Overview

Cycode MCP Server is a lightweight, local server that exposes code-security scans (SAST, SCA, Secrets, and IaC) via the Model Context Protocol (MCP). It centralizes multiple static-analysis and inventory tools under a single API so developer tools and language models can request contextual security findings about a codebase in a consistent format. The server is useful for integrating security scans into IDE assistants, chat-based code reviewers, and automated CI gates where an LLM or tool consumes scan output as structured context.

The server is designed to be run locally, in CI, or as a self-hosted service. It orchestrates individual scanner executables (for example, semgrep, tfsec, checkov, detect-secrets, or OSS/SCA tools) and normalizes their results into MCP-compatible responses. That normalization lets downstream consumers easily present, correlate, and act on findings without parsing a dozen different output formats.

Features

Unified API that normalizes results from multiple scanners into a single MCP response schema
Support for common classes of analysis:
- SAST (source code analysis)
- SCA (software composition / dependency analysis)
- Secrets detection (hard-coded credentials, tokens)
- IaC (infrastructure-as-code) checks
Pluggable scanner adapters — run native scanners, wrapper scripts, or custom analyzers
Local and CI-friendly operation (CLI, Docker, or binary)
JSON result format with standardized fields (file, line, severity, rule id, scanner)
Optional caching, rate limiting, and basic metrics endpoints
Integrates easily with LLM-based assistants or CI pipelines that consume MCP

Installation / Configuration

Below are example ways to run a Cycode MCP Server locally or in CI. Replace placeholders with your organization-specific values.

Run via Docker (example)

docker run -d \
  --name cycode-mcp \
  -p 8080:8080 \
  -v /path/to/repo:/workspace:ro \
  -v /path/to/mcp-config.yml:/etc/mcp/config.yml:ro \
  cycode/mcp-server:latest

Run via a local binary (example)

# Download the binary (example URL)
curl -L -o cycode-mcp https://example.com/cycode-mcp-linux
chmod +x cycode-mcp

# Start server with config
./cycode-mcp --config ./mcp-config.yml --port 8080

Minimal MCP config (mcp-config.yml)

server:
  host: 0.0.0.0
  port: 8080

workspace:
  path: /workspace
  read_only: true

scanners:
  sast:
    - name: semgrep
      cmd: ["semgrep", "--config", "/rules/semgrep-rules.yml", "-j"]
  secrets:
    - name: detect-secrets
      cmd: ["detect-secrets", "scan", "--all-files", "--json"]
  iac:
    - name: tfsec
      cmd: ["tfsec", "--format", "json"]
  sca:
    - name: oss-audit
      cmd: ["oss-audit", "--format", "json"]

outputs:
  cache_enabled: true
  cache_ttl_seconds: 3600

Start the server using cycode-cli (experimental)

# If you have the cycode CLI installed:
cycode mcp start --config ./mcp-config.yml --port 8080

Available Resources

API endpoints (examples)
- POST /mcp/v1/scan — run requested scans and return MCP-formatted results
- GET /mcp/v1/scan/{id} — retrieve previous scan results
- GET /metrics — Prometheus-style metrics (optional)
- GET /healthz — basic health check
Supported scanners (commonly integrated adapters)
- SAST: semgrep, custom linters
- IaC: tfsec, checkov, cfn-lint
- Secrets: detect-secrets, truffleHog, git-secrets
- SCA: OSV/OSS advisory tools, dependency auditors (Adapters are configurable — you can add wrapper scripts for other tools.)
Logging and outputs
- Structured JSON output that includes: scanner, rule_id, severity, file_path, start_line, end_line, message, fixed_in (if available)
- Optionally persist scan outputs to disk or object storage for later retrieval

Example API usage

Request a scan (curl)

curl -X POST "http://localhost:8080/mcp/v1/scan" \
  -H "Content-Type: application/json" \
  -d '{
    "workspace": "/workspace",
    "tools": ["sast", "secrets", "iac"],
    "paths": ["src/", "infrastructure/"],
    "options": {"max_findings": 200}
  }'

Sample normalized response (truncated)

{
  "scan_id": "1234abcd",
  "status": "completed",
  "findings": [
    {
      "scanner": "semgrep",
      "rule_id": "SEC001",
      "severity": "HIGH",
      "file": "src/auth.py",
      "start_line": 42,
      "end_line": 42,
      "message": "Use of hard-coded password",
      "metadata": {"confidence": "HIGH"}
    }
  ]
}

Use Cases

CI gating and pull request checks
- Trigger an MCP scan in your pipeline to block PRs when high-severity SAST/IaC issues are found. The normalized output simplifies creating PR comments or annotations.
IDE and assistant integrations
- An LLM-based assistant can call the MCP server to fetch recent scan results for the file under edit, present findings inline, and propose fixes referencing the scanner rule IDs.
Pre-commit or local developer scans
- Run a quick MCP scan locally to discover hard-coded secrets or insecure IaC patterns before pushing changes.
Consolidated security dashboards
- Periodically run scheduled MCP scans, store normalized results in a database, and drive dashboards and trend analysis without writing custom parsers for each scanner.

Tips and Best Practices

Start with read-only workspace mounts in CI

Cycode MCP Server: SAST, SCA, Secrets, IaC