DevSecOps Stack
Shift security left by integrating vulnerability scanning, code analysis, and container security directly into your development workflow.
Token Budget
Moderate token usage. You will have good room for prompts but watch if adding more servers.
Config
Paste in ~/.claude.json
{
"mcpServers": {
"github-mcp": {
"command": "npx",
"args": [
"-y",
"@modelcontextprotocol/server-github"
],
"env": {
"GITHUB_PERSONAL_ACCESS_TOKEN": "YOUR_GITHUB_PERSONAL_ACCESS_TOKEN"
}
},
"docker-mcp": {
"command": "npx",
"args": [
"-y",
"docker-mcp"
]
},
"sonarqube-mcp": {
"command": "docker",
"args": [
"run",
"--init",
"--pull=always",
"-i",
"--rm",
"mcp/sonarqube"
],
"env": {
"SONARQUBE_TOKEN": "YOUR_SONARQUBE_TOKEN",
"SONARQUBE_URL": "YOUR_SONARQUBE_URL",
"SONARQUBE_ORG": "YOUR_SONARQUBE_ORG"
}
},
"sentry-mcp": {
"command": "npx",
"args": [
"-y",
"sentry-mcp"
],
"env": {
"SENTRY_AUTH_TOKEN": "YOUR_SENTRY_AUTH_TOKEN"
}
},
"semgrep-mcp": {
"command": "uvx",
"args": [
"semgrep-mcp"
]
},
"trivy-mcp": {
"command": "trivy",
"args": [
"mcp"
]
}
}
}Included Servers
Docker MCP
Community
Manage Docker containers, images, volumes, and networks. Run, stop, inspect, and monitor containers from your AI editor.
Build, scan, and manage container images to ensure your deployments start from a secure, reproducible foundation.
GitHub MCP
Anthropic
Access the GitHub API to manage repositories, issues, pull requests, branches, and workflows directly from your AI editor.
Automate security-focused CI/CD pipelines, manage branch protection rules, and enforce code review policies across repositories.
Semgrep MCP
Semgrep
Static analysis security scanning with custom rules, AST analysis, and multi-language vulnerability detection. Official Semgrep implementation.
Run static analysis to catch security vulnerabilities, anti-patterns, and compliance issues directly in your source code.
SonarQube MCP
SonarSource
Code quality analysis, security hotspot detection, and vulnerability tracking from SonarQube Cloud or Server. Official SonarSource implementation.
Continuously inspect code quality and security hotspots, tracking technical debt and vulnerability trends over time.
Trivy MCP
Aqua Security
Container image scanning, filesystem vulnerability detection, and infrastructure misconfiguration analysis. Official Aqua Security implementation.
Scan containers, filesystems, and dependencies for known CVEs so vulnerabilities are caught before they reach production.
Sentry MCP
Sentry
Query Sentry for error tracking, performance monitoring, and issue management directly from your AI editor.
Monitor runtime errors and security-related exceptions in production to detect and respond to incidents quickly.
Recommended Skills
Skills that pair with the servers in this stack. Learn more
For Docker MCP
Multi-stage builds, image optimization, container security, Compose orchestration, and production deployment patterns.
npx skillsadd sickn33/antigravity-awesome-skills/docker-expertCI/CD pipelines, infrastructure automation, containerization, and cloud platform expertise. Pairs with Docker MCP for hands-on container management.
For GitHub MCP
Use gh CLI for all GitHub operations including stacked PR workflows, issue management, and CI/CD automation.
npx skillsadd callstackincubator/agent-skills/githubDebug and fix failing GitHub PR checks in GitHub Actions. Automatically diagnoses CI issues and suggests fixes.
npx skillsadd openai/skills/gh-fix-ciAddress PR review comments using GitHub CLI. Streamlines the code review response workflow.
npx skillsadd openai/skills/gh-address-commentsAutomated code review for TypeScript, JavaScript, Python, Go. Analyzes PRs for complexity, SOLID violations, and code smells.
For Sentry MCP
Read-only observability: list issues, view events, monitor production errors via Sentry API. Includes bundled Python script.
npx skillsadd openai/skills/sentry