DevSecOps Mcp

Created By

jmstar858 months ago

A comprehensive Model Context Protocol (MCP) server that integrates Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Interactive Application Security Testing (IAST), and Software Composition Analysis (SCA) tools for AI-powered DevSecOps automation.

# #DevSecOps #SAST #DAST #IAST #SCA

Overview Content Tools Comments

Content

📊 MCP Tools The server provides the following MCP tools:

SAST Scan { "name": "run_sast_scan", "description": "Execute SAST security scan", "inputSchema": { "target": "string", // Source code path/repo "rules": "array", // Security rules "severity_threshold": "enum", // low|medium|high|critical "tool": "enum" // sonarqube|semgrep|auto } }
DAST Scan { "name": "run_dast_scan", "description": "Execute DAST security scan", "inputSchema": { "target_url": "string", // Application URL "scan_type": "enum", // quick|baseline|full "authentication": "object" // Login credentials } }
SCA Scan { "name": "run_sca_scan", "description": "Execute SCA dependency scan", "inputSchema": { "project_path": "string", // Project directory "package_manager": "enum", // npm|yarn|maven|gradle|pip "tool": "enum", // osv-scanner|trivy|npm-audit|auto "fix_vulnerabilities": "bool" // Auto-fix enabled } }
IAST Scan { "name": "run_iast_scan", "description": "Execute IAST-like security analysis", "inputSchema": { "application_id": "string", // App identifier or path "environment": "enum", // dev|staging|testing "tool": "enum", // trivy|owasp-zap|auto "test_suite": "string" // Test suite to run (optional) } }
Generate Security Report { "name": "generate_security_report", "description": "Generate comprehensive security report", "inputSchema": { "scan_ids": "array", // Scan result IDs "format": "enum", // json|html|pdf|sarif "include_remediation": "bool" // Include fix guidance } }
Validate Security Policy { "name": "validate_security_policy", "description": "Validate security policy compliance", "inputSchema": { "policy_file": "string", // Policy file path "scan_results": "array" // Scan result IDs } } 🧪 Testing ✅ Verified Performance Metrics (Tested on 2025-07-06) Security Test Vulnerabilities Detected Accuracy Tool Status Test Time SAST 60+ issues 95%+ ✅ Verified ~5s DAST 5+ types 100% ✅ Verified ~30s SCA 20 issues 100% ✅ Verified ~3s IAST Hybrid 90%+ ✅ Simulated ~10s Real-World Vulnerability Detection OWASP Top 10: 100% coverage confirmed CWE Coverage: 20+ types actually detected Language Support: JavaScript, Python fully verified Run Tests

Comprehensive security test (actually verified)

node test-all-security.js

SAST testing

node test-sast.js

DAST testing with vulnerable web server

node test-vulnerable-server.js & curl "http://localhost:3001/search?q="

Unit tests

npm test

With coverage

npm run test:coverage

Integration tests

npm run test:integration Test Structure Real vulnerable samples: test-samples/ Vulnerable dependencies: test-vulnerable-dependencies/ Comprehensive test script: test-all-security.js Unit tests: tests/security/ Integration tests: tests/integration/

Server Config

{
  "mcpServers": {
    "devsecops": {
      "command": "node",
      "args": [
        "dist/src/mcp/server.js"
      ],
      "cwd": "/path/to/DevSecOps-MCP",
      "env": {
        "NODE_ENV": "production",
        "MCP_PORT": "3000",
        "LOG_LEVEL": "info",
        "SECURITY_STRICT_MODE": "true"
      }
    }
  }
}

Recommend Servers

TraeBuild with Free GPT-4.1 & Claude 3.7. Fully MCP-Ready.

EdgeOne Pages MCPAn MCP service designed for deploying HTML content to EdgeOne Pages and obtaining an accessible public URL.

AiimagemultistyleA Model Context Protocol (MCP) server for image generation and manipulation using fal.ai's Stable Diffusion model.

Tavily Mcp

Zhipu Web SearchZhipu Web Search MCP Server is a search engine specifically designed for large models. It integrates four search engines, allowing users to flexibly compare and switch between them. Building upon the web crawling and ranking capabilities of traditional search engines, it enhances intent recognition capabilities, returning results more suitable for large model processing (such as webpage titles, URLs, summaries, site names, site icons, etc.). This helps AI applications achieve "dynamic knowledge acquisition" and "precise scenario adaptation" capabilities.

MCP AdvisorMCP Advisor & Installation - Use the right MCP server for your needs

Howtocook Mcp基于Anduin2017 / HowToCook （程序员在家做饭指南）的mcp server，帮你推荐菜谱、规划膳食，解决“今天吃什么“的世纪难题； Based on Anduin2017/HowToCook (Programmer's Guide to Cooking at Home), MCP Server helps you recommend recipes, plan meals, and solve the century old problem of "what to eat today"

Baidu Map百度地图核心API现已全面兼容MCP协议，是国内首家兼容MCP协议的地图服务商。

Y GuiA web-based graphical interface for AI chat interactions with support for multiple AI models and MCP (Model Context Protocol) servers.

WindsurfThe new purpose-built IDE to harness magic

RedisA Model Context Protocol server that provides access to Redis databases. This server enables LLMs to interact with Redis key-value stores through a set of standardized tools.