Security Engineer Stack
Scan code, audit infrastructure, and investigate threats with a comprehensive vulnerability detection and response toolkit.
Token Budget
Moderate token usage. You will have good room for prompts but watch if adding more servers.
Config
Paste in ~/.claude.json
{
"mcpServers": {
"github-mcp": {
"command": "npx",
"args": [
"-y",
"@modelcontextprotocol/server-github"
],
"env": {
"GITHUB_PERSONAL_ACCESS_TOKEN": "YOUR_GITHUB_PERSONAL_ACCESS_TOKEN"
}
},
"docker-mcp": {
"command": "npx",
"args": [
"-y",
"docker-mcp"
]
},
"sonarqube-mcp": {
"command": "docker",
"args": [
"run",
"--init",
"--pull=always",
"-i",
"--rm",
"mcp/sonarqube"
],
"env": {
"SONARQUBE_TOKEN": "YOUR_SONARQUBE_TOKEN",
"SONARQUBE_URL": "YOUR_SONARQUBE_URL",
"SONARQUBE_ORG": "YOUR_SONARQUBE_ORG"
}
},
"virustotal-mcp": {
"command": "npx",
"args": [
"-y",
"@burtthecoder/mcp-virustotal"
],
"env": {
"VIRUSTOTAL_API_KEY": "YOUR_VIRUSTOTAL_API_KEY"
}
},
"semgrep-mcp": {
"command": "uvx",
"args": [
"semgrep-mcp"
]
},
"shodan-mcp": {
"command": "npx",
"args": [
"-y",
"@burtthecoder/mcp-shodan"
],
"env": {
"SHODAN_API_KEY": "YOUR_SHODAN_API_KEY"
}
},
"trivy-mcp": {
"command": "trivy",
"args": [
"mcp"
]
}
}
}Included Servers
Semgrep MCP
Semgrep
Static analysis security scanning with custom rules, AST analysis, and multi-language vulnerability detection. Official Semgrep implementation.
Runs static analysis rules to catch security vulnerabilities and dangerous code patterns before they reach production.
SonarQube MCP
SonarSource
Code quality analysis, security hotspot detection, and vulnerability tracking from SonarQube Cloud or Server. Official SonarSource implementation.
Provides continuous code quality and security scanning with detailed remediation guidance for your development team.
Trivy MCP
Aqua Security
Container image scanning, filesystem vulnerability detection, and infrastructure misconfiguration analysis. Official Aqua Security implementation.
Scans container images and infrastructure configs for known CVEs and misconfigurations in your deployment pipeline.
Shodan MCP
BurtTheCoder
Internet-connected device search, IP reconnaissance, CVE lookups, and DNS intelligence via the Shodan API.
Discovers exposed services and open ports across your external attack surface before adversaries do.
VirusTotal MCP
BurtTheCoder
Malware detection, file and URL analysis, IP and domain reputation checks, and threat relationship mapping via the VirusTotal API.
Analyzes suspicious files, URLs, and hashes against dozens of antivirus engines during incident investigation.
GitHub MCP
Anthropic
Access the GitHub API to manage repositories, issues, pull requests, branches, and workflows directly from your AI editor.
Reviews pull requests for security issues and manages security advisories across your organization's repositories.
Docker MCP
Community
Manage Docker containers, images, volumes, and networks. Run, stop, inspect, and monitor containers from your AI editor.
Audits container configurations and base images to enforce security policies in your build pipeline.
Recommended Skills
Skills that pair with the servers in this stack. Learn more
For GitHub MCP
Use gh CLI for all GitHub operations including stacked PR workflows, issue management, and CI/CD automation.
npx skillsadd callstackincubator/agent-skills/githubDebug and fix failing GitHub PR checks in GitHub Actions. Automatically diagnoses CI issues and suggests fixes.
npx skillsadd openai/skills/gh-fix-ciAddress PR review comments using GitHub CLI. Streamlines the code review response workflow.
npx skillsadd openai/skills/gh-address-commentsAutomated code review for TypeScript, JavaScript, Python, Go. Analyzes PRs for complexity, SOLID violations, and code smells.
For Docker MCP
Multi-stage builds, image optimization, container security, Compose orchestration, and production deployment patterns.
npx skillsadd sickn33/antigravity-awesome-skills/docker-expertCI/CD pipelines, infrastructure automation, containerization, and cloud platform expertise. Pairs with Docker MCP for hands-on container management.