Offensive360 MCP Server
OfficialServer Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| O360_URL | No | The URL of the Offensive360 instance. Defaults to https://sast.offensive360.com. Can point to your own on-premise or air-gapped instance. | https://sast.offensive360.com |
| O360_TOKEN | Yes | Your Offensive360 external scan token. Required for authentication. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| o360_scan_pathA | Run an Offensive360 SAST scan on a local directory (60+ languages, taint/data-flow analysis). Uploads the directory as a zip, waits for the scan, and returns the findings with file/line, severity, and remediation guidance. Typical duration: 1–5 minutes. |
| o360_scan_statusA | Check the queue position of an Offensive360 scan started with o360_scan_path. Returns 0 when the scan is actively processing, a positive number for its queue position, and -1 when no scan is queued or running under that name (finished or unknown). |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 2 tools
The two tools have clearly distinct purposes: one initiates a scan and another checks its queue status. There is no overlap or ambiguity in their functions.
Both tools follow the same 'o360_scan_' prefix followed by a noun, creating a consistent and predictable naming pattern.
With only two tools, the set feels thin. The scope is narrowly focused on scanning and status, but the count is at the borderline of being too minimal.
The set covers initiating a scan and checking status, but lacks operations like retrieving results for finished scans, cancelling scans, or listing past scans. This creates a significant gap for users who need to manage scans over time.