Labsco
MCP SERVER

Contrast MCP Server

by Contrast-Security-OSS ↗

Ask Contrast Security about your vulnerabilities, libraries and attacks — hosted with OAuth, or self-run against an on-premises instance.

Vulnerability Scanning & Application Security
Summary
The vulnerability, the library that carries it, and the code that must change — in one conversation.

Because the detail includes remediation guidance and the stack trace, an agent working in your repository can go from "which of my applications are exposed to this CVE" to the specific call site, rather than handing you a dashboard link.

What it is

Two ways into the same Contrast data. The hosted server is remote, read-only, and run by Contrast: you point a client at your Contrast host followed by `/mcp` and sign in through the browser. The local server is the open-source one in this repository, launched over stdio with API keys, and is the route for on-premises and EOP instances or when you need raw SARIF output.

What you get
  • Vulnerabilities — `search_vulnerabilities` across applications, `search_app_vulnerabilities` within one with session filtering, `get_vulnerability` for the detail including stack trace and remediation guidance, `list_vulnerability_types`
  • Applications and servers — `search_applications` by name, tag or metadata, `get_session_metadata`, `search_servers` for agent health and Protect coverage
  • Libraries — `list_application_libraries` with class usage statistics and vulnerability counts, `list_applications_by_cve`
  • Protection — `search_attacks` filtered by status, type and rule, `get_protect_rules`
  • Coverage and SAST — `get_route_coverage` for exercised against discovered routes, `get_scan_project`, and locally `get_scan_results` in SARIF format
  • The hosted server adds `get_user_info` and, where the unified data platform is enabled, CVE, issue, incident and observation tools such as `search_cves`, `get_cve_impact`, `search_issues`, `search_incidents` and `list_issue_observations`
Requirements

For the hosted server: a Contrast SaaS account and a client that supports Streamable HTTP with OAuth 2.0 and PKCE — `claude mcp add --transport http contrast-hosted-mcp https://app.contrastsecurity.com/mcp`, substituting your own Contrast host. The scopes are identity only (`openid`, `profile`, `offline_access`); authorisation is decided by Contrast on every request using your existing role-based access, so an agent sees exactly what you see and no more. Gemini CLI and the VS Code Copilot plugin are listed as not yet working because of OAuth compatibility. For the local server: Docker, or Java 21+ for the JAR, plus `CONTRAST_HOST_NAME`, `CONTRAST_ORG_ID`, `CONTRAST_USERNAME`, `CONTRAST_API_KEY` and `CONTRAST_SERVICE_KEY`. One warning the project puts above everything else: tool results become part of your AI conversation, so only use it with services that contractually prohibit training on your prompts.

Setup effort

One command plus a key — docker run -e CONTRAST_HOST_NAME -e CONTRAST_API_KEY -e CONTRAST_SERVICE_KEY -e CONTRAST_USERNAME -e CONTRAST_ORG_ID -i --rm contrast/mcp-contrast:latest -t stdio, then supply credentials