SecureCode MCP

Standalone MCP (Model Context Protocol) server for SecureCode AI. Provides security scanning tools to AI coding assistants — Cursor, Claude Code, Codex, Windsurf, and other compatible MCP clients — without requiring the VS Code extension.

Install

npm install -g @securecode-ai/mcp

Related MCP server: VulScan-MCP

Authenticate

securecode-mcp login

Or set the SECURECODE_API_TOKEN environment variable.

MCP client configuration

Cursor / Windsurf

{
  "mcpServers": {
    "securecode": {
      "command": "securecode-mcp",
      "args": ["serve", "--workspace", "/path/to/your/project"]
    }
  }
}

Claude Code

claude mcp add securecode -s user -- securecode-mcp serve --workspace /path/to/your/project

Tools

CLI

securecode-mcp serve [--workspace <path>]    Start the MCP stdio server
securecode-mcp login [--api-url <url>]      Store your API token
securecode-mcp status                       Show auth status
securecode-mcp logout                       Remove credentials

Security

• No API token in MCP client configuration — credentials are stored in ~/.securecode/credentials.json (mode 0600) or the SECURECODE_API_TOKEN env var.

• File reads are confined to the --workspace root.

• Fixes are returned for review and never auto-applied.

• No telemetry.

Development

npm install
npm run build
npm test