DLP MCP Server
A production-ready Model Context Protocol (MCP) server that connects AI coding assistants to DLP One — enabling real-time security scanning, vulnerability management, and AI-generated remediation directly inside your IDE or AI agent.
Table of Contents
Overview
The DLP Security MCP server bridges your AI assistant (Claude, Cursor, Copilot, etc.) with DLP One's enterprise application security platform. It exposes security workflows as natural-language-accessible MCP tools, allowing developers to scan code, investigate findings, and receive context-aware fixes without leaving their development environment.
Supported scan engines:
- SAST — Static Application Security Testing (30+ languages)
- SCA — Software Composition Analysis (open-source dependencies)
- KICS — Infrastructure as Code security (Terraform, CloudFormation, Kubernetes, Dockerfile)
- Secret Detection — Hardcoded credentials, API keys, tokens
Supported transport protocols
Multi-protocol support to facilitate secure and efficient communication between clients and the server:
stdio: Standard input/output for CLI or embedded agentssse (Server-Sent Events): For real-time streaming to web-based clientshttpstreamableHttp: HTTP-compatible protocol for stream-based messaging
Features
| Category | Capabilities |
|---|
| Scanning | Plan, trigger, and monitor multi-engine security scans (CLI or API mode) |
| Findings | List, filter, and inspect vulnerabilities with severity and state tracking |
| Remediation | AI-generated fixes for code vulnerabilities, insecure packages, and container images |
| Project Management | Create, configure, and search DLP One projects |
| Application Management | Group projects into applications and get org-wide security metrics |
| Analytics | Tenant-wide vulnerability summaries, risk scores, and time-windowed trends |
| Supply Chain | Detect malicious npm/Maven/PyPI/Go/NuGet packages via Dustico integration |
| Enterprise Auth | JWT (JWKS-verified), OAuth2 token exchange, Redis session caching |
| Observability | Structured logging (zerolog), OpenTelemetry tracing |
Authentication
The server uses API Key and OAuth2 authentication.
API Key Authentication
- Clients authenticate to DLP One and get an API key.
- This API key will be used during MCP client configuration, include the API Key in the
Authorization header as mentioned in the MCP Client Configuration section.
OAuth2 Authentication
DLP MCP supports Dynamic Client Registration (DCR) flow allows an AI client (such as Cursor or Claude Desktop) to connect securely.
- User only needs to configure the MCP client as mentioned in the MCP Client Configuration section.
- When the client attempts to connect to the MCP server, it will be redirected to DLP One login page for authentication.
- Once authentication is successful with valid DLP credentials, the MCP client can use the tools provided by the MCP server.
Note: You required valid DLP credentials to get the API Key or connect to the MCP server.
Refer Authentication for detailed authentication instructions and troubleshooting.
MCP Client Configuration
Prerequisites
- A DLP One tenant
- DLP API Host
- API Key (with required access if using API key authentication)
JSON Configuration
Below are examples to add the server to your MCP client configuration. See the examples/ folder for ready-to-use client config files.
Cursor IDE
API Key Authentication:
{
"mcpServers": {
"DLP": {
"url": "https://{api_host}/api/security-mcp/mcp/{tenant}",
"headers": {
"cx-origin": "Curosr",
"Authorization": "API_KEY"
}
}
}
}
OAuth2 Authentication
{
"mcpServers": {
"DLP": {
"url": "https://{api_host}/api/security-mcp/mcp/{tenant}"
}
}
}
Claude Desktop / Claude Code
API Key Authentication:
{
"mcpServers": {
"DLP": {
"type": "http",
"url": "https://{api_host}/api/security-mcp/mcp/{tenant}",
"headers": {
"Authorization": "<API_KEY>"
}
}
}
}
Refer usage for detail information.
Scanning
| Tool | Description |
|---|
planScan | Recommend scan engines based on the project |
triggerScan | Start a scan (CLI for local code, API for repository URL) |
getScanDetails | Get scan status, progress, and severity summary |
getLatestScans | Retrieve recent scans for a project |
listScans | List scans with status, date, and branch filters |
listFindings | List vulnerabilities from a scan with severity filtering |
getFindingDetails | Get detailed information for a specific finding |
Project management
| Tool | Description |
|---|
resolveProject | Look up a project by name |
createProject | Create a new DLP One project |
listProjects | Browse or search all projects |
getProjectConfig | Get full project configuration |
Application management
| Tool | Description |
|---|
listApplications | Browse or search applications |
createApplication | Create a new application |
getApplicationDetails | Get application details by ID |
associateProject | Link projects to an application |
Analytics & risk
| Tool | Description |
|---|
listProjectsOverview | High-level project security status |
getProjectsOverviewAggregate | Organization-wide project metrics |
getApplicationsOverviewAggregate | Organization-wide application metrics |
getTenantVulnerabilitiesSummary | Time-windowed vulnerability analytics |
getRiskSummary | Overall risk assessment |
listRiskResults | Risk findings with filtering |
updateRiskResultStatus | Update finding status (CONFIRMED, URGENT, NOT_EXPLOITABLE, …) |
| Tool | Description |
|---|
codeRemediation | AI-generated fixes for SAST findings, secrets, and IaC misconfigurations |
packageRemediation | Safe upgrade paths for vulnerable open-source packages |
imageRemediation | Secure base image alternatives for vulnerable container images |
License
Apache 2.0 — see LICENSE for details.
Contributing
See CONTRIBUTING.md for development setup, module architecture, and contribution guidelines.
Website: DLP.
© 2026 DLP Ltd. All Rights Reserved.