Stackhawk MCP server

official from Stackhawk Slow last commit 5 mo

{
  "mcpServers": {
    "stackhawk": {
      "command": "uvx",
      "args": [
        "stackhawk-mcp"
      ],
      "env": {
        "COPILOT_MCP_STACKHAWK_API_KEY": "<copilot_mcp_stackhawk_api_key>",
        "STACKHAWK_API_KEY": "<stackhawk_api_key>"
      }
    }
  }
}

{
  "mcpServers": {
    "stackhawk": {
      "command": "uvx",
      "args": [
        "stackhawk-mcp"
      ],
      "env": {
        "COPILOT_MCP_STACKHAWK_API_KEY": "<copilot_mcp_stackhawk_api_key>",
        "STACKHAWK_API_KEY": "<stackhawk_api_key>"
      }
    }
  }
}

{
  "mcpServers": {
    "stackhawk": {
      "command": "uvx",
      "args": [
        "stackhawk-mcp"
      ],
      "env": {
        "COPILOT_MCP_STACKHAWK_API_KEY": "<copilot_mcp_stackhawk_api_key>",
        "STACKHAWK_API_KEY": "<stackhawk_api_key>"
      }
    }
  }
}

{
  "servers": {
    "stackhawk": {
      "command": "uvx",
      "args": [
        "stackhawk-mcp"
      ],
      "env": {
        "COPILOT_MCP_STACKHAWK_API_KEY": "${input:copilot_mcp_stackhawk_api_key}",
        "STACKHAWK_API_KEY": "${input:stackhawk_api_key}"
      }
    }
  },
  "inputs": [
    {
      "id": "copilot_mcp_stackhawk_api_key",
      "type": "promptString",
      "description": "Copilot mcp stackhawk api key",
      "password": true
    },
    {
      "id": "stackhawk_api_key",
      "type": "promptString",
      "description": "Stackhawk api key",
      "password": true
    }
  ]
}

{
  "mcpServers": {
    "stackhawk": {
      "command": "uvx",
      "args": [
        "stackhawk-mcp"
      ],
      "env": {
        "COPILOT_MCP_STACKHAWK_API_KEY": "<copilot_mcp_stackhawk_api_key>",
        "STACKHAWK_API_KEY": "<stackhawk_api_key>"
      }
    }
  }
}

file .mcp.json (in your project root)install uvx stackhawk-mcpversion 1.1.1

An MCP server that provides interaction with StackHawk's security scanning platform.

Before you enable it

An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.

This server has not seen a commit in 5 mo. It may still work, but nobody is currently fixing it — check the alternatives before you build on it.