dlp-mcp

DLP MCP Server

A production-ready Model Context Protocol (MCP) server that connects AI coding assistants to DLP One — enabling real-time security scanning, vulnerability management, and AI-generated remediation directly inside your IDE or AI agent.

Table of Contents

• Overview
  • Supported scan engines
  • Supported transport protocols
• Features
• Authentication
  • API Key Authentication
  • OAuth2 Authentication
• MCP Client Configuration
  • Prerequisites
  • JSON Configuration
    • Windsurf IDE
    • IntelliJ IDEA - GitHub Copilot
    • Claude Desktop / Claude Code
• Available Tools
  • Scanning
  • Project management
  • Application management
  • Analytics & risk
  • Remediation

Overview

The DLP Security MCP server bridges your AI assistant (Claude, Cursor, Copilot, etc.) with DLP One's enterprise application security platform. It exposes security workflows as natural-language-accessible MCP tools, allowing developers to scan code, investigate findings, and receive context-aware fixes without leaving their development environment.

Supported scan engines:

• SAST — Static Application Security Testing (30+ languages)
• SCA — Software Composition Analysis (open-source dependencies)
• KICS — Infrastructure as Code security (Terraform, CloudFormation, Kubernetes, Dockerfile)
• Secret Detection — Hardcoded credentials, API keys, tokens

Supported transport protocols

Multi-protocol support to facilitate secure and efficient communication between clients and the server:

• stdio: Standard input/output for CLI or embedded agents
• sse (Server-Sent Events): For real-time streaming to web-based clients
• httpstreamableHttp: HTTP-compatible protocol for stream-based messaging

Features

Category	Capabilities
Scanning	Plan, trigger, and monitor multi-engine security scans (CLI or API mode)
Findings	List, filter, and inspect vulnerabilities with severity and state tracking
Remediation	AI-generated fixes for code vulnerabilities, insecure packages, and container images
Project Management	Create, configure, and search DLP One projects
Application Management	Group projects into applications and get org-wide security metrics
Analytics	Tenant-wide vulnerability summaries, risk scores, and time-windowed trends
Supply Chain	Detect malicious npm/Maven/PyPI/Go/NuGet packages via Dustico integration
Enterprise Auth	JWT (JWKS-verified), OAuth2 token exchange, Redis session caching
Observability	Structured logging (zerolog), OpenTelemetry tracing

Authentication

The server uses API Key and OAuth2 authentication.

API Key Authentication

1. Clients authenticate to DLP One and get an API key.
2. This API key will be used during MCP client configuration, include the API Key in the Authorization header as mentioned in the MCP Client Configuration section.

OAuth2 Authentication

DLP MCP supports Dynamic Client Registration (DCR) flow allows an AI client (such as Cursor or Claude Desktop) to connect securely.

1. User only needs to configure the MCP client as mentioned in the MCP Client Configuration section.
2. When the client attempts to connect to the MCP server, it will be redirected to DLP One login page for authentication.
3. Once authentication is successful with valid DLP credentials, the MCP client can use the tools provided by the MCP server.

Note: You required valid DLP credentials to get the API Key or connect to the MCP server.

Refer Authentication for detailed authentication instructions and troubleshooting.

MCP Client Configuration

Prerequisites

• A DLP One tenant
• DLP API Host
• API Key (with required access if using API key authentication)

JSON Configuration

Below are examples to add the server to your MCP client configuration. See the examples/ folder for ready-to-use client config files.

Cursor IDE

API Key Authentication:

{
  "mcpServers": {
    "DLP": {
      "url": "https://{api_host}/api/security-mcp/mcp/{tenant}",
      "headers": {
        "cx-origin": "Curosr",
        "Authorization": "API_KEY"
      }
    }
  }
}

OAuth2 Authentication

{
  "mcpServers": {
    "DLP": {
      "url": "https://{api_host}/api/security-mcp/mcp/{tenant}"
    }
  }
}

Claude Desktop / Claude Code

API Key Authentication:

{
  "mcpServers": {
    "DLP": {
      "type": "http",
      "url": "https://{api_host}/api/security-mcp/mcp/{tenant}",
      "headers": {
        "Authorization": "<API_KEY>"
      }
    }
  }
}

Available Tools

Refer usage for detail information.

Scanning

Tool	Description
planScan	Recommend scan engines based on the project
triggerScan	Start a scan (CLI for local code, API for repository URL)
getScanDetails	Get scan status, progress, and severity summary
getLatestScans	Retrieve recent scans for a project
listScans	List scans with status, date, and branch filters
listFindings	List vulnerabilities from a scan with severity filtering
getFindingDetails	Get detailed information for a specific finding

Project management

Tool	Description
resolveProject	Look up a project by name
createProject	Create a new DLP One project
listProjects	Browse or search all projects
getProjectConfig	Get full project configuration

Application management

Tool	Description
listApplications	Browse or search applications
createApplication	Create a new application
getApplicationDetails	Get application details by ID
associateProject	Link projects to an application

Analytics & risk

Tool	Description
listProjectsOverview	High-level project security status
getProjectsOverviewAggregate	Organization-wide project metrics
getApplicationsOverviewAggregate	Organization-wide application metrics
getTenantVulnerabilitiesSummary	Time-windowed vulnerability analytics
getRiskSummary	Overall risk assessment
listRiskResults	Risk findings with filtering
updateRiskResultStatus	Update finding status (CONFIRMED, URGENT, NOT_EXPLOITABLE, …)

Remediation

Tool	Description
codeRemediation	AI-generated fixes for SAST findings, secrets, and IaC misconfigurations
packageRemediation	Safe upgrade paths for vulnerable open-source packages
imageRemediation	Secure base image alternatives for vulnerable container images

License

Apache 2.0 — see LICENSE for details.

Contributing

See CONTRIBUTING.md for development setup, module architecture, and contribution guidelines.

Website: DLP.

© 2026 DLP Ltd. All Rights Reserved.