Cybersecurity Stack
SAST scanning, container security, threat intelligence, and malware analysis. Semgrep, SonarQube, Trivy, Shodan, and VirusTotal in one config.
Token Budget
Moderate token usage. You will have good room for prompts but watch if adding more servers.
Config
Paste in ~/.claude.json
{
"mcpServers": {
"sonarqube-mcp": {
"command": "docker",
"args": [
"run",
"--init",
"--pull=always",
"-i",
"--rm",
"mcp/sonarqube"
],
"env": {
"SONARQUBE_TOKEN": "YOUR_SONARQUBE_TOKEN",
"SONARQUBE_URL": "YOUR_SONARQUBE_URL",
"SONARQUBE_ORG": "YOUR_SONARQUBE_ORG"
}
},
"virustotal-mcp": {
"command": "npx",
"args": [
"-y",
"@burtthecoder/mcp-virustotal"
],
"env": {
"VIRUSTOTAL_API_KEY": "YOUR_VIRUSTOTAL_API_KEY"
}
},
"semgrep-mcp": {
"command": "uvx",
"args": [
"semgrep-mcp"
]
},
"shodan-mcp": {
"command": "npx",
"args": [
"-y",
"@burtthecoder/mcp-shodan"
],
"env": {
"SHODAN_API_KEY": "YOUR_SHODAN_API_KEY"
}
},
"trivy-mcp": {
"command": "trivy",
"args": [
"mcp"
]
}
}
}Included Servers
Semgrep MCP
Semgrep
Static analysis security scanning with custom rules, AST analysis, and multi-language vulnerability detection. Official Semgrep implementation.
Your first line of defense. Scan code for vulnerabilities with 2,000+ built-in rules or write custom ones. Catches SQL injection, XSS, and hardcoded secrets before they ship.
SonarQube MCP
SonarSource
Code quality analysis, security hotspot detection, and vulnerability tracking from SonarQube Cloud or Server. Official SonarSource implementation.
Continuous code quality and security analysis. Track security hotspots, review vulnerability trends, and enforce quality gates across your projects.
Trivy MCP
Aqua Security
Container image scanning, filesystem vulnerability detection, and infrastructure misconfiguration analysis. Official Aqua Security implementation.
Scan container images and filesystems for CVEs before deployment. Catches vulnerable dependencies in Docker images and IaC misconfigurations in Terraform/CloudFormation.
Shodan MCP
BurtTheCoder
Internet-connected device search, IP reconnaissance, CVE lookups, and DNS intelligence via the Shodan API.
Reconnaissance and attack surface monitoring. Look up exposed services, check IP reputation, and search for CVEs affecting your infrastructure.
VirusTotal MCP
BurtTheCoder
Malware detection, file and URL analysis, IP and domain reputation checks, and threat relationship mapping via the VirusTotal API.
Analyze suspicious files, URLs, IPs, and domains against 70+ antivirus engines. Map threat relationships to understand attack vectors and indicators of compromise.