About o360-mcp
o360-mcp lets MCP clients run Offensive360 SAST scans on local code and retrieve findings with locations, severity, and fixes. It supports scans across 60+ languages and can target a configured on-premise or air-gapped instance.
Key features
- 01Local directory SAST scans
- 02Analysis across 60+ languages
- 03Taint and data-flow analysis
- 04Findings with file, line, and severity
- 05Scan queue status
Use cases
- 01Scan a codebase from an AI assistant
- 02Locate and prioritize security findings
- 03Check the queue position of a scan
- 04Run scans against an on-premise instance
MCP support
Exposes `o360_scan_path` and `o360_scan_status` to MCP clients. The server uses the configured Offensive360 URL and external scan token.
Configuration
Local server config is the same for every client. Copy it into your client’s MCP config file.
npx -y o360-mcpO360_URLOffensive360 instance base URLO360_TOKENSecretExternal scan token (free for public repos: https://offensive360.com/free-for-open-source/)Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.
Tools
2Saved tool list · updated 2w ago
| Parameter | Type | Required | Description |
|---|---|---|---|
| path | string | Yes | Absolute path of the directory to scan |
| exclude | array | No | Extra directory names to exclude from the upload |
| project_name | string | No | Project name in the Offensive360 dashboard (default: directory name) |
| timeout_seconds | integer | No | Max seconds to wait (default 900) |
Details
From the project READMEOffensive360 MCP Server
Run Offensive360 SAST scans from inside your AI assistant. This Model Context Protocol server gives Claude Code, Claude Desktop, Cursor, and any other MCP client two tools:
| Tool | What it does |
|---|---|
o360_scan_path | Zips a local directory, runs a full SAST scan (60+ languages, taint/data-flow analysis), returns findings with file/line, severity, and fixes |
o360_scan_status | Queue position of a running scan |
Ask your assistant things like "scan this project with Offensive360 and fix the criticals" — it scans, reads the findings, and starts patching.
Setup
You need an Offensive360 External scan token:
- Open-source / public repos: free — request one at offensive360.com/free-for-open-source
- Commercial: any admin of your instance can create one under Settings → Tokens
Claude Code
claude mcp add offensive360 \
-e O360_URL=https://sast.offensive360.com \
-e O360_TOKEN=<your-token> \
-- npx -y o360-mcp
Claude Desktop / Cursor (JSON)
{
"mcpServers": {
"offensive360": {
"command": "npx",
"args": ["-y", "o360-mcp"],
"env": {
"O360_URL": "https://sast.offensive360.com",
"O360_TOKEN": "<your-token>"
}
}
}
}
O360_URL can point at your own on-premise or air-gapped instance — the server
talks only to the instance you configure.
Notes
- Scans are synchronous; typical duration is 1–5 minutes depending on codebase size.
The default client timeout is 900s (
timeout_secondsparameter to override). - Common junk directories (
node_modules,.git,dist, …) are excluded from the upload automatically; add more via theexcludeparameter. - Findings are also visible in your Offensive360 dashboard with full data-flow traces.
- Requires Node 18+.
About Offensive360
One platform for SAST, DAST, MAST, SCA, malware & binary analysis, and license compliance — flat pricing, cloud or fully air-gapped on-premise. offensive360.com · Book a demo
Comments
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.