Install SAST in Claude Code
claude mcp add sast -- uvx sast-mcp-server{
"mcpServers": {
"sast": {
"command": "uvx",
"args": [
"sast-mcp-server"
]
}
}
}Frequently asked questions
What does the SAST MCP server do?
SAST/DAST scanners (Bandit, Semgrep, Trivy, CodeQL, OWASP ZAP and more) with closed-loop remediation, SARIF/SBOM/VEX export and compliance reporting.
Is the SAST MCP server free?
Yes, most likely. Open source and no paid account or API key is mentioned in the listing. Check the provider for current pricing.
Does SAST run locally or remotely?
Local. Runs on your machine (stdio). You install it with npx, uvx, Docker or from source.
How do I add SAST to Claude Code?
Run: claude mcp add sast -- uvx sast-mcp-server
More security & identity MCP servers
View allScreenVerity
williamblakecunningham-max/screenverity-mcp
U.S. exclusion, debarment and license screening (OIG LEIE, SAM.gov, state boards) with an Ed25519-signed receipt of the exact list snapshots checked.
SafeNode MCP Gateway
sp3ak/safenode-mcp-gateway
Fail-closed policy proxy for MCP tool calls that denies, warns on or holds each call for human approval before forwarding, with client-side redaction.
1Claw Vault
1clawAI/1claw-mcp
HSM-backed vault secrets for AI agents (JIT fetch) plus prompt-injection and threat scanning.
qURL
layervai/qurl-mcp
Mint, resolve, audit and rotate expiring, scope-limited access links (qURLs) via the qURL API.
Aegis Protocol
im-sham/aegis-protocol
Trustless escrow for AI agent-to-agent transactions on Base L2 with ERC-8004 identity and USDC.
Guardian
rudraneel93/mcp-guardian
Security and governance proxy for MCP with YAML policies (blocklists, rate limits, token budgets), token cost tracking, health monitoring and RBAC.