TASIE MCP

TASIE — autonomous SAST + real exploit + human-gated remediation — exposed as an MCP app (NitroStack + NitroCloud), so ChatGPT and other MCP clients can scan code for vulnerabilities and get proof-carrying remediation.

This Node/TypeScript service is a thin MCP surface over the TASIE FastAPI backend (demo/backend/). All detection, live exploitation and patching happens in the Python engine; this app forwards tool calls over HTTP.

Architecture

ChatGPT / Studio  ──MCP──▶  tasie-mcp (this app)  ──HTTP──▶  TASIE FastAPI backend
                                                              (~90 engines + Docker
                                                               exploit sandbox)

The backend URL is TASIE_API_BASE (default http://localhost:8000).

• Stateless tools (scan_code, scan_dependencies, detect_frameworks) send the code/manifest inline — they work against any reachable TASIE host.

• Backend-state tools (remediate_file, scan_repo) act on files that live on the TASIE host and need the full Docker-enabled deployment.

Related MCP server: chatgpt-codex-local-mcp

Tools

Setup

npm install                 # main app
npm --prefix src/widgets install   # widget subpackage (or run `npm run dev`)
cp .env.example .env        # then set TASIE_API_BASE

Start the TASIE backend first (from demo/backend):

.venv/Scripts/python.exe -m uvicorn app:app --host 127.0.0.1 --port 8000

Run

npm run dev        # MCP server (STDIO) + widget dev server (:3001)

Then connect in NitroStudio → Add Server → Nitro Project → this folder → Studio App Canvas. Test scan_code on the Tools page; the TASIE Scan Report widget renders the findings.

Deploy (NitroCloud → ChatGPT)

1. Set TASIE_API_BASE to a publicly reachable TASIE host (a cloud VM/Docker host running demo/backend). NitroCloud deploys only this Node app — the Python engine + exploit sandbox must be hosted separately.

2. In Studio App Canvas: Link to app / Create Cloud App → Deploy.

3. In ChatGPT: Settings → Plugins → Developer mode (Plus/Pro) → + → Server URL = {serviceUrl}/sse → Create → Connect.

Cloud builds run on Node 20 (engines pins 20.x). Local dev on newer Node works but test against 20 before deploying.

Config

Notes

• ctx.logger only inside tools — console.* breaks the STDIO transport.

• Verified end-to-end: scan_code on a Flask SQLi sample returns critical / CWE-89 / OWASP A03 from the live backend.