ThreatCorralling

Version 1.0.7.9667673

ThreatCorralling is an intelligent, extensible Vulnerability Correlation Agent and Model Context Protocol (MCP) server. It bridges the gap between disparate security tools by analyzing scoped assets across platforms like Checkmarx SAST and Tenable WAS. Powered by LLMs (supporting both Gemini and local Ollama deployments), ThreatCorralling automates the arduous task of correlating findings, determining reachability, mapping compliance controls (SOC2, ISO27001), and generating actionable, tech-stack-specific remediation and regression testing patterns. It offers a "best of both worlds" architecture, functioning as a standalone Streamlit web application for interactive analysis, or as a background MCP server ready to plug into modern AI IDEs and clients like Cursor and Claude Desktop.

Requirements

1. Python

2. Streamlit

3. Gemini or Ollama running with a well capable model.

4. Credentials: 4.1. Tenable (Access and Secret) 4.2. Checkmarx (Tenanat and Refresh Token) 4.3. If using Gemini, an API key.

Related MCP server: DevSecOps MCP Server

Architecture Breakdown

The Agent (agent.py)

It contains the SYSTEM_INSTRUCTION (telling the LLM it to be an elite DevSecOps correlation agent) and the logic to communicate with Gemini or Ollama to execute a multi-step thought process.

The UI (app.py)

The UI for the Agent. Uses a structured JSON file to "glue" the components of the applications. This is critical to group assets under the same umbrell when needed to be sent to the MCP Server for analysis from the skills. This files can be created outside as far as they respect the structure.

{
  "team_name": "Some cool team",
  "product_name": "Some cool product",
  "product_owner": "John Doe",
  "group_portfolio_owner": "John's brother",
  "developers": ["John's Sister"],
  "security_champions": ["John's Sister in law"],
  "tech_platform": ["Python","Java"],
  "checkmarx_projects": [
    "cool-project_1",
    "cool-project_2"
  ],
  "public_domains": [
    "example.com"
  ],
  "public_apis": ["example.com/api"],
  "gcp_projects": [
    "main-project"
  ],
  "gcp_services": [],
  "documentation_urls": "",
  "tenable_was_applications": [
    "example.com"
  ]
}

The MCP Server (mcp_server.py)

Using FastMCP wrapper, the file sits in the background and waits for an external AI to say, "Hey, what tools do you have?" It then executes the tools locally and passes the data back to the AI. For performance, the server caches the results for further use. This feature can be replaced by a database or any other better persistence method.

The Skills (The Python Functions & Adapters)

The skills rely on the Adapters to securely communicate with external APIs like Tenable and Checkmarx. More skills are being prepared by the time of version 1.0.7.9667673 like Security Scorecard, Bitbucket and OneTrust.

By importing the Skills from mcp_server.py directly into agent.py, we are using the Skills in two places at once: powering the custom Agent UI, and exposing them to the global MCP ecosystem.

Setup and How to Run

# Create a new environment (Optional)
virtualenv ENV
# Activate the environment
source ENV/bin/activate
# Install the requirements
pip install -r requirements.txt
# Copy the sample ENV to a production version
cp sample.env prod.env
# Update the credentials in the prod.env file
# Start the agent's UI
streamlit run app.py

To run the tests:

pytest tests/ -v

Known Limitations

1. The Agent will work with data cached in the device. If not data is available, it will be pulled before the agent can analyze it. This is reflected in a delay when the tool is called and the data is available to the agent.

2. If you use a Local Model, you MUST use one with Tool capabilities like Hermes3, Qwen3, GLM-4.7 or Devstral-Small.

TODO

1. Move tools to their own classes.

2. Review caching alternatives to the flat files by the MCP server.