# Skyrxin/sast-mcp-server

Source: https://glimind.com/server/awesome%2Fskyrxin%2Fsast-mcp-server
Registry id: `awesome/skyrxin/sast-mcp-server`
Status: unknown

## Tools (25)

- `apply_patch`: Apply an agent-generated unified diff to disk via git apply.
- `comment_on_pr`: Post a security summary on a GitHub PR or GitLab merge request.
- `compare_baseline`: Compare a fresh scan against a saved baseline to highlight new and fixed findings.
- `compliance_report`: Map findings to a compliance framework and report the posture.
- `create_jira_issue`: Open a Jira issue for a finding.
- `evaluate_policy`: Run all scanners and return an explicit PASS/FAIL verdict for CI gating.
- `export_sarif`: Export scan results in SARIF 2.1.0 format for CI/CD integration.
- `export_sbom`: Run all scanners and export an SBOM / vulnerability report.
- `generate_fix_prompt`: Package a cached finding's vulnerable code and context into an LLM-ready prompt.
- `generate_report`: Run all scanners and render an executive security report.
- `ignore_vulnerability`: Suppress a finding from future scans (with audit trail).
- `import_sarif`: Ingest an external SARIF file into the normalized cache.
- `list_ignored_vulnerabilities`: Show all currently suppressed findings for a project.
- `list_scanners`: List available scanners, their installation status, and supported languages.
- `remediate_and_verify`: Closed-loop remediation: dry-run a patch, apply it, re-scan, and confirm the fix.
- `run_active_scan`: Run a dynamic (DAST) baseline scan with OWASP ZAP by orchestrating a Docker Compose stack.
- `save_baseline`: Run a scan and cache the results as a named baseline for future trend comparison.
- `scan_all`: Run ALL installed scanners in parallel with automatic deduplication.
- `scan_git_history`: Scan the entire .git history for leaked secrets and credentials using Gitleaks.
- `scan_image`: Scan a container image reference for vulnerabilities and secrets (Trivy or Grype).
- `scan_vulnerabilities`: Scan a directory for security vulnerabilities using a specific scanner.
- `triage_finding`: Get an exploitability/false-positive assessment prompt, or record a CycloneDX VEX.
- `unignore_vulnerability`: Re-enable a previously suppressed finding.
- `upload_to_defectdojo`: Import a SARIF export into a DefectDojo engagement.
- `upload_to_github`: Upload a SARIF report to GitHub Code Scanning.

Measured by Glimind (https://glimind.com): MCP handshake + tool list only, no tool is ever called. CC BY 4.0.