Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Offensive360 MCP Server Scan this repo with Offensive360 and fix the critical findings"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Run Offensive360 SAST scans from inside your AI assistant. This Model Context Protocol server gives Claude Code, Claude Desktop, Cursor, and any other MCP client two tools:
Tool | What it does |
| Zips a local directory, runs a full SAST scan (60+ languages, taint/data-flow analysis), returns findings with file/line, severity, and fixes |
| Queue position of a running scan |
Ask your assistant things like "scan this project with Offensive360 and fix the criticals" — it scans, reads the findings, and starts patching.
You need an Offensive360 External scan token:
Open-source / public repos: free — request one at offensive360.com/free-for-open-source
Commercial: any admin of your instance can create one under Settings → Tokens
claude mcp add offensive360 \
-e O360_URL=https://sast.offensive360.com \
-e O360_TOKEN=<your-token> \
-- npx -y o360-mcp{
"mcpServers": {
"offensive360": {
"command": "npx",
"args": ["-y", "o360-mcp"],
"env": {
"O360_URL": "https://sast.offensive360.com",
"O360_TOKEN": "<your-token>"
}
}
}
}O360_URL can point at your own on-premise or air-gapped instance — the server
talks only to the instance you configure.
Related MCP server: Cybrium MCP Server
Scans are synchronous; typical duration is 1–5 minutes depending on codebase size.
The default client timeout is 900s (timeout_seconds parameter to override).
Common junk directories (node_modules, .git, dist, …) are excluded from the
upload automatically; add more via the exclude parameter.
Findings are also visible in your Offensive360 dashboard with full data-flow traces.
Requires Node 18+.
One platform for SAST, DAST, MAST, SCA, malware & binary analysis, and license compliance — flat pricing, cloud or fully air-gapped on-premise. offensive360.com · Book a demo
Run an Offensive360 SAST scan on a local directory (60+ languages, taint/data-flow analysis). Uploads the directory as a zip, waits for the scan, and returns the findings with file/line, severity, and remediation guidance. Typical duration: 1–5 minutes.
Inputs: path (required), exclude, project_name, timeout_seconds.
Check the queue position of an Offensive360 scan started with o360_scan_path. Returns 0 when the scan is actively processing, a positive number for its queue position, and -1 when no scan is queued or running under that name (finished or unknown).
Inputs: project_name (required).
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 2 tools
The two tools have clearly distinct purposes: one initiates a scan and another checks its queue status. There is no overlap or ambiguity in their functions.
Both tools follow the same 'o360_scan_' prefix followed by a noun, creating a consistent and predictable naming pattern.
With only two tools, the set feels thin. The scope is narrowly focused on scanning and status, but the count is at the borderline of being too minimal.
The set covers initiating a scan and checking status, but lacks operations like retrieving results for finished scans, cancelling scans, or listing past scans. This creates a significant gap for users who need to manage scans over time.
Security scanner for AI-written code: SAST, secrets, dependencies, IaC, containers and DAST.
Scan websites and code for security, performance and SEO issues from your AI assistant.
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
Generate SBOMs, scan vulnerabilities, and analyze dependencies from local projects or Git repos.
