Allows checking release gate status for Jenkins pipelines.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@armorcode-mcp show me critical severity findings for the last week"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Local MCP server for ArmorCode — finding triage, scans, exceptions, risk scores, and release gate checks.
{
"mcpServers": {
"armorcode": {
"command": "npx",
"args": ["-y", "@raviraj87/armorcode-mcp"],
"env": {
"ARMORCODE_URL": "https://your-tenant.armorcode.com",
"ARMORCODE_API_TOKEN": "your-api-token"
}
}
}
}ARMORCODE_WRITE_ENABLED is optional — omit it for safe defaults (write tools preview only).
Related MCP server: bd-skill
Variable | Required | Description |
| Yes | Tenant base URL |
| Yes | API token from Manage → Integrations → API |
| No | Set |
Tool | Purpose |
| Search/filter findings |
| Full finding detail |
| Audit trail |
| Counts by severity/status |
| Severity breakdown |
Tool | Purpose |
| OPEN → CONFIRMED |
| → CONTROLLED |
| Block via accept-risk |
| Accept risk |
| False positive |
| Reopen |
| → TRIAGE |
| → MITIGATED |
| Suppress |
| Add note |
| Structured exploitability |
| Change severity |
Tool | Purpose |
| List products/groups |
| List subproducts |
| Product risk |
| Subproduct risk |
| All products |
Tool | Purpose |
| List scans |
| Scan details |
| Trigger scan |
| PULL tool scheduler (Black Duck, etc.) |
| List schedulers |
| Clean up scheduler |
| Open exceptions |
| Exception detail |
| Create risk register entry |
| Jenkins release gate check |
Tool | Purpose |
| Connectivity check |
| Any GET/POST/PUT/DELETE path |
cd armorcode-mcp
npm install
npm run build
ARMORCODE_URL=... ARMORCODE_API_TOKEN=... npm run test:readonlyMIT — Copyright © 2026 Ravi Raj
Accept Risk. dryRun defaults true.
Inputs: findingId (required), notes, dryRun, reason.
Add comment to finding. dryRun defaults true.
Inputs: note (required), findingId (required), dryRun.
Structured exploitable/notexploitable comment. dryRun defaults true.
Inputs: reason (required), findingId (required), exploitable (required), dryRun.
Add/remove finding tags only (no comment). For exploitability triage use armorcode_set_product_exploitability. dryRun defaults true.
Inputs: tags (required), findingId (required), dryRun, removeTags.
Escape hatch for any ArmorCode REST path.
Inputs: path (required), method (required), body, dryRun.
Block via accept-risk (fix unavailable). dryRun defaults true.
Inputs: findingId (required), notes, dryRun, reason.
Triage multiple findings: comment first, then product_exploitability tag per finding. dryRun defaults true.
Inputs: reason (required), productName (required), dryRun, status, +5 more.
Confirm Finding. dryRun defaults true.
Inputs: findingId (required), notes, dryRun, reason.
Control Finding. dryRun defaults true.
Inputs: findingId (required), notes, dryRun, reason.
Create risk register exception. dryRun defaults true.
Inputs: name (required), endDate (required), startDate (required), description (required), +5 more.
Delete scheduler config. dryRun defaults true.
Inputs: schedulerId (required), dryRun.
Trigger scan for subproduct. dryRun defaults true.
Inputs: toolName (required), environment (required), subproductName (required), dryRun, +1 more.
Risk scores for all products.
Inputs: environment.
Exception details by ID.
Inputs: exceptionId (required).
Full finding details by ID.
Inputs: findingId (required).
Audit events for a finding.
Inputs: findingId (required).
Finding counts by severity/status.
Inputs: status, severity, sourceTool, productName, +1 more.
Risk score for a product by name.
Inputs: productName (required), environment.
Scan details by ID.
Inputs: scanId (required).
Severity breakdown for product/subproduct.
Inputs: productName, subproductName.
Risk score for a subproduct.
Inputs: subproductName (required), environment, productName.
Verify ArmorCode API connectivity.
Inputs: no named parameters.
Open risk register exceptions.
Inputs: no named parameters.
List ArmorCode products/groups.
Inputs: search.
List security scans with filters.
Inputs: pageSize, toolName, scanStatus, environment, +2 more.
Schedulers for a security tool.
Inputs: toolName (required).
List subproducts, optionally by product.
Inputs: search, productName.
False Positive. dryRun defaults true.
Inputs: findingId (required), notes, dryRun, reason.
Mitigate Finding. dryRun defaults true.
Inputs: findingId (required), notes, dryRun, reason.
Check ArmorCode release gate (/client/build).
Inputs: env (required), product (required), subProducts (required).
Reopen Finding. dryRun defaults true.
Inputs: findingId (required), notes, dryRun, reason.
Search/filter ArmorCode findings. Severity and excludeTagPrefix are applied client-side when server filters fail. Use fetchAll=true to paginate.
Inputs: cves, tags, status, afterKey, +9 more.
Triage exploitability: adds comment first, then product_exploitability tag. dryRun defaults true.
Inputs: reason (required), findingId (required), exploitable (required), dryRun.
Suppress Finding. dryRun defaults true.
Inputs: findingId (required), notes, dryRun, reason.
Triage Finding. dryRun defaults true.
Inputs: findingId (required), notes, dryRun, reason.
Create temporary scheduler for PULL tools (e.g. Black Duck). dryRun defaults true.
Inputs: toolName (required), productName (required), subproductName (required), dryRun, +1 more.
Update finding severity. dryRun defaults true.
Inputs: severity (required), findingId (required), notes, dryRun, +1 more.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 37 tools
Most tools have clearly distinct purposes, especially for findings where each action (accept, confirm, mitigate, etc.) targets a specific status. However, the sheer number of finding-related tools (15+) could cause some confusion, particularly between armorcode_accept_risk and armorcode_block_finding, though descriptions clarify.
All tools follow the consistent pattern of 'armorcode_verb_noun' with underscores, using predictable verbs like get, list, add, create, delete, search, etc. The naming is uniform and easy to understand across the entire set.
With 37 tools, the count is well above typical well-scoped MCP servers (3-15) and exceeds the 25+ threshold for 'too many'. While the ArmorCode domain may have many operations, the tool surface feels overly granular, with many separate tools that could be parameterized.
The tool set covers the core ArmorCode workflows: findings (CRUD-like status changes, tagging, comments), scans, products, exceptions, and risk scores. Missing operations like deleting findings or updating products are minor gaps that do not severely hinder common use cases, especially with the armorcode_api escape hatch.
MCP server for Appcircle mobile CI/CD platform.
An MCP server for Arcjet - the runtime security platform that ships with your AI code.
Zero-log MCP server with 49 tools for AI guardrails, secret scanning, MCP linting & EU compliance.
One MCP server for all your MCP servers: code mode, per-tool permissions, approvals and audit.
