TL;DR
SAST on Every Commit is a security workflow that chains GitHub + SonarQube to automate a common task. Static application security testing runs on every commit. Critical vulnerabilities block the pipeline and page the security team. Once configured, it runs through Claude Code, Cursor, Windsurf or any MCP-compatible AI agent.
SAST on Every Commit
Static application security testing runs on every commit. Critical vulnerabilities block the pipeline and page the security team.
How it works
Partial support — 1 of 2 MCPs hostable
Hosted execution needs every MCP on the whitelist. Use the local CLI for this recipe until the missing MCPs are added.
Not yet hostable:
mcpizy recipe install github-sonarqube-sastWhy this combo?
SonarQube knows the OWASP vulnerability patterns and can scan code statically at high accuracy; GitHub provides the commit trigger and the merge gate. Together they make security a continuous, automated process rather than a periodic manual audit — catching vulnerabilities when they're cheapest to fix.
Without this workflow
Security audit happens quarterly. Vulnerabilities introduced months ago discovered during the audit. Expensive to fix, potentially already exploited.
With MCPizy
Every commit scanned. Critical vuln blocks the PR. Developer fixes it while the code is still fresh in their head. Zero drift.
Business value
Concrete ROI — not marketing fluff.
Time saved
- Shifts security left: developers learn OWASP patterns from PR comments instead of annual training
- Makes SOC2/ISO27001 audits painless — continuous SAST evidence is already collected, no audit sprint
Workflow steps
- 1Commit pushed — trigger SAST scan
- 2Analyze code for OWASP Top 10 patterns
- 3Check for secrets and credentials in diff
- 4Block PR if critical vulnerability found
- 5Create GitHub issue and notify security team
Use cases
- Block merges containing OWASP Top 10 vulnerabilities automatically
- Catch hardcoded secrets and credentials before they reach the repo
- Create GitHub issues for vulnerabilities that need tracking across sprints
- Trend vulnerability count over time to measure security program effectiveness
Agent prompt (copy into Claude Code)
This prompt is the workflow. Paste into Claude Code, Cursor, or Windsurf.
You are a SAST agent. Runs on every commit pushed to any branch. On push event: 1. Call github.get_diff(before_sha, after_sha) to extract changed files 2. Call sonarqube.scan(project_key, sources=changed_files, branch=ref) — use pull-request mode if PR context 3. Poll sonarqube.get_issues(component=project, types=["VULNERABILITY","SECURITY_HOTSPOT"], severities=["CRITICAL","BLOCKER"]) 4. Also run secret scanning: call sonarqube.scan with secretsEnabled=true (or gitleaks fallback) 5. For each critical finding: - Call github.create_review_comment on exact file:line with the rule description + remediation - Call github.create_issue with label "security" if it's on main branch 6. Call github.create_status(context="sast", state=critical_count === 0 ? "success" : "failure") 7. If secrets detected, also page security team via pagerduty/slack immediately — never ignore secret leaks Strictly block merge on any critical finding. Warning-level findings are comments only.
Trigger & credentials
How this workflow fires and what env vars you need.
POST /webhook/github (events: push, pull_request)
One-command deploy
Install everything — MCPs, prompt, env template — in a single call.
$ mcpizy recipe install github-sonarqube-sast ✓ Installs all 2 MCP servers ✓ Writes prompt to ~/.mcpizy/prompts/github-sonarqube-sast.md ✓ Generates .env.example in current directory ✓ Ready to paste into Claude Code
Requires mcpizy CLI v1.1+ — install via npm i -g mcpizy.
Quick install (MCPs only)
$ mcpizy install github && mcpizy install sonarqubeFrequently asked questions
What is this workflow?
SAST on Every Commit is a security automation that uses GitHub + SonarQube together via the Model Context Protocol. Static application security testing runs on every commit. Critical vulnerabilities block the pipeline and page the security team.
How long does setup take?
Setup takes around 25 min setup, security on every commit. You install the required MCP servers with `mcpizy install github && mcpizy install sonarqube`, connect your accounts, and the workflow is ready to run.
What does this workflow change in practice?
Shifts security left: developers learn OWASP patterns from PR comments instead of annual training; Makes SOC2/ISO27001 audits painless — continuous SAST evidence is already collected, no audit sprint.
Which MCP servers do I need for this?
You need 2 MCP servers: GitHub (mcpizy install github), SonarQube (mcpizy install sonarqube). All are installable in one command via the MCPizy CLI and configured in your `.claude.json` or `.cursor/mcp.json`.
Does this work with Claude Code, Cursor, and Windsurf?
Yes. The workflow runs with any MCP-compatible AI agent — Claude Code, Claude Desktop, Cursor, Windsurf, VS Code with Copilot, and custom agents built on the MCP SDK. The MCP servers are identical across clients; only the config file path (`.claude.json` vs `.cursor/mcp.json`) changes.
Start building this workflow
Install the required MCPs from the directory and automate this in 25 min setup.
$ mcpizy install github && mcpizy install sonarqube
Free to install. Connect your accounts and this workflow runs itself.