The ZeroPath MCP Server bridges the gap between security scanning and the development environment by allowing developers to interact with security findings using natural language. Instead of manually navigating complex dashboards or triaging tickets, teams can now chat directly with their security data within AI-assisted tools. This makes it easy to identify vulnerabilities, understand security risks, and manage patches without ever leaving the code editor. On a technical level, this open-source server provides a direct interface to ZeroPath’s security platform, exposing tools that query Static Application Security Testing (SAST) issues, secrets, and suggested patches. By integrating this server into MCP-compatible environments like Claude Desktop or Cursor, an AI assistant gains the specific ability to search for vulnerabilities via keyword—such as identifying SSRF issues in a particular microservice—and fetch detailed metadata for individual security findings. The real power for developers lies in the seamless workflow for remediation and context-aware debugging. The MCP tools allow the AI to retrieve full code context and patch suggestions, enabling it to explain exactly why a vulnerability exists and how to fix it. Beyond simple querying, the server even supports write actions like approving patches, effectively turning the AI into a security-aware collaborator that helps maintain a secure codebase through real-time, automated interaction.
Category: Developer Tools & Code Intelligence
Tags: remediation, sast, secrets-scanning, vulnerability-management, zeropath
bash export ZEROPATH_TOKEN_ID=your_token_id export ZEROPATH_TOKEN_SECRET=your_token_secret 3. Retrieve Organization ID: Run the following command to find your organization ID: bash curl -X POST https://zeropath.com/api/v1/orgs/list \ -H "X-ZeroPath-API-Token-Id: $ZEROPATH_TOKEN_ID" \ -H "X-ZeroPath-API-Token-Secret: $ZEROPATH_TOKEN_SECRET" \ -H "Content-Type: application/json" \ -d '{}' 4. Install uv: The server uses uv for dependency management: bash curl -LsSf https://astral.sh/uv/install.sh | sh 5. Clone and Setup: bash git clone https://github.com/ZeroPathAI/zeropath-mcp-server.git cd zeropath-mcp-server uv sync export ZEROPATH_ORG_ID=your_org_id<absolute cloned directory path> with the actual absolute path to the repository on your machine. json { "mcpServers": { "zeropath-mcp-server": { "command": "uv", "args": [ "run", "--project", "<absolute cloned directory path>/zeropath-mcp-server", "<absolute cloned directory path>/zeropath-mcp-server/main.py" ], "env": { "ZEROPATH_TOKEN_ID": "your_token_id", "ZEROPATH_TOKEN_SECRET": "your_token_secret", "ZEROPATH_ORG_ID": "your_org_id" } } } }search_vulnerabilities(search_query: str): Query SAST issues by keyword. * get_issue(issue_id: str): Fetch full metadata, patch suggestions, and code context for a specific issue. * approve_patch(issue_id: str): Approve a specific patch (write action).abc123." * "Approve the patch for xyz456."search_vulnerabilities to list the issues, allowing the developer to prioritize them immediately within their coding flow.get_issue, the AI assistant can fetch the full metadata, code context, and suggested patches for a specific vulnerability. The AI can then explain the fix in the context of the existing codebase and even apply the patch. Example: After identifying an issue, the user says: "Give me the details for issue SEC-123 and explain why the suggested patch is necessary." The AI retrieves the context, explains the risk, and asks the user if they want to apply the fix. Once confirmed, the user can say: "Approve the patch for SEC-123," using the approve_patch tool.auth` directory?"* The AI queries ZeroPath and presents a filtered list of relevant findings, enabling a "mini-audit" before new features are deployed.
Part of MCP Servers