MCP SSDLC Security Toolkit
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| list_domainsB | List all available domain plugins |
| load_domainC | Load a specific domain plugin |
| detect_domainC | Auto-detect domain from project description |
| ba_analyze_requirementsC | Generate user stories, security requirements, and abuse cases |
| techlead_designC | Generate feature checklist, flows, modules, pseudocode, architecture diagram |
| security_threat_modelC | Generate STRIDE threat model from modules |
| qa_design_test_strategyC | Generate test cases from features and threats |
| devops_design_cicdC | Generate CI/CD pipeline with security gates |
| orchestrate_ssdlc_pipelineC | Run complete SSDLC pipeline from project description |
| workspace_snapshotA | Generate a snapshot of the workspace structure (file tree with .gitignore filtering) |
| run_diagnostic_playbookC | Run a diagnostic playbook to check/fix environment issues |
| run_environment_diagnosticsC | Run diagnostics to check development environment (Node, Git, build tools) |
| parse_error_logC | Parse error log to extract issues and suggestions |
| get_last_known_goodC | Get last known good configuration that worked |
| analyze_code_securityC | Analyze code for security issues and vulnerabilities |
| get_coding_guidelinesC | Get coding guidelines and security rules for a domain |
| get_secure_templateC | Get a secure code template for a feature type |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 17 tools
Most tools have clearly distinct purposes, but there is minor overlap between run_diagnostic_playbook and run_environment_diagnostics, and between get_coding_guidelines and get_secure_template. Descriptions are clear enough to differentiate.
The majority of tools follow a consistent verb_noun pattern (e.g., analyze_code_security, list_domains). However, two tools (security_threat_model, workspace_snapshot) deviate by omitting a verb, creating a minor inconsistency.
With 17 tools, the server is well-scoped for a security toolkit covering requirements, design, threat modeling, code analysis, CI/CD, testing, diagnostics, and domain management. Each tool earns its place.
The toolset covers major SSDLC phases (requirements, design, implementation guidance, analysis, testing, CI/CD). Minor gaps exist, such as lack of deployment security scanning or compliance checks, but core workflows are supported.