What can you do with this server?

The ZeroPath MCP Server enables AI agents to interact with ZeroPath's application security platform through MCP-compatible tools, calling the tRPC V2 API directly for vulnerability management and security operations. Key Capabilities: * Vulnerability Management - Search for vulnerabilities with queries, retrieve detailed issue information including patch data, mark issues as true/false positives, and archive/unarchive issues for workflow management * Patch Operations - Generate automated security fixes for vulnerabilities and approve patches for deployment * Security Scanning - Start new scans on repositories and list existing scans with filtering by repository, type (FullScan, PrScan, SCAScan), and pagination * Software Composition Analysis (SCA) - Search and list vulnerabilities in third-party dependencies across ecosystems (npm, pip, maven, etc.), get detailed SCA vulnerability information including transitivity (direct vs transitive), and filter by repository, ecosystem, and dependency type * Repository Management - List all repositories in the organization and view repositories with dependency inventory information * Security Analytics - Access overall security posture metrics (scores, trends, risk assessment), view issue statistics grouped by vulnerability class (XSS, SQLi, etc.), and get aggregated summary statistics (total issues, patches, repositories, KPIs) * Direct API Integration - Calls ZeroPath tRPC V2 procedures directly without REST wrappers, returning structured JSON responses with client-side input validation

Which integrations are available for this server?

Offers a community space for users to ask questions, provide feedback, and discuss the ZeroPath MCP server Enables bug reporting and contribution to the ZeroPath MCP server through GitHub issues and pull requests

How do I use ZeroPath MCP Server?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@ZeroPath MCP Server show me all SSRF vulnerabilities in the user service" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

en es ja ko zh

ZeroPath MCP Server

Official

by ZeroPathAI

Overview Schema Source Related Servers Discussions Admin

Python

Remote

ZeroPath MCP Server

License: MIT

Interact with ZeroPath security findings via MCP-compatible tools.

This MCP server calls ZeroPath tRPC V2 procedures directly (no REST wrappers) and returns structured JSON responses suitable for agent consumption.

Blog Post

Learn more about why we built this and how it fits into the evolving AI development ecosystem:

Chat With Your AppSec Scans: Introducing the ZeroPath MCP Server

Related MCP server: Checkmarx

Installation

Quick Install (Recommended)

Install directly from GitHub:

# Using pip
pip install git+https://github.com/ZeroPathAI/zeropath-mcp-server.git

# Using uvx (run without installing)
uvx --from git+https://github.com/ZeroPathAI/zeropath-mcp-server zeropath-mcp-server

You can also pin to a specific version:

# Specific version tag
pip install git+https://github.com/ZeroPathAI/zeropath-mcp-server.git@v0.1.0

# Latest from main branch
uvx --from "git+https://github.com/ZeroPathAI/zeropath-mcp-server@main" zeropath-mcp-server

From Source

git clone https://github.com/ZeroPathAI/zeropath-mcp-server.git
cd zeropath-mcp-server
uv sync

From PyPI (Optional)

If the package is published to PyPI, you can also install via:

pip install zeropath-mcp-server

Setup

1. Generate API Key

Generate a user-scoped or admin API key from ZeroPath Settings.

2. Configure Environment Variables

export ZEROPATH_BASE_URL="https://zeropath.com"  # optional (defaults to https://zeropath.com)
export ZEROPATH_TOKEN_ID=your_token_id
export ZEROPATH_TOKEN_SECRET=your_token_secret
export ZEROPATH_ORG_ID=your_org_id

Use ZEROPATH_BASE_URL to target staging or another environment, for example:

export ZEROPATH_BASE_URL="https://staging.branch.zeropath.com"

Configuration

Add the following to your MCP config file (Claude Desktop, Cursor, etc.):

Using GitHub URL (Recommended)

{
  "mcpServers": {
    "zeropath": {
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/ZeroPathAI/zeropath-mcp-server",
        "zeropath-mcp-server"
      ],
      "env": {
        "ZEROPATH_BASE_URL": "https://zeropath.com",
        "ZEROPATH_TOKEN_ID": "your_token_id",
        "ZEROPATH_TOKEN_SECRET": "your_token_secret",
        "ZEROPATH_ORG_ID": "your_org_id"
      }
    }
  }
}

Using source install

{
  "mcpServers": {
    "zeropath": {
      "command": "uv",
      "args": [
        "run",
        "--project",
        "/path/to/zeropath-mcp-server",
        "python",
        "-m",
        "zeropath_mcp_server"
      ],
      "env": {
        "ZEROPATH_BASE_URL": "https://zeropath.com",
        "ZEROPATH_TOKEN_ID": "your_token_id",
        "ZEROPATH_TOKEN_SECRET": "your_token_secret",
        "ZEROPATH_ORG_ID": "your_org_id"
      }
    }
  }
}

Using PyPI install (Optional)

{
  "mcpServers": {
    "zeropath": {
      "command": "zeropath-mcp-server",
      "env": {
        "ZEROPATH_BASE_URL": "https://zeropath.com",
        "ZEROPATH_TOKEN_ID": "your_token_id",
        "ZEROPATH_TOKEN_SECRET": "your_token_secret",
        "ZEROPATH_ORG_ID": "your_org_id"
      }
    }
  }
}

Tool Surface (tRPC V2)

Tools are loaded dynamically from the ZeroPath frontend's MCP manifest at startup.

All tool calls use tRPC V2 procedures directly using tRPC v10 HTTP conventions:

Queries: GET /trpc/<procedure>?input=<url-encoded-json>
Mutations: POST /trpc/<procedure> with the raw JSON input object as the body (not wrapped).

Successful responses are returned as structured JSON with the { "result": { "data": ... } } wrapper removed. Errors return the tRPC error object directly.

The server also performs best-effort client-side input validation using each tool's inputSchema from the manifest and returns a BAD_REQUEST error before calling tRPC when inputs are invalid. If a schema uses unsupported JSON Schema features, client-side validation is skipped for that call (server-side validation remains authoritative).

Example Calls

List issues:

{
  "tool": "issues.list",
  "input": {
    "page": 1,
    "pageSize": 25,
    "statuses": ["PENDING_REVIEW"],
    "sortBy": "score",
    "sortOrder": "desc"
  }
}

Archive issues:

{
  "tool": "issues.archive",
  "input": {
    "issueIds": ["issue_123", "issue_456"],
    "reason": "Confirmed duplicate"
  }
}

Create a rule:

{
  "tool": "rules.create",
  "input": {
    "name": "Detect unsafe eval",
    "rule": "Detect any use of eval() on user input",
    "globPattern": "**/*.js",
    "sourceTypes": ["FILE_HANDLER"],
    "repositoryIds": ["repo_123"]
  }
}

Fetch stats summary:

{
  "tool": "stats.summary",
  "input": {
    "organizationId": "org_123"
  }
}

Development

Running Tests

uv run pytest tests/ -v

Building the Package

uv build

Publishing to PyPI (Optional)

uv publish

Contributing

We welcome contributions from the security, AI, and developer tools communities.

Found a bug? Open an issue
Want to improve a tool or add a new one? Submit a pull request
Have feedback or questions? Join us on Discord

License

MIT License - see LICENSE for details.

Available Tools

17 tools

approve_patchC

Approve a patch for a specific vulnerability issue.

Args:
    issue_id (str): The ID of the issue whose patch should be approved

Name	Required	Description	Default
`issue_id`	Yes

archive_issueB

Archive a security issue to remove it from active view.

Args:
    issue_id: The ID of the issue to archive

Name	Required	Description	Default
`issue_id`	Yes

generate_patchC

Generate an automated patch/fix for a security issue.

Args:
    issue_id: The ID of the issue to generate a patch for

Name	Required	Description	Default
`issue_id`	Yes

get_issueB

Get a specific vulnerability issue by its ID, including patch information if available.

Args:
    issue_id (str): The ID of the issue to retrieve

Name	Required	Description	Default
`issue_id`	Yes

get_issues_by_vuln_classB

Get issue statistics grouped by vulnerability class/type. Shows distribution of vulnerabilities by category (XSS, SQLi, etc.).

Name	Required	Description	Default
No parameters

get_sca_vulnerabilityC

Get detailed information about a specific SCA vulnerability.

Args:
    vulnerability_id: The ID of the vulnerability to retrieve

Name	Required	Description	Default
`vulnerability_id`	Yes

get_security_postureB

Get the overall security posture metrics for the organization. Returns security score, vulnerability trends, and risk assessment.

Name	Required	Description	Default
No parameters

get_summary_statisticsB

Get aggregated summary statistics across the organization. Includes total issues, patches, repositories, and key metrics.

Name	Required	Description	Default
No parameters

list_repositoriesB

List all repositories in the organization.

Args:
    search_query: Optional search term to filter repositories

Name	Required	Description	Default
`search_query`	No

list_scansB

List security scans with optional filtering and pagination.

Args:
    search_query: Optional search term to filter scans
    repository_ids: Optional list of repository IDs to filter by
    scan_type: Optional scan type filter (FullScan, PrScan, SCAScan)
    page: Page number (default: 1)
    page_size: Number of results per page (default: 10)

Name	Required	Description	Default
`search_query`	No
`repository_ids`	No
`scan_type`	No
`page`	No
`page_size`	No

list_sca_repositoriesB

List repositories with their aggregated dependency inventory information. Shows which repositories have been analyzed for dependencies.

Name	Required	Description	Default
No parameters

list_sca_vulnerabilitiesB

Search for SCA (Software Composition Analysis) vulnerabilities in dependencies.

Args:
    search_query: Optional search term to filter vulnerabilities
    repository_ids: Optional list of repository IDs to filter by
    ecosystems: Optional list of ecosystems to filter (npm, pip, maven, etc.)
    transitivity: Optional filter by dependency type (direct, transitive)
    page: Page number (default: 1)
    page_size: Number of results per page (default: 50)

Name	Required	Description	Default
`search_query`	No
`repository_ids`	No
`ecosystems`	No
`transitivity`	No
`page`	No
`page_size`	No

mark_false_positiveA

Mark a security issue as a false positive (not a real vulnerability).

Args:
    issue_id: The ID of the issue to mark as false positive

Name	Required	Description	Default
`issue_id`	Yes

mark_true_positiveC

Mark a security issue as a true positive (confirmed vulnerability).

Args:
    issue_id: The ID of the issue to mark as true positive

Name	Required	Description	Default
`issue_id`	Yes

search_vulnerabilitiesC

Search for vulnerabilities using the Zeropath API with a simple search query.

Name	Required	Description	Default
`search_query`	No

start_scanC

Start a new security scan on one or more repositories.

Args:
    repository_ids: List of repository IDs to scan

Name	Required	Description	Default
`repository_ids`	No

unarchive_issueB

Unarchive a previously archived security issue to restore it to active view.

Args:
    issue_id: The ID of the issue to unarchive

Name	Required	Description	Default
`issue_id`	Yes

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

17 tool updatesDec 23, 2025
- First observedapprove_patch
- First observedarchive_issue
- First observedgenerate_patch
- First observedget_issue
- First observedget_issues_by_vuln_class
- First observedget_sca_vulnerability
- First observedget_security_posture
- First observedget_summary_statistics
- First observedlist_repositories
- First observedlist_sca_repositories
- First observedlist_sca_vulnerabilities
- First observedlist_scans
- First observedmark_false_positive
- First observedmark_true_positive
- First observedsearch_vulnerabilities
- First observedstart_scan
- First observedunarchive_issue

Deploy Server

Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

TDQS

B3.4/5.0

Scored 2026-04-18 10:40 across 17 tools

Disambiguation4/5

Most tools have distinct purposes, but some overlap exists: 'get_issues_by_vuln_class' and 'search_vulnerabilities' both involve vulnerability discovery, though the former focuses on statistics and the latter on search. 'list_sca_vulnerabilities' and 'search_vulnerabilities' could be confused as both handle vulnerability queries, but their scopes differ (SCA vs. general). Overall, descriptions help clarify boundaries, but minor ambiguity remains.

Naming Consistency5/5

All tools follow a consistent verb_noun naming pattern (e.g., 'approve_patch', 'archive_issue', 'generate_patch'). There are no deviations in style or convention, making the set predictable and easy to parse. This uniformity enhances usability and reduces cognitive load for agents.

Tool Count4/5

With 17 tools, the count is slightly high but reasonable for a security vulnerability management domain, covering issues, patches, scans, repositories, and SCA. It feels comprehensive without being overwhelming, though it borders on the upper limit of typical scoping (3-15 tools).

Completeness5/5

The toolset provides complete coverage for security vulnerability management: CRUD operations for issues (get, archive/unarchive, mark status), patch lifecycle (generate, approve), scanning (start, list), repository management, and SCA vulnerabilities. No obvious gaps exist; agents can handle full workflows from detection to resolution.

Maintenance

ActivityNo data

ResponsivenessOutdated data

Resources

Related MCP Connectors

Frogeye Security ScannerA
io.github.frogeye-ai
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
Security Penetration Testing
2
https://mcp.frogeye.ai/mcp
Opzyai Pro
com.opzyai
Deep security scans of repos you own from your editor: dependency CVEs, SAST, git-history secrets.
Code Analysis Penetration Testing Security
2
https://www.opzyai.com/api/mcp/pro/mcp
TrentA
ai.trent
Security reviews, threat models over a repo or website, and remediation tracking, in your editor.
Code Analysis Penetration Testing Security
2419
https://mcp.eu.trent.ai/mcp
SafeWeave
dev.safeweave
Security scanner for AI-written code: SAST, secrets, dependencies, IaC, containers and DAST.
Code Analysis Penetration Testing Security
16
https://mcp.safeweave.dev/mcp

Related MCP Servers

Fast Context MCP
Code Analysis Search Developer Tools
meimingqi222
A
license
B
quality
D
maintenance
Enables AI-driven semantic code search via natural language queries, integrating with MCP clients like Claude Desktop to retrieve relevant code context from any codebase.
Updated 9 months ago (2026-02-13 16:53 UTC)
1
MIT
Checkmarxofficial
Penetration Testing Code Analysis Security
Checkmarx
A
license
Not graded
quality
B
maintenance
The Checkmarx Security MCP server bridges your AI assistant (Claude, Cursor, Copilot, etc.) with Checkmarx One's enterprise application security platform. It exposes security workflows as natural-language-accessible MCP tools, allowing developers to scan code, investigate findings, and receive context-aware fixes without leaving their development environment.
Updated 7 days ago (2026-11-03 10:09 UTC)
Apache 2.0
VibeGuard MCP Server
Penetration Testing Code Analysis
yagyeshVyas
A
license
Not graded
quality
C
maintenance
Enables AI coding tools to scan projects for security vulnerabilities, hardcoded secrets, injection flaws, and privacy violations with 699 rules and 76 MCP tools, all running locally with zero telemetry.
Updated 10 days ago (2026-10-31 10:12 UTC)
17 npm
7
MIT
Apiiro Guardian Agent MCPofficial
Security Developer Tools Code Analysis
apiiro
A
license
Not graded
quality
D
maintenance
Enables AI coding assistants to leverage Application Security Posture Management (ASPM) capabilities, allowing developers to write secure code, query security risks, trigger diff scans, and manage security findings directly from their AI assistant.
Updated 16 days ago (2026-10-25 12:21 UTC)
5
Apache 2.0

ZeroPath MCP Server

Blog Post

Installation

Quick Install (Recommended)

From Source

From PyPI (Optional)

Setup

1. Generate API Key

2. Configure Environment Variables

Configuration

Using GitHub URL (Recommended)

Using source install

Using PyPI install (Optional)

Tool Surface (tRPC V2)

Example Calls

Development

Running Tests

Building the Package

Publishing to PyPI (Optional)

Contributing

License

Available Tools

Tool Schema Changelog

TDQS

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

Fast Context MCP

Checkmarxofficial

VibeGuard MCP Server

Apiiro Guardian Agent MCPofficial