StackMCP

Security Engineer Stack for Claude Code

Advanced7 servers37.5K tokens

Configuration

{
  "mcpServers": {
    "semgrep-mcp": {
      "command": "uvx",
      "args": [
        "semgrep-mcp"
      ]
    },
    "sonarqube-mcp": {
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "-i",
        "--rm",
        "mcp/sonarqube"
      ],
      "env": {
        "SONARQUBE_TOKEN": "YOUR_SONARQUBE_TOKEN",
        "SONARQUBE_URL": "YOUR_SONARQUBE_URL",
        "SONARQUBE_ORG": "YOUR_SONARQUBE_ORG"
      }
    },
    "trivy-mcp": {
      "command": "trivy",
      "args": [
        "mcp"
      ]
    },
    "shodan-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@burtthecoder/mcp-shodan"
      ],
      "env": {
        "SHODAN_API_KEY": "YOUR_SHODAN_API_KEY"
      }
    },
    "virustotal-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@burtthecoder/mcp-virustotal"
      ],
      "env": {
        "VIRUSTOTAL_API_KEY": "YOUR_VIRUSTOTAL_API_KEY"
      }
    },
    "github-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-github"
      ],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "YOUR_GITHUB_PERSONAL_ACCESS_TOKEN"
      }
    },
    "docker-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "docker-mcp"
      ]
    }
  }
}

CLI Commands

Alternatively, add each server via the Claude Code CLI:

claude mcp add semgrep-mcp -- uvx semgrep-mcp
claude mcp add sonarqube-mcp -e SONARQUBE_TOKEN=YOUR_SONARQUBE_TOKEN -e SONARQUBE_URL=YOUR_SONARQUBE_URL -e SONARQUBE_ORG=YOUR_SONARQUBE_ORG -- docker run --init --pull=always -i --rm mcp/sonarqube
claude mcp add trivy-mcp -- trivy mcp
claude mcp add shodan-mcp -e SHODAN_API_KEY=YOUR_SHODAN_API_KEY -- npx -y @burtthecoder/mcp-shodan
claude mcp add virustotal-mcp -e VIRUSTOTAL_API_KEY=YOUR_VIRUSTOTAL_API_KEY -- npx -y @burtthecoder/mcp-virustotal
claude mcp add github-mcp -e GITHUB_PERSONAL_ACCESS_TOKEN=YOUR_GITHUB_PERSONAL_ACCESS_TOKEN -- npx -y @modelcontextprotocol/server-github
claude mcp add docker-mcp -- npx -y docker-mcp

Where to save

Paste the config above into:

~/.claude.json

Environment Variables

Replace the YOUR_ placeholders with your actual values.

SONARQUBE_TOKENrequired

SonarQube authentication token

Used by: SonarQube MCP

SONARQUBE_URL

SonarQube Server URL (omit for SonarQube Cloud)

Used by: SonarQube MCP

SONARQUBE_ORG

SonarQube Cloud organization key

Used by: SonarQube MCP

SHODAN_API_KEYrequired

Shodan API key

Used by: Shodan MCP

VIRUSTOTAL_API_KEYrequired

VirusTotal API key

Used by: VirusTotal MCP

GITHUB_PERSONAL_ACCESS_TOKENrequired

GitHub personal access token

Used by: GitHub MCP

What’s in this stack

Semgrep MCP7 tools

Static analysis security scanning with custom rules, AST analysis, and multi-language vulnerability detection. Official Semgrep implementation.

Runs static analysis rules to catch security vulnerabilities and dangerous code patterns before they reach production.

SonarQube MCP13 tools

Code quality analysis, security hotspot detection, and vulnerability tracking from SonarQube Cloud or Server. Official SonarSource implementation.

Provides continuous code quality and security scanning with detailed remediation guidance for your development team.

Trivy MCP5 tools

Container image scanning, filesystem vulnerability detection, and infrastructure misconfiguration analysis. Official Aqua Security implementation.

Scans container images and infrastructure configs for known CVEs and misconfigurations in your deployment pipeline.

Shodan MCP7 tools

Internet-connected device search, IP reconnaissance, CVE lookups, and DNS intelligence via the Shodan API.

Discovers exposed services and open ports across your external attack surface before adversaries do.

VirusTotal MCP8 tools

Malware detection, file and URL analysis, IP and domain reputation checks, and threat relationship mapping via the VirusTotal API.

Analyzes suspicious files, URLs, and hashes against dozens of antivirus engines during incident investigation.

GitHub MCP20 tools

Access the GitHub API to manage repositories, issues, pull requests, branches, and workflows directly from your AI editor.

Reviews pull requests for security issues and manages security advisories across your organization's repositories.

Docker MCP14 tools

Manage Docker containers, images, volumes, and networks. Run, stop, inspect, and monitor containers from your AI editor.

Audits container configurations and base images to enforce security policies in your build pipeline.

Other editors

CursorVS CodeWindsurfClaude DesktopContinue