Cycode

Name: Cycode
Author: cycodehq

@cycodehq

Repository

About Cycode

Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning

#cycode #code #secrets #secure #sca #sast

Basic information

Config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "cycode": {
      "command": "uvx",
      "args": [
        "cycode",
        "mcp"
      ],
      "env": {
        "CYCODE_CLIENT_ID": "your-cycode-id",
        "CYCODE_CLIENT_SECRET": "your-cycode-secret-key",
        "CYCODE_API_URL": "https://api.cycode.com",
        "CYCODE_APP_URL": "https://app.cycode.com"
      }
    }
  }
}

Tools

Get Cycode CLI version, authentication status, and configuration information. Use this tool when you need to: - verify Cycode CLI is properly configured - check authentication status - get CLI version information - troubleshoot setup issues - confirm service connectivity Returns: JSON string containing CLI status, version, and configuration details

Scan files for hardcoded secrets. Use this tool when you need to: - scan code for hardcoded secrets, API keys, passwords, tokens - verify that code doesn't contain exposed credentials - detect potential security vulnerabilities from secret exposure Args: files: Dictionary mapping file paths to their content Returns: JSON string containing scan results and any secrets found

Scan files for Software Composition Analysis (SCA) - vulnerabilities and license issues. Use this tool when you need to: - scan dependencies for known security vulnerabilities - check for license compliance issues - analyze third-party component risks - verify software supply chain security - review package.json, requirements.txt, pom.xml and other dependency files Important: You must also include lock files (like package-lock.json, Pipfile.lock, etc.) to get accurate results. You must provide manifest and lock files together. Args: files: Dictionary mapping file paths to their content Returns: JSON string containing scan results, vulnerabilities, and license issues found

Scan files for Infrastructure as Code (IaC) misconfigurations. Use this tool when you need to: - scan Terraform, CloudFormation, Kubernetes YAML files - check for cloud security misconfigurations - verify infrastructure compliance and best practices - detect potential security issues in infrastructure definitions - review Docker files for security issues Args: files: Dictionary mapping file paths to their content Returns: JSON string containing scan results and any misconfigurations found

Scan files for Static Application Security Testing (SAST) - code quality and security flaws. Use this tool when you need to: - scan source code for security vulnerabilities - detect code quality issues and potential bugs - check for insecure coding practices - verify code follows security best practices - find SQL injection, XSS, and other application security issues Args: files: Dictionary mapping file paths to their content Returns: JSON string containing scan results and any security flaws found

Overview

What is Cycode?

Cycode is an MCP server that exposes Cycode's scanning capabilities to AI systems via the Model Context Protocol. It allows AI models to interact with Cycode CLI tools for security scanning.

How to use Cycode?

Install the Cycode CLI globally (pip install cycode or brew install cycode), authenticate with cycode auth, then start the server with the command cycode mcp. The server supports stdio, sse, and streamable-http transports.