Zeropath

🚀 ZeroPath MCP Server

Interact with your product's security vulnerabilities using natural language.

This open-source MCP server allows developers to query SAST issues, confidential information, patches, etc., directly from ZeroPath and use them in AI-assisted tools such as Claude Desktop, Cursor, Windsurf, and other MCP-compatible environments.

No dashboards. No manual ticket categorization. Just get the security context in the environment where you're working.

🚀 Quick Start

This open - source MCP server enables seamless interaction with product security vulnerabilities. It allows developers to query various security - related information from ZeroPath and utilize it within compatible AI - assisted tools.

✨ Features

• Interact with product security vulnerabilities using natural language.
• Query SAST issues, confidential information, patches, etc., directly from ZeroPath.
• Use in Claude Desktop, Cursor, Windsurf, and other MCP - compatible environments.
• Eliminate the need for dashboards and manual ticket categorization.

📦 Installation

1. Generate an API Key

Generate an API key from https://zeropath.com/app/settings/api in your ZeroPath organization settings.

2. Configure Environment Variables

Set your environment variables to include the API key:

export ZEROPATH_TOKEN_ID=your_token_id
export ZEROPATH_TOKEN_SECRET=your_token_secret

3. Get Your Organization ID

Run the following command to get your organization ID:

curl -X POST https://zeropath.com/api/v1/orgs/list \
    -H "X-ZeroPath-API-Token-Id: $ZEROPATH_TOKEN_ID" \
    -H "X-ZeroPath-API-Token-Secret: $ZEROPATH_TOKEN_SECRET" \
    -H "Content-Type: application/json" \
    -d '{}'

4. Install uv

We use uv for dependency management:

curl -LsSf https://astral.sh/uv/install.sh | sh

5. Clone and Set Up

git clone https://github.com/ZeroPathAI/zeropath-mcp-server.git
cd zeropath-mcp-server
uv sync
export ZEROPATH_ORG_ID=your_org_id

📚 Documentation

Configuration

Add the following entries to your MCP configuration (e.g., Claude Desktop, Cursor, etc.):

{
  "mcpServers": {
    "zeropath-mcp-server": {
      "command": "uv",
      "args": [
        "run",
        "--project",
        "<absolute cloned directory path>/zeropath-mcp-server",
        "<absolute cloned directory path>/zeropath-mcp-server/main.py"
      ]
    }
  }
}

Replace <absolute cloned directory path> with the absolute path of the repository.

Environment Variables

Export the following before running the server:

export ZEROPATH_TOKEN_ID=your_token_id
export ZEROPATH_TOKEN_SECRET=your_token_secret
export ZEROPATH_ORG_ID=your_org_id

These can be found in your ZeroPath settings.

Blog Post

Learn why we built this project and how it fits into the evolving AI development ecosystem: 📄 Chat with Your AppSec Scans: Introducing the ZeroPath MCP Server

💻 Usage Examples

Basic Usage

Search Vulnerabilities

search_vulnerabilities(pattern: str) -> List[Dict[str, Any]] Search for all vulnerabilities that match the pattern. Returns a list containing detailed information about the vulnerabilities.

vulns = search_vulnerabilities("critical")

Get an Issue

get_issue(issue_id: int) -> Dict[str, Any] Get detailed information about a specific issue based on its ID.

issue = get_issue(123)
print(f"Severity of issue {issue['id']} is {issue['severity']}")

Approve a Patch

approve_patch(patch_id: int) -> None Approve a specific patch to be applied to the codebase.

approve_patch(456)

Advanced Usage

To test the tools locally without a client connection:

uv run --project zeropath-mcp-server main.py

🤝 Contribution Guide

We welcome community contributions! Please refer to our CONTRIBUTING.md file to learn how to get involved. You can contact us in the following ways:

• Report an issue: https://github.com/ZeroPathAI/zeropath-mcp-server/issues
• Submit a pull request: https://github.com/ZeroPathAI/zeropath-mcp-server/pulls
• Join Discord: https://discord.gg/zeropath