MCPs for SAST, secrets management, and security scanning
Security MCP servers expose vulnerability scanning (SonarQube, Snyk), secret vaulting (Vault, 1Password), and IAM tools. Agents can audit codebases, rotate secrets, and review permissions — turning security reviews into conversational tasks. Core to SecOps automation.
Security MCPs connect agents to SonarQube, Snyk, HashiCorp Vault, 1Password, and cloud IAM. They scan code for vulnerabilities, rotate secrets, audit permissions, and enforce compliance.
Secrets should be stored in a vault (Vault, 1Password, AWS Secrets Manager). The MCP fetches by reference, never exposes values to the LLM context.
They can propose fixes and open PRs — but merging should always go through human review and your CI gates.
Log every tool call with CID (correlation ID) and user context. All major security MCPs support structured audit logging out of the box.
SonarQube is the most widely adopted; Snyk has the best vuln database. Both have official MCP servers.
Browse the full marketplace or explore all tags to find the right MCPs for your stack.