LABSCO SUMMARY

The vulnerability, the library that carries it, and the code that must change — in one conversation.

Because the detail includes remediation guidance and the stack trace, an agent working in your repository can go from "which of my applications are exposed to this CVE" to the specific call site, rather than handing you a dashboard link.

What it is

Two ways into the same Contrast data. The hosted server is remote, read-only, and run by Contrast: you point a client at your Contrast host followed by /mcp and sign in through the browser. The local server is the open-source one in this repository, launched over stdio with API keys, and is the route for on-premises and EOP instances or when you need raw SARIF output.

What you get

Vulnerabilities — search_vulnerabilities across applications, search_app_vulnerabilities within one with session filtering, get_vulnerability for the detail including stack trace and remediation guidance, list_vulnerability_types
Applications and servers — search_applications by name, tag or metadata, get_session_metadata, search_servers for agent health and Protect coverage
Libraries — list_application_libraries with class usage statistics and vulnerability counts, list_applications_by_cve
Protection — search_attacks filtered by status, type and rule, get_protect_rules
Coverage and SAST — get_route_coverage for exercised against discovered routes, get_scan_project, and locally get_scan_results in SARIF format
The hosted server adds get_user_info and, where the unified data platform is enabled, CVE, issue, incident and observation tools such as search_cves, get_cve_impact, search_issues, search_incidents and list_issue_observations

Requirements

For the hosted server: a Contrast SaaS account and a client that supports Streamable HTTP with OAuth 2.0 and PKCE — claude mcp add --transport http contrast-hosted-mcp https://app.contrastsecurity.com/mcp; on a dedicated Contrast instance, the address is your own Contrast host followed by /mcp. The scopes are identity only (openid, profile, offline_access); authorisation is decided by Contrast on every request using your existing role-based access, so an agent sees exactly what you see and no more. Gemini CLI and the VS Code Copilot plugin are listed as not yet working because of OAuth compatibility. For the local server: Docker, or Java 21+ for the JAR, plus CONTRAST_HOST_NAME, CONTRAST_ORG_ID, CONTRAST_USERNAME, CONTRAST_API_KEY and CONTRAST_SERVICE_KEY. One warning the project puts above everything else: tool results become part of your AI conversation, so only use it with services that contractually prohibit training on your prompts.

Setup effort

One command plus a key — docker run -e CONTRAST_HOST_NAME -e CONTRAST_API_KEY -e CONTRAST_SERVICE_KEY -e CONTRAST_USERNAME -e CONTRAST_ORG_ID -i --rm contrast/mcp-contrast:latest -t stdio

See installation options

USE CASES

Fixing a vulnerability in the code you are looking at

Search the application's vulnerabilities, pull the one that matters with its stack trace and remediation guidance, and make the change in the same session.

search_app_vulnerabilitiesget_vulnerability

Answering "are we affected by this CVE"

Find every application affected by the CVE, then list the libraries involved with their class usage statistics to see whether the vulnerable code is actually reached.

list_applications_by_cvelist_application_libraries

Deciding what to look at first

Search vulnerabilities across the whole organisation and filter by type, so triage starts from the population rather than one application.

search_vulnerabilitieslist_vulnerability_types

Checking whether an attack is real

Search attack events by status, type and rule, then read the protection rules configured for the application involved.

search_attacksget_protect_rules

Seeing how much of the app is actually exercised

Compare exercised against discovered routes to find the surface your testing never reaches.

get_route_coverage

Feeding scan output into your own tooling

The local server returns SAST results in SARIF, which is the format the rest of your pipeline already reads.

get_scan_projectget_scan_results

28 tools

Listed in project docs. Your client may show a different list.

get_user_info

search_vulnerabilities

search_app_vulnerabilities

get_vulnerability

list_vulnerability_types

search_applications

get_session_metadata

search_servers

list_application_libraries

list_applications_by_cve

search_attacks

get_protect_rules

get_route_coverage

get_scan_project

get_scan_results

INSTALLATION

Connect your client

Server setup

docker

TERMINAL

docker run -e CONTRAST_HOST_NAME -e CONTRAST_API_KEY -e CONTRAST_SERVICE_KEY -e CONTRAST_USERNAME -e CONTRAST_ORG_ID -i --rm contrast/mcp-contrast:latest -t stdio

Hosted endpoint

ENDPOINT URL

https://app.contrastsecurity.com/mcp

Add this hosted endpoint to your MCP client using the credentials listed under Requirements.

MCP Clients

Claude Code

CLAUDE CODE · TERMINAL

claude mcp add --transport http contrast-hosted-mcp https://app.contrastsecurity.com/mcp

Claude Desktop

CLAUDE DESKTOP · JSON

{
  "mcpServers": {
    "contrast": {
      "command": "docker",
      "args": [
        "run",
        "-e",
        "CONTRAST_HOST_NAME",
        "-e",
        "CONTRAST_API_KEY",
        "-e",
        "CONTRAST_SERVICE_KEY",
        "-e",
        "CONTRAST_USERNAME",
        "-e",
        "CONTRAST_ORG_ID",
        "-i",
        "--rm",
        "contrast/mcp-contrast:latest",
        "-t",
        "stdio"
      ],
      "env": {
        "CONTRAST_HOST_NAME": "example.contrastsecurity.com",
        "CONTRAST_API_KEY": "<YOUR_CONTRAST_API_KEY>",
        "CONTRAST_SERVICE_KEY": "<YOUR_CONTRAST_SERVICE_KEY>",
        "CONTRAST_USERNAME": "<YOUR_CONTRAST_USERNAME>",
        "CONTRAST_ORG_ID": "<YOUR_CONTRAST_ORG_ID>"
      }
    }
  }
}

IntelliJ IDEA, oterm

JSON

{
  "servers": {
    "contrast": {
      "command": "docker",
      "args": [
        "run",
        "-e",
        "CONTRAST_HOST_NAME",
        "-e",
        "CONTRAST_API_KEY",
        "-e",
        "CONTRAST_SERVICE_KEY",
        "-e",
        "CONTRAST_USERNAME",
        "-e",
        "CONTRAST_ORG_ID",
        "-i",
        "--rm",
        "contrast/mcp-contrast:latest",
        "-t",
        "stdio"
      ],
      "env": {
        "CONTRAST_HOST_NAME": "example.contrastsecurity.com",
        "CONTRAST_API_KEY": "example",
        "CONTRAST_SERVICE_KEY": "example",
        "CONTRAST_USERNAME": "<YOUR_CONTRAST_USERNAME>",
        "CONTRAST_ORG_ID": "example"
      }
    }
  }
}

Cline

CLINE · JSON

{
  "mcpServers": {
    "contrast": {
      "command": "docker",
      "args": [
        "run",
        "-e",
        "CONTRAST_HOST_NAME",
        "-e",
        "CONTRAST_API_KEY",
        "-e",
        "CONTRAST_SERVICE_KEY",
        "-e",
        "CONTRAST_USERNAME",
        "-e",
        "CONTRAST_ORG_ID",
        "-i",
        "--rm",
        "contrast/mcp-contrast:latest",
        "-t",
        "stdio"
      ],
      "env": {
        "CONTRAST_HOST_NAME": "example.contrastsecurity.com",
        "CONTRAST_API_KEY": "example",
        "CONTRAST_SERVICE_KEY": "example",
        "CONTRAST_USERNAME": "<YOUR_CONTRAST_USERNAME>",
        "CONTRAST_ORG_ID": "example"
      },
      "disabled": false,
      "autoApprove": []
    }
  }
}

VS Code

VS CODE · JSON

{
  "inputs": [
    {
      "type": "promptString",
      "id": "contrast_host_name",
      "description": "Your Contrast Server's host name (with or without https://)"
    },
    {
      "type": "promptString",
      "id": "contrast_org_id",
      "description": "<YOUR_CONTRAST_ORGANIZATION_ID>"
    },
    {
      "type": "promptString",
      "id": "contrast_username",
      "description": "<YOUR_CONTRAST_USER_NAME>"
    },
    {
      "type": "promptString",
      "id": "contrast_api_key",
      "description": "API key for your Contrast Installation.",
      "password": true
    },
    {
      "type": "promptString",
      "id": "contrast_service_key",
      "description": "Service key for your Contrast Installation.",
      "password": true
    }
  ],
  "servers": {
    "contrast": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "-e",
        "CONTRAST_HOST_NAME",
        "-e",
        "CONTRAST_API_KEY",
        "-e",
        "CONTRAST_SERVICE_KEY",
        "-e",
        "CONTRAST_USERNAME",
        "-e",
        "CONTRAST_ORG_ID",
        "-i",
        "--rm",
        "contrast/mcp-contrast:latest",
        "-t",
        "stdio"
      ],
      "env": {
        "CONTRAST_HOST_NAME": "${input:contrast_host_name}",
        "CONTRAST_ORG_ID": "${input:contrast_org_id}",
        "CONTRAST_USERNAME": "${input:contrast_username}",
        "CONTRAST_API_KEY": "${input:contrast_api_key}",
        "CONTRAST_SERVICE_KEY": "${input:contrast_service_key}"
      }
    }
  }
}

Contrast MCP Server

The vulnerability, the library that carries it, and the code that must change — in one conversation.

What it is

What you get

Requirements

Setup effort

Fixing a vulnerability in the code you are looking at

Answering "are we affected by this CVE"

Deciding what to look at first

Checking whether an attack is real

Seeing how much of the app is actually exercised

Feeding scan output into your own tooling

28 tools

What to know first

Tools you get

Requires

Where it runs

Connect your client

Server setup

docker

Hosted endpoint

MCP Clients

Claude Code

Claude Desktop

IntelliJ IDEA, oterm

Cline

VS Code

Contrast MCP Server

The vulnerability, the library that carries it, and the code that must change — in one conversation.

What it is

What you get

Requirements

Setup effort

Fixing a vulnerability in the code you are looking at

Answering "are we affected by this CVE"

Deciding what to look at first

Checking whether an attack is real

Seeing how much of the app is actually exercised

Feeding scan output into your own tooling

28 tools

What to know first

Tools you get

Requires

Where it runs

Connect your client

Server setup

docker

Hosted endpoint

MCP Clients

Claude Code

Claude Desktop

IntelliJ IDEA, oterm

Cline

VS Code

Same category

VibeShift

Nmap Scan Interface

Shipcheck MCP

SonarQube