Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@codescan-mcp-server show open issues with severity MAJOR"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A Model Context Protocol (MCP) server implementation for Codescan, enabling AI models to interact with Codescan's API through a standardized interface.
List Codescan projects
Get project metrics
Query project issues with advanced filtering
Environment-based configuration
Docker support
TypeScript implementation
Related MCP server: sonarqube-mcp-py
Node.js 20 or later
pnpm 10.7.1 or later
Docker (optional, for containerized deployment)
Clone the repository:
git clone <repository-url>
cd codescan-mcp-serverInstall dependencies:
pnpm installBuild the project:
pnpm run buildStart the server:
pnpm startBuild the Docker image:
docker build -t codescan-mcp-server .Run the container:
docker run -d \
-e CODESCAN_URL=https://app.codescan.io \
-e CODESCAN_TOKEN=your_token_here \
-e CODESCAN_ORGANIZATION=your_org \
-e CODESCAN_PROJECT=your_project \
-e CODESCAN_COMPONENT=your_component \
-e NODE_OPTIONS="--experimental-specifier-resolution=node" \
-p 3000:3000 \
codescan-mcp-serverVariable | Description | Required | Default |
CODESCAN_URL | URL of your Codescan instance | Yes | |
CODESCAN_TOKEN | Authentication token for Codescan API | Yes | - |
CODESCAN_ORGANIZATION | Organization key for Codescan Cloud | No | - |
CODESCAN_PROJECT | Default project key | No | - |
CODESCAN_COMPONENT | Default component key | No | - |
NODE_OPTIONS | Node.js runtime options | No | --experimental-specifier-resolution=node |
Here's an example MCP client configuration for interacting with the Codescan MCP server:
{
"name": "codescan-mcp-client",
"version": "1.0.0",
"description": "MCP client for Codescan integration",
"servers": [
{
"name": "codescan-mcp-server",
"url": "http://localhost:3000",
"tools": ["projects", "metrics", "issues"]
}
],
"env": {
"CODESCAN_URL": "https://app.codescan.io",
"CODESCAN_TOKEN": "your_token_here",
"CODESCAN_ORGANIZATION": "your_org",
"CODESCAN_PROJECT": "your_project",
"CODESCAN_COMPONENT": "your_component"
}
}List Projects:
{
"tool": "projects",
"params": {
"page": "1",
"page_size": "10"
}
}Get Metrics:
{
"tool": "metrics",
"params": {
"component": "your_component",
"page": "1",
"page_size": "10"
}
}Get Issues:
{
"tool": "issues",
"params": {
"component": "your_component",
"severity": "MAJOR",
"page": "1",
"page_size": "10",
"statuses": ["OPEN", "CONFIRMED"],
"types": ["BUG", "VULNERABILITY"]
}
}pnpm run build: Build the TypeScript code
pnpm start: Start the MCP server
pnpm test: Run tests
pnpm lint: Run linter
pnpm format: Format code
codescan-mcp-server/
├── src/
│ ├── index.ts # Main server entry point
│ └── codescan.ts # Codescan API client
├── dist/ # Compiled JavaScript
├── Dockerfile # Docker configuration
├── package.json # Project dependencies
├── tsconfig.json # TypeScript configuration
└── mcp.json # MCP server configuration[License Type] - See LICENSE file for details
Get issues for a Codescan project
| Name | Required | Description | Default |
|---|---|---|---|
| token | No | ||
| component | Yes | ||
| severity | No | ||
| page | No | ||
| page_size | No | ||
| statuses | No | ||
| resolutions | No | ||
| resolved | No | ||
| types | No | ||
| rules | No | ||
| tags | No | ||
| created_after | No | ||
| created_before | No | ||
| created_at | No | ||
| created_in_last | No | ||
| assignees | No | ||
| authors | No | ||
| cwe | No | ||
| languages | No | ||
| owasp_top10 | No | ||
| sans_top25 | No | ||
| sonarsource_security | No | ||
| on_component_only | No | ||
| facets | No | ||
| since_leak_period | No | ||
| in_new_code_period | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavioral traits. It only says 'Get issues', which implies a read operation, but it doesn't confirm idempotency, rate limits, pagination behavior, or error handling. The description provides no meaningful behavioral context for a tool with 26 parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, which is concise, but it is under-specified and lacks structure. It fails to earn its place because it does not aid correct tool invocation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the high parameter count, no output schema, and no annotations, the description is severely incomplete. It does not cover return values, filtering options, pagination, or any usage nuances.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does not explain any of the 26 parameters. Even though some parameters have enums, their meanings are not clarified. The description adds no value beyond the parameter names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Get issues for a Codescan project' clearly states the verb and resource, and implies the context of a Codescan project. It distinguishes from siblings 'metrics' and 'projects' by naming a different resource.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like 'metrics' or 'projects'. There are no exclusions or context hints for usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get available metrics from Codescan
| Name | Required | Description | Default |
|---|---|---|---|
| token | No | ||
| page | No | ||
| page_size | No | ||
| component | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must convey behavioral traits. It only says 'Get available metrics', which implies a read operation but does not disclose side effects, authentication requirements, rate limits, pagination behavior, or response format. The presence of 'page' and 'page_size' parameters hints at pagination, but this is not explained.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely short (one sentence), but it lacks necessary detail. Conciseness is achieved at the cost of completeness, making it under-specified. The structure is flat and does not front-load key information beyond the basic purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given four parameters, no annotations, no output schema, and sibling tools, the description is severely incomplete. It fails to explain what the tool returns, how parameters work, or when to use it. The tool's complexity demands a richer description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description must explain parameter semantics, but it does not. It mentions none of the four parameters (token, page, page_size, component), leaving the agent to guess their purpose and format. This is a critical gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Get available metrics from Codescan', clearly indicating the verb (get) and resource (metrics). It distinguishes this tool from sibling tools 'issues' and 'projects' by referring to a different resource type. However, it does not explicitly differentiate itself from potential other metric-related tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No usage guidelines are provided. The description does not specify when to use this tool over alternatives, nor does it mention prerequisites or typical use cases. The agent is left without guidance on tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List all Codescan projects
| Name | Required | Description | Default |
|---|---|---|---|
| token | No | ||
| page | No | ||
| page_size | No | ||
| projects | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description fails to disclose any behavioral traits such as authentication requirements, pagination behavior, or what happens when no projects exist.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise at one sentence with no wasted words, but it is overly brief and lacks necessary detail for a tool with four parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has four parameters with no schema descriptions, no output schema, and no annotations, the description is severely incomplete, providing only a basic purpose.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description does not mention any of the four parameters (token, page, page_size, projects), leaving their meaning and usage completely unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'List' and resource 'Codescan projects', clearly indicating the tool's function and distinguishing it from siblings 'issues' and 'metrics'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives; the description simply states what it does without any context on when it is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v1.1.0issuesmetricsprojectsScored across 3 tools
Each tool has a distinct purpose: listing projects, retrieving issues for a project, and fetching metrics. There is no overlap or ambiguity.
All tool names are single nouns, which is consistent. Adding verbs (e.g., list_projects) would make them more descriptive, but the pattern is uniform.
3 tools is a reasonable number for a focused code scanning server. It covers the core actions without being overly sparse.
The server covers listing projects, retrieving issues, and getting metrics. Missing are details on individual projects, issue filtering, or update/delete operations, but for a read-only scanner it is fairly complete.
MCP server for AI access to Swagger by SmartBear.
MCP server that lets AI assistants use all OneSchema features exposed via the public API.
MCP server providing access to the Scorecard API to evaluate and optimize LLM systems.
MCP server for secureFlows: token-free URL builders and integration-linting tools for AI agents.
