Labsco
ZeroPathAI logo

ZeroPath MCP Server

★ 9

from ZeroPathAI

Interact with your product security findings using natural language.

🔥🔥🔥✓ VerifiedFreeNeeds API keys
#email#git#security

ZeroPath MCP Server

License: MIT

Interact with ZeroPath security findings via MCP-compatible tools.

This MCP server calls ZeroPath tRPC V2 procedures directly (no REST wrappers) and returns structured JSON responses suitable for agent consumption.

Blog Post

Learn more about why we built this and how it fits into the evolving AI development ecosystem:

Chat With Your AppSec Scans: Introducing the ZeroPath MCP Server

Tool Surface (tRPC V2)

Tools are loaded dynamically from the ZeroPath frontend's MCP manifest at startup.

All tool calls use tRPC V2 procedures directly using tRPC v10 HTTP conventions:

  • Queries: GET /trpc/<procedure>?input=<url-encoded-json>
  • Mutations: POST /trpc/<procedure> with the raw JSON input object as the body (not wrapped).

Successful responses are returned as structured JSON with the { "result": { "data": ... } } wrapper removed. Errors return the tRPC error object directly.

The server also performs best-effort client-side input validation using each tool's inputSchema from the manifest and returns a BAD_REQUEST error before calling tRPC when inputs are invalid. If a schema uses unsupported JSON Schema features, client-side validation is skipped for that call (server-side validation remains authoritative).

Example Calls

List issues:

{
  "tool": "issues.list",
  "input": {
    "page": 1,
    "pageSize": 25,
    "statuses": ["PENDING_REVIEW"],
    "sortBy": "score",
    "sortOrder": "desc"
  }
}

Archive issues:

{
  "tool": "issues.archive",
  "input": {
    "issueIds": ["issue_123", "issue_456"],
    "reason": "Confirmed duplicate"
  }
}

Create a rule:

{
  "tool": "rules.create",
  "input": {
    "name": "Detect unsafe eval",
    "rule": "Detect any use of eval() on user input",
    "globPattern": "**/*.js",
    "sourceTypes": ["FILE_HANDLER"],
    "repositoryIds": ["repo_123"]
  }
}

Fetch stats summary:

{
  "tool": "stats.summary",
  "input": {
    "organizationId": "org_123"
  }
}

Development

Running Tests

uv run pytest tests/ -v

Building the Package

uv build

Publishing to PyPI (Optional)

uv publish