MCP Veracode
# MCP Veracode
MCP server para consultar Veracode desde Claude Code.
## Tools
| Tool | Descripcion |
|------|-------------|
| `veracode_applications` | Listar y buscar aplicaciones |
| `veracode_findings` | Vulnerabilidades y flaws de una aplicacion |
| `veracode_scan_status` | Estado de scans y summary report |
| `veracode_policy_compliance` | Estado de cumplimiento de politicas |
## Instalacion
Agregar a `~/.claude/mcp.json`:
```json
{
"mcpServers": {
"veracode-mcp": {
"command": "npx",
"args": ["-y", "github:landscapedotcl/mcp-veracode"],
"env": {
"VERACODE_API_ID": "tu_api_id",
"VERACODE_API_SECRET": "tu_api_secret"
}
}
}
}
```
Reiniciar Claude Code para que cargue el MCP server.
## Autenticacion
Usa HMAC-SHA-256 con API ID y API Secret, el metodo estandar de Veracode.
Las credenciales se generan en Veracode > Account Settings > API Credentials.
## Uso
```
# Listar aplicaciones
veracode_applications({ name: "mi-app" })
# Findings de una aplicacion
veracode_findings({ applicationGuid: "guid-aqui", scanType: "STATIC", severityGte: 3 })
# Estado de scans
veracode_scan_status({ applicationGuid: "guid-aqui" })
# Apps que no cumplen politica
veracode_policy_compliance({ policyCompliance: "DID_NOT_PASS" })
```
TDQS
Scored across 4 tools
Each tool has a clearly distinct purpose targeting different aspects of the Veracode security platform: applications management, vulnerability findings, policy compliance, and scan status. There is no overlap or ambiguity between these four functions.
All tool names follow the exact same pattern: 'veracode_' prefix followed by a descriptive noun phrase (applications, findings, policy_compliance, scan_status). This creates perfect consistency and predictability across the toolset.
Four tools is a reasonable count for a security scanning platform interface, though it feels slightly minimal. The tools cover core functions but might benefit from additional operations like initiating scans or managing scan configurations.
The toolset provides good coverage for monitoring and reporting on Veracode security scans, including applications, findings, compliance, and status. However, there are minor gaps in action-oriented operations like initiating new scans or managing scan configurations that would complete the workflow.