LABSCO SUMMARY

The scanner you already run in CI, now inside the edit loop.

The files input mode is what makes this fit an assistant rather than a pipeline: it can scan an in-memory change that is not on disk yet, so a secret or a bad dependency gets caught while the code is still being written. The summary line means the model gets a violation count it can act on without parsing the full detections array first.

What it is

The mcp subcommand of Cycode's CLI: cycode mcp starts a server exposing five tools that wrap the same scanners the CLI runs — secrets, SCA, IaC and SAST — plus a status check.

What you get

cycode_secret_scan looks for hardcoded secrets — API keys, passwords, tokens — before they reach a commit
cycode_sca_scan runs Software Composition Analysis over dependencies for known vulnerabilities and license-compliance issues
cycode_iac_scan checks Infrastructure-as-Code — Terraform, CloudFormation, Kubernetes YAML — for cloud security misconfigurations
cycode_sast_scan runs Static Application Security Testing over source for security flaws and code-quality issues
cycode_status reports the CLI version, authentication state and configuration, so you can confirm the connection before trusting a scan
Every scan tool takes input two mutually exclusive ways: paths, which point at files or directories on disk and let the Cycode engine discover and filter recursively, or files, a map of path to content for edits that are not written yet
Each scan returns a JSON object with a detections array and a summary field in plain language, such as 'Cycode found 3 violations: 1 CRITICAL, 2 HIGH.'

Requirements

A Cycode account. Install the CLI (pip install cycode or brew install cycode) and authenticate once with cycode auth; after a global install and auth you do not need to set credentials in the MCP config. Otherwise pass CYCODE_CLIENT_ID and CYCODE_CLIENT_SECRET in the environment. The mcp command needs Python 3.10 or later — it is absent on earlier versions even though the rest of the CLI runs on 3.9. It defaults to stdio, launched as cycode mcp (or uvx cycode mcp); -t sse and -t streamable-http are available for non-local use, binding 127.0.0.1:8000 by default.

Setup effort

One command plus credentials — pip3 install cycode, then supply credentials

See installation options

USE CASES

01

Catching a secret before it commits

Scan the file you just touched — or its in-memory content — for hardcoded keys, passwords and tokens, and get back a count of what it found rather than a raw log.

cycode_secret_scancycode_status

02

Vetting a dependency you are about to add

Run SCA over the project to see whether a package carries known vulnerabilities or a license that will not clear compliance, before the change lands.

cycode_sca_scan

03

Reviewing infrastructure code

Point the IaC scan at your Terraform, CloudFormation or Kubernetes YAML to surface cloud misconfigurations while the manifest is still under review.

cycode_iac_scan

04

A security pass over the whole change

Run SAST across the source for insecure patterns and quality issues, and confirm the CLI is authenticated and configured so the result is one you can trust.

cycode_sast_scancycode_status

5 tools

Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.

`cycode_iac_scan`

Scan for Infrastructure as Code (IaC) misconfigurations.

Use this tool when you need to:

scan Terraform, CloudFormation, Kubernetes YAML files
check for cloud security misconfigurations
verify infrastructure compliance and best practices
detect potential security issues in infrastructure definitions
review Docker files for security issues

Args: paths: File or directory paths on disk to scan (preferred). Directories are scanned recursively. files: Dictionary mapping file paths to their content (fallback when files are not on disk).

Returns: JSON string with a "summary" field (human-readable violation count) plus full scan results.

BEFORE YOU INSTALL

What to know first

Tools you get

5 tools when we connected.

Optional

CYCODE_CLIENT_ID in your environment
CYCODE_CLIENT_SECRET in your environment

CONTEXT COST

Light Standing cost

Rated by the size of the 5 tool definitions that ride along on every turn, not by how many there are

INSTALLATION

Connect your client

Server setup

TERMINAL

pip3 install cycode

MCP Clients

Cursor — CLI, Claude Desktop — CLI

JSON

{
  "mcpServers": {
    "cycode": {
      "command": "cycode",
      "args": [
        "mcp"
      ],
      "env": {
        "CYCODE_CLIENT_ID": "<YOUR_CYCODE_CLIENT_ID>",
        "CYCODE_CLIENT_SECRET": "<YOUR_CYCODE_CLIENT_SECRET>",
        "CYCODE_API_URL": "https://api.cycode.com",
        "CYCODE_APP_URL": "https://app.cycode.com"
      }
    }
  }
}

Cursor — pipx, Claude Desktop — pipx

JSON

{
  "mcpServers": {
    "cycode": {
      "command": "pipx",
      "args": [
        "run",
        "cycode",
        "mcp"
      ],
      "env": {
        "CYCODE_CLIENT_ID": "<YOUR_CYCODE_CLIENT_ID>",
        "CYCODE_CLIENT_SECRET": "<YOUR_CYCODE_CLIENT_SECRET>",
        "CYCODE_API_URL": "https://api.cycode.com",
        "CYCODE_APP_URL": "https://app.cycode.com"
      }
    }
  }
}

Any MCP client — SSE

Authenticate once with cycode auth (or set CYCODE_CLIENT_ID and CYCODE_CLIENT_SECRET), then start the server and leave it running:

Start the server

ANY MCP CLIENT — SSE · TERMINAL

cycode mcp -t sse -p 8000 &

Add this to mcp.json

ANY MCP CLIENT — SSE · JSON

{
  "mcpServers": {
    "cycode": {
      "url": "http://127.0.0.1:8000/sse"
    }
  }
}

Any MCP client — HTTP

Authenticate once with cycode auth (or set CYCODE_CLIENT_ID and CYCODE_CLIENT_SECRET), then start the server and leave it running. With no -H or -p it binds 127.0.0.1:8000:

Start the server

ANY MCP CLIENT — HTTP · TERMINAL

cycode mcp -t streamable-http &

Add this to mcp.json

ANY MCP CLIENT — HTTP · JSON

{
  "mcpServers": {
    "cycode": {
      "url": "http://127.0.0.1:8000/mcp"
    }
  }
}

Cycode

The scanner you already run in CI, now inside the edit loop.

What it is

What you get

Requirements

Setup effort

Catching a secret before it commits

Vetting a dependency you are about to add

Reviewing infrastructure code

A security pass over the whole change

5 tools

`cycode_iac_scan`

`cycode_sast_scan`

`cycode_sca_scan`

`cycode_secret_scan`

`cycode_status`

What to know first

Tools you get

Optional

Light Standing cost

Connect your client

Server setup

MCP Clients

Cursor — CLI, Claude Desktop — CLI

Cursor — pipx, Claude Desktop — pipx

Any MCP client — SSE

Any MCP client — HTTP

Cycode

The scanner you already run in CI, now inside the edit loop.

What it is

What you get

Requirements

Setup effort

Catching a secret before it commits

Vetting a dependency you are about to add

Reviewing infrastructure code

A security pass over the whole change

5 tools

cycode_iac_scan

cycode_sast_scan

cycode_sca_scan

cycode_secret_scan

cycode_status

What to know first

Tools you get

Optional

Light Standing cost

Connect your client

Server setup

MCP Clients

Cursor — CLI, Claude Desktop — CLI

Cursor — pipx, Claude Desktop — pipx

Any MCP client — SSE

Any MCP client — HTTP

Same category

CybeDefend Vulnerability Triage

NMAP

WatchTower

MCP Code Sanitizer

`cycode_iac_scan`

`cycode_sast_scan`

`cycode_sca_scan`

`cycode_secret_scan`

`cycode_status`