O360 MCP server
{
"mcpServers": {
"offensive360-o360": {
"command": "npx",
"args": [
"-y",
"o360-mcp@latest"
],
"env": {
"O360_URL": "https://...",
"O360_TOKEN": "<o360_token>"
}
}
}
}{
"mcpServers": {
"offensive360-o360": {
"command": "npx",
"args": [
"-y",
"o360-mcp@latest"
],
"env": {
"O360_URL": "https://...",
"O360_TOKEN": "<o360_token>"
}
}
}
}{
"mcpServers": {
"offensive360-o360": {
"command": "npx",
"args": [
"-y",
"o360-mcp@latest"
],
"env": {
"O360_URL": "https://...",
"O360_TOKEN": "<o360_token>"
}
}
}
}{
"servers": {
"offensive360-o360": {
"command": "npx",
"args": [
"-y",
"o360-mcp@latest"
],
"env": {
"O360_URL": "${input:o360_url}",
"O360_TOKEN": "${input:o360_token}"
}
}
},
"inputs": [
{
"id": "o360_url",
"type": "promptString",
"description": "O360 url",
"password": true
},
{
"id": "o360_token",
"type": "promptString",
"description": "O360 token",
"password": true
}
]
}{
"mcpServers": {
"offensive360-o360": {
"command": "npx",
"args": [
"-y",
"o360-mcp@latest"
],
"env": {
"O360_URL": "https://...",
"O360_TOKEN": "<o360_token>"
}
}
}
}file .mcp.json (in your project root)file claude_desktop_config.jsonfile ~/.cursor/mcp.jsonfile .vscode/mcp.jsonfile ~/.codeium/windsurf/mcp_config.jsoninstall npx -y o360-mcpversion 1.0.2
What it does
MCP server that runs Offensive360 SAST scans on local code, supporting 60+ languages with taint and data-flow analysis. Developers use it to scan projects for security findings and retrieve actionable fixes directly from their AI assistant.
- Scan a local codebase with SAST analysis and retrieve findings with file locations, line numbers, and suggested fixes.
- Check the queue position of a running scan to monitor progress.
- Integrate security scanning into an AI-assisted workflow to identify and patch critical vulnerabilities in code.
Tools this server exposes
| Tool | Does |
|---|---|
| o360_scan_path | Scans a local directory with SAST analysis (60+ languages, taint/data-flow), returns findings with file/line, severity, and fixes. |
| o360_scan_status | Returns the queue position of a currently running scan. |
Before you enable it
An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.