secscan-mcp

MCP server for Cursor that scans codebases for security issues: hardcoded secrets, SAST, vulnerable dependencies, and IaC misconfigurations.

The built-in custom scanner works with no extra tools. Install optional CLIs (below) for broader coverage.

Install

Requires Python 3.11+.

git clone <repository-url>
cd mcp_test
python3 -m venv .venv
source .venv/bin/activate   # Windows: .venv\Scripts\activate
pip install .

Confirm the command exists:

which secscan-mcp

Use in Cursor

Option 1 — Any project (recommended)

Add to ~/.cursor/mcp.json (create the file if needed):

{
  "mcpServers": {
    "secscan": {
      "command": "/absolute/path/to/secscan-mcp"
    }
  }
}

Use the path from which secscan-mcp after install.

Then:

1. Cmd+Shift+P → Developer: Reload Window

2. Cursor Settings → Tools & MCP — secscan should show as connected (green)

3. Open the project you want to scan

4. In Agent chat, ask the agent to use the tools (see examples)

Works for any folder you open in Cursor, not only this repository.

Option 2 — This repo only

If you develop or test secscan-mcp itself, use the included .cursor/mcp.json and run make install-dev so ${workspaceFolder}/.venv/bin/secscan-mcp exists.

MCP tools

Most tools accept path (directory to scan) and optional severity_threshold (critical, high, medium, low, info).

Example prompts

• “Call list_available_scanners and tell me what’s installed.”

• “Run scan_secrets on this project.”

• “Run scan_all with severity_threshold high and summarize the findings.”

• “Explain the rule internal-api-key.”

Optional scanners

After installing, run list_available_scanners again to confirm.

Troubleshooting

Development

See docs/CONTRIBUTING.md and PLAN.md.