Cursor MCP Trivy

🚀 Trivy Security Scanner MCP Server

A Model Context Protocol (MCP) server that provides Trivy security scanning capabilities through a unified interface.

⚠️ Important Note

This is a proof-of-concept project demonstrating the integration capabilities of MCP, Cursor IDE, and Trivy. It is intended for experimental and learning purposes only and should not be used in a production environment. Use with caution!

✨ Features

• 🔍 Project Scanning: Automatically scan project directories for security vulnerabilities.
• 🛠️ Automated Fixes: Automatically update vulnerable dependencies to secure versions.
• 📦 Multi-Package Manager Support: Support multiple package managers (Python, Node.js, Ruby, Go).

🎥 Demo

🏗️ Architecture

┌─────────────┐     ┌──────────────┐     ┌─────────────┐
│  Cursor IDE │ --> │   MCP Server │ --> │    Trivy    │
│  (Composer) │     │              │     │             │
└─────────────┘     └──────────────┘     └─────────────┘

📋 Prerequisites

• Python 3.12 or higher.
• Trivy installed on the system:

  # macOS
  brew install trivy
  

📦 Installation

# Create and activate a virtual environment
python -m venv .venv
source .venv/bin/activate

# Install dependencies
pip install -r requirements.txt

💻 Usage Examples

Basic Usage

Start the server using SSE transport:

# Use SSE transport (default)
python server.py --transport sse --port 54321

The server provides two tools:

1. scan_project: Scan a directory for security vulnerabilities.

   • Required parameter: workspace - The path to the directory to scan.

2. fix_vulnerability: Update a vulnerable package to a secure version.

   • Required parameters:
     • workspace - The directory to modify.
     • pkg_name - The name of the package to update.
     • target_version - The target version for the update.

🤝 Using with Cursor IDE

Step 1: Start the Server

Start the server using SSE transport:

python server.py --transport sse --port 54321

Step 2: Configure in Cursor

• Open the settings.
• Go to Features > MCP Server.
• Add: http://127.0.0.1:54321/sse.

Step 3: Update .cursorrules

Add the following to your .cursorrules file (create it if it doesn't exist):

Automatically scan the project for security vulnerabilities after any changes to dependency files.
Fixes should only be executed based on the required versions reported by the scanner.
If the scanner reports fixes unrelated to our changes, ignore them.
After executing a fix, scan the project again for security vulnerabilities.

This configuration will:

• Automatically trigger security scans after any changes to dependency files.
• Help identify vulnerabilities in newly added dependencies early.
• Ensure the project remains secure during development.

If you want to use this tool manually, you can prompt the agent in the composer interface with the following:

Please scan my project for security vulnerabilities.

❓ Why MCP?

MCP (Model Context Protocol) aims to solve a fundamental problem in the development of large language models (LLMs): how to handle context information. Through a unified interface, MCP provides an efficient and reliable communication method.

🤝 Contributing

We welcome contributions from the community! Please refer to the Contribution Guidelines for details on how to get involved.

📄 License

This project is licensed under the MIT License.

🙏 Acknowledgments

Thanks to the following projects for their contributions:

• Trivy
• MCP

⚠️ Important Note

This document is an example of an experimental project and is for reference only. Please carefully evaluate its suitability and security before actual use.