com.offensive360/o360-mcp (Offensive360 MCP Server)

This Model Context Protocol (MCP) server runs Offensive360 SAST scans on local code through an MCP client. It supports 60+ languages and returns scan findings with file/line context, severity, and suggested fixes. It also reports scan queue status via a separate tool.

🛠️ Key Features

Run Offensive360 SAST scans on a local directory (60+ languages)
Uses taint/data-flow analysis during scanning
Returns findings including file/line, severity, and fixes
Provides scan queue status for running scans

🚀 Use Cases

Scan an existing project directory from within an AI assistant
Use results to locate issues at specific file/line positions
Apply fixes suggested by the scan output

⚡ Developer Benefits

Access two MCP tools: o360_scan_path and o360_scan_status
Enable integration with MCP clients such as Claude Code, Claude Desktop, and Cursor

⚠️ Limitations

Scan execution is queue-based; o360_scan_status is required to check progress.

Offensive360 MCP Server

Run Offensive360 SAST scans from inside your AI assistant. This Model Context Protocol server gives Claude Code, Claude Desktop, Cursor, and any other MCP client two tools:

Tool

What it does

o360_scan_path

Zips a local directory, runs a full SAST scan (60+ languages, taint/data-flow analysis), returns findings with file/line, severity, and fixes

o360_scan_status

Queue position of a running scan

Ask your assistant things like "scan this project with Offensive360 and fix the criticals" — it scans, reads the findings, and starts patching.

Setup

You need an Offensive360 External scan token:

Open-source / public repos: free — request one at offensive360.com/free-for-open-source

Commercial: any admin of your instance can create one under Settings → Tokens

Claude Code

bash

claude mcp add offensive360 \
  -e O360_URL=https://sast.offensive360.com \
  -e O360_TOKEN=<your-token> \
  -- npx -y o360-mcp

Claude Desktop / Cursor (JSON)

json

{
  "mcpServers": {
    "offensive360": {
      "command": "npx",
      "args": ["-y", "o360-mcp"],
      "env": {
        "O360_URL": "https://sast.offensive360.com",
        "O360_TOKEN": "<your-token>"
      }
    }
  }
}

O360_URL can point at your own on-premise or air-gapped instance — the server talks only to the instance you configure.

Notes

Scans are synchronous; typical duration is 1–5 minutes depending on codebase size. The default client timeout is 900s (timeout_seconds parameter to override).

Common junk directories (node_modules, .git, dist, …) are excluded from the upload automatically; add more via the exclude parameter.

Findings are also visible in your Offensive360 dashboard with full data-flow traces.

Requires Node 18+.

Install

Configuration

Environment variables

O360_URLdefault https://sast.offensive360.com

Offensive360 instance base URL

O360_TOKENrequiredsecret

External scan token (free for public repos: https://offensive360.com/free-for-open-source/)

Add to VS Code Add to Cursor

claude_desktop_config.json

json

{
  "mcpServers": {
    "o360-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "o360-mcp@1.0.2"
      ],
      "env": {
        "O360_URL": "https://sast.offensive360.com",
        "O360_TOKEN": "<YOUR_O360_TOKEN>"
      }
    }
  }
}

com.offensive360/o360-mcp