SCA-Triage MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| SCA_HOST | No | Address for HTTP transports. Defaults to 127.0.0.1. | 127.0.0.1 |
| SCA_PORT | No | Port for HTTP transports. Defaults to 8000. | 8000 |
| SCA_MCP_PATH | No | Endpoint path for streamable-http transport. Defaults to /mcp. Alias: SCA_STREAMABLE_HTTP_PATH. | /mcp |
| SCA_TRANSPORT | No | Transport mode for the MCP server (stdio, sse, or streamable-http). Defaults to stdio. | stdio |
| SCA_STREAMABLE_HTTP_PATH | No | Alias for SCA_MCP_PATH; endpoint path for streamable-http transport. Defaults to /mcp. | /mcp |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| search_multi_patternsA | Run a single, efficient ripgrep pass over a Java/Spring project for a list of patterns or a named security profile (e.g. 'deserialization'). Returns matches grouped by pattern and file with line numbers and code snippets. Build/service dirs (target/, build/, .gradle/, .mvn/, .idea/, bin/) are always ignored. |
| analyze_project_structureB | Analyze a Java/Spring project: locate pom.xml / build.gradle(.kts), extract Java, Spring Boot and Spring Framework versions, list key dependencies with versions/scopes, and surface configuration files (application.yml / application.properties). |
| analyze_vulnerability_usageA | Assess whether vulnerable components are actually used in a project. For each component, search imports/usages (FQCN or artifact keywords), group hits by architectural layer (controller/service/test/...), and flag externally-reachable usages to help estimate real exploitability. Layers are resolved from file paths AND file contents: any file declaring @RestController/@Controller/@RequestMapping/@GetMapping/@PostMapping/@PutMapping/@DeleteMapping is treated as a controller ([HIGH]) even when its path has no web/controller token. project_root must be an absolute path to the target project. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 3 tools
Each tool has a distinct role: raw pattern search, project metadata extraction, and vulnerability-usage assessment. There is mild overlap between search_multi_patterns and analyze_vulnerability_usage, since the latter performs import/usage searches internally, but the descriptions make the boundary clear (generic grep vs. component-level exploitability triage).
All three names follow a consistent snake_case verb_noun pattern (search_multi_patterns, analyze_project_structure, analyze_vulnerability_usage). Two share the 'analyze_' prefix on distinct objects, which reads predictably.
Three well-scoped, non-trivial tools fit a focused SCA triage workflow without bloat. It is on the lean side, but each tool earns its place rather than being a thin single-purpose wrapper.
The surface covers search, build-file/dependency discovery, and usage-based exploitability assessment, but there is no way to match discovered dependencies against a vulnerability database/CVE feed, nor to emit a structured triage report or read an arbitrary file. An agent would hit dead ends when the actual CVE-to-dependency correlation is needed.