Contrast Security MCP Server for Vulnerability Remediation

Overview

The Contrast Security MCP Server for Vulnerability Remediation lets you surface Contrast application security findings (vulnerabilities and SCA results) as Model Context Protocol (MCP) resources that a coding agent or LLM-based assistant can consume. Instead of embedding raw scan results in prompts, an MCP-compliant server packages targeted, pre-filtered contextual data—vulnerability details, evidence, and suggested remediation—so agents can produce precise, actionable fixes and patch suggestions.

This server is useful when you want automated code suggestions, PR comments, or pre-merge checks that directly reference Contrast findings. By converting Contrast API data into an MCP context feed, you reduce noise, protect sensitive data (by returning only what’s necessary), and accelerate remediation workflows inside IDE assistants or CI-integrated bots.

Features

• Exposes Contrast vulnerability and SCA findings as MCP-style context resources
• Filters and formats findings to include only relevant evidence (stack traces, vulnerable code snippets, dependency info)
• Supports credentialed access to Contrast APIs (API key/credentials configuration)
• Caching and rate-limit handling to avoid repeated heavy API calls
• Endpoint(s) designed for easy integration with code assistants, CI bots, and PR automation
• Configurable scoping (applications, severity, CWE, CVE, or time ranges)

Installation / Configuration

These instructions assume you have the repository locally. The server can be run via Docker (recommended) or from source.

1. Clone the repo:

git clone https://github.com/Contrast-Security-OSS/mcp-contrast.git
cd mcp-contrast

2a. Run with Docker (example)

# build image (if Dockerfile provided)
docker build -t mcp-contrast .

# run with environment variables
docker run --rm -p 8080:8080 \
  -e CONTRAST_API_KEY=your_api_key \
  -e CONTRAST_SERVICE_KEY=your_service_key \
  -e CONTRAST_URL=https://app.contrastsecurity.com \
  -e MCP_PORT=8080 \
  mcp-contrast

2b. Run locally (example; actual command may vary depending on language/build system)

# If the project uses Maven/Gradle/Node, build first, then run:
./gradlew bootRun                # Java/Gradle example
# or
npm install && npm start         # Node example

3. Example .env / config file

# Contrast API credentials and server options
CONTRAST_URL=https://app.contrastsecurity.com
CONTRAST_API_KEY=org_api_key_here
CONTRAST_SERVICE_KEY=org_service_key_here
CONTRAST_ACCOUNT_ID=12345
MCP_PORT=8080
CACHE_TTL_SECONDS=300

Environment variables and exact names may vary; consult the repository code or configuration files for exact keys.

Common configuration options (table)

Available Resources

The server typically exposes the following resource types (paths may vary by implementation):

• GET /mcp/manifest — Returns MCP manifest describing available context types
• POST /mcp/context — Accepts a context request from an agent and returns relevant findings
• GET /mcp/vulnerabilities?appId=… — Filtered list of vulnerability summaries
• GET /mcp/sca?appId=… — SCA/dependency findings for an application

Example request to request contextual data (agent -> server):

POST /mcp/context HTTP/1.1
Content-Type: application/json

{
  "request_id": "req-123",
  "target": {
    "repository": "acme/service",
    "file_path": "src/main/java/com/acme/PaymentService.java",
    "line": 128
  },
  "constraints": {
    "severities": ["HIGH","CRITICAL"],
    "max_results": 10
  }
}

Example response (server -> agent):

{
  "request_id": "req-123",
  "context": {
    "vulnerabilities": [
      {
        "id": "VULN-9876",
        "title": "SQL Injection",
        "severity": "HIGH",
        "evidence": [
          {"type": "stack", "value": "com.acme.PaymentService:executeQuery(...)"},
          {"type": "source_snippet", "value": "String sql = \"select * from accounts where id=\" + id;"}
        ],
        "remediation": "Use parameterized queries (PreparedStatement) and input validation. See example..."
      }
    ],
    "sca": [
      {
        "dependency": "commons-fileupload",
        "current_version": "1.2",
        "fixed_in": "1.3.3",
        "cve": "CVE-YYYY-XXXX"
      }
    ]
  }
}

Use Cases

• Agent-assisted code fixes: An LLM coding assistant requests context for a file/line: the MCP server returns the specific Contrast finding and evidence, enabling the assistant to generate a minimal, correct patch (e.g., parameterize a query or sanitize input).
• PR automation: A CI bot queries the MCP server to list vulnerabilities touched by a pull request and