Sentrasec MCP

Give your coding agent security scans, finding explanations and remediation plans, without leaving the editor.

Version 0.5.1Released October 19, 2026Transport stdio

The Sentrasec MCP server lets AI coding agents work with your security data through the Model Context Protocol. Your agent can run scans, read and explain findings, list rules, and fetch the remediation plan and test plan for a finding. The agent makes the code change and runs the tests. Sentrasec plans the fix; it does not edit your code.

It ships inside the sentrasec binary, so there is nothing extra to install.

Install

The MCP server is part of the Sentrasec CLI. Install it once. It runs on macOS, Linux and Windows, on x64 and arm64.

macOS / Linux (Terminal)

$ curl -fsSL https://cli.sentrasec.ai/install.sh | bash

Windows (PowerShell)

$ irm https://cli.sentrasec.ai/install.ps1 | iex

On Windows, open a new terminal afterwards so the updated PATH is picked up. Then confirm it works:

$ sentrasec --version

PATH steps, version pinning and uninstalling are in the CLI installation guide.

How clients run it

MCP clients launch the server over stdio with this command. You rarely run it by hand:

$ sentrasec mcp serve

In client configuration that is { "command": "sentrasec", "args": ["mcp", "serve"] }. To get that block with the full path to the binary filled in, which desktop apps need when they do not see your shell's PATH, run:

$ sentrasec mcp config

Connect your client

Pick your tool for a configuration you can copy:

Claude Code, added with a single command
Cursor, added to ~/.cursor/mcp.json
Claude Desktop, added to the desktop config
VS Code, added to .vscode/mcp.json

Set an app id and app key first, so the server knows what to scan and who is scanning, then see the available tools.

The server runs locally over stdio and opens no network port. security.scan uploads the code to your workspace and scans it there. security.scan_local scans in-process and sends nothing.

Looking for MCP config scanning instead?

This site is about Sentrasec acting as an MCP server for your agent. If you want Sentrasec to scan a repo's own mcp.json / agent-framework configs for risk — untrusted servers, secrets in env blocks, unpinned versions, excessive tool scope — that is a different, unrelated command, sentrasec mcp-scan, documented on the CLI site.