AI DevSecOps Agent MCP Server
Fetches CI/CD pipeline runs from GitHub Actions to monitor build status and pipeline health.
Queries a vulnerability board in Jira and returns severity-ranked CVEs for vulnerability triage.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@AI DevSecOps Agent MCP ServerWhat's the status of the main CI pipeline and any critical vulnerabilities?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
NOTE: This repository is an archival lab or partial prototype. It is not actively maintained and should not be used as a reference for production-grade deployments or performance benchmarks.
AI-Assisted DevSecOps Agent β MCP Server π€π
Maturity: Functional Prototype An MCP (Model Context Protocol) server exposing DevSecOps tooling to LLM clients.
β οΈ PoC Note: All tools return mock/simulated data β no live GitHub Actions, Jira, or logging integrations required. The MCP protocol implementation and tool structure are fully functional.
The Problem
DevSecOps teams drown in context-switching: checking pipeline status in one tab, triaging vulnerabilities in another, searching logs in a third. Meanwhile, LLM coding assistants can write code but are blind to your operational reality β they can't see your failing builds, open CVEs, or production errors.
Related MCP server: MCP Tool Manager
The Solution
This MCP server bridges the gap by exposing four security-critical tools to any MCP-compatible LLM client (GitHub Copilot, Claude Desktop, Cursor, etc.):
Tool | What It Does |
| Fetches CI/CD pipeline runs from GitHub Actions |
| Queries a vulnerability board and returns severity-ranked CVEs |
| Searches application logs by service, severity, and time range |
| Analyzes a |
| Fetches recent K8s events for incident correlation (OOMKills, scheduling failures) |
| Correlates SRE incidents across pipeline, vulnerability, and runtime data |
Why This Over the Obvious Alternative
Most "AI + DevOps" demos are chatbots with hardcoded responses. This project implements the Model Context Protocol (MCP) β the open standard for tool-use that GitHub Copilot, Claude, and other major LLM clients natively support. The tools return real, structured data that the LLM reasons over, not canned answers.
Architecture
βββββββββββββββββββ MCP (stdio/SSE) ββββββββββββββββββββββββ
β LLM Client βββββββββββββββββββββββββΊβ MCP Server β
β (Copilot, β β β
β Claude, etc.) β β ββββββββββββββββββ β
β β β β Pipeline Tool β β
β β β β Vuln Triage Toolβ β
β β β β Log Search Tool β β
β β β β Dep Scan Tool β β
β β β ββββββββββββββββββ β
βββββββββββββββββββ ββββββββββββββββββββββββ
β
βββββββββ΄ββββββββ
β Mock Data β
β (Simulated β
β APIs) β
βββββββββββββββββπ οΈ Tech Stack
Runtime: Node.js + TypeScript
Protocol: Model Context Protocol (MCP) SDK
Transport: stdio (local) and SSE (remote)
Containerization: Docker
π Getting Started
Local Development
npm install
npm run build
npm run startWith Docker
docker-compose up -d --buildConnecting to Claude Desktop
Add to your Claude Desktop MCP config (claude_desktop_config.json):
{
"mcpServers": {
"devsecops-agent": {
"command": "node",
"args": ["dist/index.js"]
}
}
}π Project Structure
src/
βββ index.ts # MCP Server entry point
βββ tools/
β βββ pipeline.tool.ts # GitHub Actions pipeline status
β βββ vulnerability.tool.ts # CVE triage from mock board
β βββ logs.tool.ts # Log search across services
β βββ dependency.tool.ts # Dependency vulnerability scanning
βββ data/
βββ mock-data.ts # Simulated API responsesDecision Log
Decision | Rationale |
MCP over REST API | MCP is the emerging standard for LLM tool-use; REST would require custom integration per client |
TypeScript over Python | Aligns with existing TypeScript expertise; MCP TS SDK is mature |
Mock data layer | Keeps the PoC self-contained without requiring real GitHub/Jira API keys |
stdio transport | Default for local MCP; SSE available for remote deployment |
π Prerequisites
Tool | Version | Purpose |
>= 20.x | Runtime | |
>= 10.x | Package manager | |
>= 24.x | Containerization (optional) | |
MCP Client | Any | Claude Desktop, GitHub Copilot, Cursor, etc. |
π Step-by-Step Setup
Option A: Local Development
# 1. Clone the repository
git clone https://github.com/SumitDalavi/ai-devsecops-agent-mcp.git
cd ai-devsecops-agent-mcp
# 2. Install dependencies
npm install
# 3. Build the TypeScript project
npm run build
# 4. Start the MCP server (stdio transport)
npm run startOption B: Docker
# 1. Clone and build
git clone https://github.com/SumitDalavi/ai-devsecops-agent-mcp.git
cd ai-devsecops-agent-mcp
# 2. Build and run
docker build -t devsecops-mcp-agent .
docker run -i devsecops-mcp-agentConnecting to Claude Desktop
Add to your Claude Desktop config (claude_desktop_config.json):
{
"mcpServers": {
"devsecops-agent": {
"command": "node",
"args": ["/absolute/path/to/ai-devsecops-agent-mcp/dist/index.js"]
}
}
}π§ͺ Usage & Demo
Once connected to an MCP client, you can ask natural language questions like:
Prompt | Tool Invoked |
"Show me the latest pipeline runs" |
|
"Are there any critical vulnerabilities?" |
|
"Search for error logs in the payment service" |
|
"Scan dependencies for known CVEs" |
|
"Show me Kubernetes events in production" |
|
"Check for active incidents" |
|
The server returns structured JSON data that the LLM reasons over to provide contextual answers.
β Verification
# Verify the build succeeds
npm run build
# Verify the server starts (it will wait for MCP client connection on stdio)
node dist/index.js
# You should see: "DevSecOps MCP Agent running on stdio" on stderrMock Boundaries (Honest Scope)
What | Status | Details |
MCP Protocol | Real | Full Model Context Protocol implementation (stdio). |
GitHub Actions Integration | Real |
|
Other Tools | Mocked | Jira/Log tools return simulated JSON data. |
π Documentation
Architecture β System diagram and component details
Runbook β Setup, commands, and expected outputs
Decisions β ADRs for MCP integration
Changelog β Change history
π¨βπ» Author
Sumit Dalavi β Senior DevSecOps / Platform Engineer GitHub | LinkedIn
Built with a focus on robust patterns, not toy demos.
CI & Reliability Updates (August 2026)
CI Pipeline Remediation: Successfully resolved all CI/CD pipeline failures.
Specific Fix: Upgraded Zod to match MCP SDK requirements and explicitly cast tool schemas to bypass TypeScript excessive type inference loop.
Status: π© Passing
Available Tools
6 toolsget-kubernetes-eventsA
Fetches recent Kubernetes events for a specific namespace, crucial for correlating deployment failures, OOMKills, or pod scheduling issues.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of events to return (default: 50) | |
| namespace | Yes | The Kubernetes namespace to query (e.g., 'production', 'staging') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the full behavioral burden. 'Fetches' implies a read-only operation and 'recent' suggests a time-bounded result, but there is no disclosure of auth requirements, rate limits, pagination, or return shape.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, front-loaded with the operation and scope, and the use-case clause earns its place by clarifying intent. No redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter read tool, the description covers purpose, scope, and key diagnostic use cases, and the schema documents all parameters. It lacks return format and pagination details, but with no output schema and no annotations those are minor gaps for this operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and both parameters have descriptions (namespace, limit default 50). The tool description does not add syntax, format, or constraints beyond what the schema already provides, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Fetches) and resource (Kubernetes events) scoped to a namespace, and the use cases (deployment failures, OOMKills, scheduling) make its role distinct from sibling tools like get_prometheus-metrics or search_logs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear context for when the tool is usefulβcorrelating deployment failures, OOMKills, and pod scheduling issuesβbut does not name alternatives or state when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_pipeline_statusB
Fetches the status of recent CI/CD pipeline runs from GitHub Actions. Optionally filter by branch or status.
| Name | Required | Description | Default |
|---|---|---|---|
| branch | No | Filter by branch name (e.g., "main") | |
| status | No | Filter by pipeline status |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations, so the description carries the full behavioral burden. It does not disclose the window of 'recent', pagination, rate limits (GitHub API), authentication requirements, or output shape. Read-only intent is implied by 'Fetches' but nothing more.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with the primary action front-loaded and the optional filters noted second. Nothing redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a list-fetch tool with no annotations and no output schema, the description should clarify the time window, volume, and return format. None of that is present, leaving key invocation context missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and already documents both parameters with examples and an enum. The description only restates that filtering is optional, adding no syntax or default-window details beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear verb 'Fetches' and resource 'status of recent CI/CD pipeline runs' with source 'GitHub Actions'. Siblings are all unrelated monitoring/security tools, so no differentiation is needed, but 'recent' is vague without a defined window.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Hints that branch and status filters are optional and that omitting them returns recent runs, but gives no guidance on when to use this versus any monitoring sibling (e.g., prometheus metrics, k8s events) or any exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get-prometheus-metricsB
Fetches Prometheus metrics for SLI/SLO analysis, specifically error rates and latency spikes.
| Name | Required | Description | Default |
|---|---|---|---|
| service | Yes | The service name to query metrics for | |
| metricType | Yes | The type of metric to fetch | |
| timeWindowMinutes | No | Time window in minutes (default: 30) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full behavioral burden. It implies a read-only fetch but does not disclose auth requirements, rate limits, return format, or side effects. This minimal disclosure is a 2.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, front-loaded with the action and resource. The trailing 'specifically' clause is slightly misleading given the broader enum, but otherwise there is no waste. A 4 reflects the minor inaccuracy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only metrics fetch with no annotations and no output schema, the description should clarify output shape or usage boundaries. It covers purpose and metric types but omits behavioral and output details. A 3 is appropriate given the tool's simplicity and complete parameter schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so all three parameters are documented in the schema. The description adds no syntax, format, or default information beyond what the schema provides, and its 'specifically' clause conflicts slightly with the metricType enum. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (Fetches) and resource (Prometheus metrics), and adds the analysis context (SLI/SLO). It does not explicitly differentiate from sibling tools, so it falls short of a 5. The clause 'specifically error rates and latency spikes' slightly undersells the cpu/memory enum values but the core purpose is clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives a clear context ('for SLI/SLO analysis') but does not name alternatives or state when not to use it. No prerequisites or exclusions are provided. This is clear context without routing guidance, matching a 4.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scan_dependenciesC
Scans project dependencies for known vulnerabilities. Optionally filter by minimum severity threshold.
| Name | Required | Description | Default |
|---|---|---|---|
| min_severity | No | Filter dependencies with vulnerabilities above this severity |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. 'Scans' hints at a read-only operation but this is never stated, nor is the scan scope (which files/ecosystems), whether network access or a vulnerability database is used, how long it takes, or that it only reports and does not remediate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the core action. The second sentence largely restates the schema parameter, which is mild redundancy but it costs no comprehension.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-optional-param tool with no annotations and no output schema, the description is minimally viable but leaves scope undefined: it never says which dependency sources are scanned or what the result contains. An agent could invoke it, but with unclear expectations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the single enum parameter is fully documented in the schema, so the baseline is 3. The description's mention of a 'minimum severity threshold' mirrors the schema rather than adding bounds or semantics beyond it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Scans project dependencies') plus the outcome ('for known vulnerabilities'), which is clear and distinguishable from the sibling triage_vulnerabilities. It does not explicitly name or contrast with any sibling, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The only guidance is about the optional filter, which is parameter usage rather than when-to-use. It never says when to scan vs. when to triage_vulnerabilities, nor any prerequisites (e.g., a manifest/lockfile must exist, run before triage).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_logsB
Searches application logs by service name, log level, or keyword. Returns matching log entries with timestamps and trace IDs.
| Name | Required | Description | Default |
|---|---|---|---|
| level | No | Filter by minimum log level | |
| keyword | No | Search keyword in log message | |
| service | No | Filter by service name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full burden. It partially discharges this by disclosing the return payload shape (log entries with timestamps and trace IDs), but says nothing about result volume, pagination/limits, time-range scoping, or whether the search is unbounded β notable since there is no time-range parameter at all.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero filler, and the purpose is front-loaded before the return summary. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 3-param read tool with no output schema and no annotations, the description is adequate but thin: it covers purpose and return fields but omits result limits, time scoping, and any routing against the sibling observability tools that could query overlapping data.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so each of the three parameters is already documented in the schema. The description merely restates the same three filters (service, level, keyword) without adding format, matching semantics, or default behavior, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (searches) and resource (application logs) plus the three filter dimensions. It is clearly distinguishable from the metric/event/vulnerability siblings, though it never explicitly contrasts itself with get_prometheus_metrics or get_kubernetes-events, which are the nearest adjacent observability tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use or when-not-to-use guidance is given. The description never says when log search is preferable to the sibling observability tools (metrics, kubernetes events) or what prerequisites exist, leaving the agent to infer usage purely from the name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
triage_vulnerabilitiesA
Queries the vulnerability tracking board and returns CVEs ranked by severity. Optionally filter by severity or status.
| Name | Required | Description | Default |
|---|---|---|---|
| status | No | Filter by vulnerability status | |
| severity | No | Filter by minimum severity level |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the behavioral load; it does disclose that results come back ranked by severity, which is genuine behavioral value. However, it omits default filtering behavior (are resolved/ignored CVEs included by default?), pagination/result limits, and permission requirements for a security-sensitive board.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero waste, front-loaded with the core action and return shape followed by the optional refinement. Nothing redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read tool with two optional enum parameters and no output schema, the description covers what it does and what it returns. It would be stronger with default-filter behavior and result-set size expectations, but it is close to complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and both parameters are enum-constrained, so the schema already documents them fully. The description adds no formatting or default-value detail beyond 'filter by severity or status' β the baseline 3 for schema-covered parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Queries) and resource (vulnerability tracking board), and names the return payload (CVEs ranked by severity). No sibling tool overlaps this domain, so no differentiation burden is required.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description says the filters are optional, implying the tool is used for broad vulnerability triage, but it gives no explicit when-to-use/when-not guidance and no mention of which sibling tools might be preferred for adjacent tasks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v1.0.0- First observed
get_pipeline_status - First observed
get-kubernetes-events - First observed
get-prometheus-metrics - First observed
scan_dependencies - First observed
search_logs - First observed
triage_vulnerabilities
TDQS
Scored across 6 tools
The tools mostly target distinct data sources: vulnerability board, logs, dependencies, Kubernetes events, CI/CD pipelines, and Prometheus metrics. The only mild overlap is between triage_vulnerabilities and scan_dependencies, which both concern vulnerabilities but differ in action and source. Descriptions help differentiate them, so confusion is unlikely but possible.
The tool names mix snake_case and kebab-case delimiters (e.g., triage_vulnerabilities vs get-kubernetes-events), and some use imperative verbs while others use a get_ prefix. The meanings remain readable, but the set is not consistently formatted. This inconsistency is noticeable though not chaotic.
Six tools is a well-scoped set for an AI DevSecOps agent covering vulnerability triage, dependency scanning, log search, Kubernetes events, pipeline status, and Prometheus metrics. Each tool earns its place without redundancy or excessive breadth. The count fits the investigative, read-oriented purpose.
The surface covers key incident and security investigation areas: CVEs, dependency scans, logs, Kubernetes events, CI/CD status, and SLI/SLO metrics. Minor gaps remain, such as fetching trace details despite search_logs returning trace IDs, or querying alert/incident state directly. These can be worked around or handled by adjacent systems, so coverage is mostly complete.
Maintenance
Related MCP Connectors
Find, vet, and run MCP tools through a secure audited gateway with prompt-injection risk scoring
Zero-setup MCP gateway securely connecting AI to your tools with authentication and workflows
Governed app access for AI agents: 1,000+ apps & 12,000+ tools via Code Mode MCP.
- gatewayOAuthai.sealgate
MCP gateway with runtime security policy, tool-call-level control, and audit of agent actions.
Related MCP Servers
AlicenseNot gradedqualityAmaintenanceEnables AI agents to securely call MCP tools with risk scoring, checkpoints, rollback, and approval workflows.6 npmMIT- AlicenseNot gradedqualityCmaintenanceEnables AI agents to securely discover, invoke, and manage tools through a hardened MCP endpoint with protections like injection detection, circuit breakers, retry backoff, response caching, context-window limiting, and state snapshots.5 npmMIT
- AlicenseNot gradedqualityBmaintenanceEnables AI agents to safely call enterprise tools through a governed MCP gateway with permission enforcement, blast-radius controls, input validation, and a full audit trail for every invocation.MIT
- FlicenseNot gradedqualityCmaintenanceEnables LLM agents to enforce security policies by authorizing tool calls, scanning for prompt injection, checking memory writes, redacting PII, and accessing audit trails through MCP.-