Summary

The scanner you already run in CI, now inside the edit loop.

The files input mode is what makes this fit an assistant rather than a pipeline: it can scan an in-memory change that is not on disk yet, so a secret or a bad dependency gets caught while the code is still being written. The summary line means the model gets a violation count it can act on without parsing the full detections array first.

What it is

The mcp subcommand of Cycode's CLI: `cycode mcp` starts a server exposing five tools that wrap the same scanners the CLI runs — secrets, SCA, IaC and SAST — plus a status check.

What you get

cycode_secret_scan looks for hardcoded secrets — API keys, passwords, tokens — before they reach a commit
cycode_sca_scan runs Software Composition Analysis over dependencies for known vulnerabilities and license-compliance issues
cycode_iac_scan checks Infrastructure-as-Code — Terraform, CloudFormation, Kubernetes YAML — for cloud security misconfigurations
cycode_sast_scan runs Static Application Security Testing over source for security flaws and code-quality issues
cycode_status reports the CLI version, authentication state and configuration, so you can confirm the connection before trusting a scan
Every scan tool takes input two mutually exclusive ways: paths, which point at files or directories on disk and let the Cycode engine discover and filter recursively, or files, a map of path to content for edits that are not written yet
Each scan returns a JSON object with a detections array and a summary field in plain language, such as 'Cycode found 3 violations: 1 CRITICAL, 2 HIGH.'

Requirements

A Cycode account. Install the CLI (pip install cycode or brew install cycode) and authenticate once with `cycode auth`; after a global install and auth you do not need to set credentials in the MCP config. Otherwise pass CYCODE_CLIENT_ID and CYCODE_CLIENT_SECRET in the environment. The mcp command needs Python 3.10 or later — it is absent on earlier versions even though the rest of the CLI runs on 3.9. It defaults to stdio, launched as `cycode mcp` (or `uvx cycode mcp`); -t sse and -t streamable-http are available for non-local use, binding 127.0.0.1:8000 by default.

Setup effort

One command plus a key — pip3 install cycode, then supply credentials