@mhdd_24/api-security-mcp"],
"env": {
"PROJECT_ROOT": "..."
}
}
}
}
```
**Local development:**
```json
{
"command": "node",
"args": ["/absolute/path/to/API-Security-MCP/dist/index.js"]
}
```
---
## Environment variables
| Variable | Description |
|----------|-------------|
| `PROJECT_ROOT` | Default project/repository root |
---
## Tools
| Tool | Description |
|------|-------------|
| `apisec_status` | Health check for API Security MCP. |
| `apisec_scan_spec` | Scan OpenAPI for security gaps (auth missing, etc). |
| `apisec_checks` | Return a security test checklist for an API. |
---
## License
ISC
TDQS
Scored across 3 tools
The three tools are distinct: status is a health check, scan_spec performs a security scan, and checks returns a checklist. There is minor potential confusion between scan_spec and checks since both relate to security analysis, but their purposes are clearly differentiated.
All tool names use a consistent 'apisec_' prefix followed by a noun or verb_noun pattern (status, scan_spec, checks). The pattern is predictable, though 'apisec_checks' is a noun while 'apisec_scan_spec' is verb_noun, creating a slight inconsistency.
Three tools is on the low end but reasonable for a focused API security MCP server. The scope is narrow, so the count is acceptable, though it feels slightly thin for a security tool that might need more operations.
The server covers health check, scanning, and checklist generation, but lacks obvious operations like retrieving scan results, managing scans, or applying fixes. The surface is functional but has notable gaps for a complete security workflow.