Zeropath MCP Server

🚀 ZeroPath MCP Server

Interact with your product's security vulnerabilities through natural language.

This open - source MCP server allows developers to directly query SAST issues, secrets, patches, etc., from ZeroPath and use them in AI - assisted tools within Claude Desktop, Cursor, Windsurf, and other compatible MCP environments.

No dashboards. No manual ticket categorization. Just get security context where you work.

🚀 Quick Start

The ZeroPath MCP Server enables seamless interaction with product security vulnerabilities via natural language. It offers a direct way for developers to access and utilize security - related information from ZeroPath in various AI - assisted development environments.

✨ Features

• Interact with security vulnerabilities using natural language.
• Query SAST issues, secrets, and patches directly from ZeroPath.
• Works in multiple compatible MCP environments without the need for dashboards or manual ticket categorization.

📦 Installation

1. Generate an API Key

Generate an API key from https://zeropath.com/app/settings/api in your ZeroPath organization settings.

2. Configure Environment Variables

Set your environment variables to include the API key:

export ZEROPATH_TOKEN_ID=your_token_id
export ZEROPATH_TOKEN_SECRET=your_token_secret

3. Get the Organization ID

Run the following command to get your organization ID:

curl -X POST https://zeropath.com/api/v1/orgs/list \
    -H "X-ZeroPath-API-Token-Id: $ZEROPATH_TOKEN_ID" \
    -H "X-ZeroPath-API-Token-Secret: $ZEROPATH_TOKEN_SECRET" \
    -H "Content-Type: application/json" \
    -d '{}'

4. Install uv

We use uv for dependency management:

curl -LsSf https://astral.sh/uv/install.sh | sh

5. Clone and Set Up

git clone https://github.com/ZeroPathAI/zeropath-mcp-server.git
cd zeropath-mcp-server
uv sync
export ZEROPATH_ORG_ID=your_org_id

📚 Documentation

Configuration

Add the following entries to your MCP configuration (Claude Desktop, Cursor, etc.):

{
  "mcpServers": {
    "zeropath-mcp-server": {
      "command": "uv",
      "args": [
        "run",
        "--project",
        "<Absolute clone directory path>/zeropath-mcp-server",
        "<Absolute clone directory path>/zeropath-mcp-server/main.py"
      ]
    }
  }
}

Replace <Absolute clone directory path> with the absolute path of the repository.

Environment Variables

Before running the server, export the following:

export ZEROPATH_TOKEN_ID=your_token_id
export ZEROPATH_TOKEN_SECRET=your_token_secret
export ZEROPATH_ORG_ID=your_org_id

These can be obtained from your ZeroPath dashboard.

Available Tools

After connecting, the following tools are available for your AI assistant:

search_vulnerabilities(search_query: str)

Query SAST issues by keyword. Example Prompt:

"Show all SSRF vulnerabilities in the user service."

get_issue(issue_id: str)

Get the full metadata, patch suggestions, and code context of a specific issue. Example Prompt:

"Give me the detailed information of issue abc123."

approve_patch(issue_id: str)

Approve a patch (write operation). Here is an example where issue_id is example - 123 Example Prompt:

"Approve the patch for issue example-123."

Development Mode

When running in a development environment, make sure to set up the following:

1. Clone this repository.
2. Install dependencies (see INSTALL.md).
3. Start the server (see USAGE.md).

Blog Post

Learn more about why we built this product and how it fits into the evolving AI development ecosystem: 📄 Chat with Your AppSec Scans: Introducing the ZeroPath MCP Server

Contribution

We welcome all contributions! Please help us improve the documentation, fix bugs, or add new features. To report issues or make suggestions, visit our GitHub repository, or join our Discord community for communication.

By following these steps, you can integrate and leverage the capabilities of the ZeroPath MCP Server in your project.