ZeroPath MCP Server

Name: ZeroPath MCP Server
Author: ZeroPathAI

@ZeroPathAI

About ZeroPath MCP Server

Open-source MCP server for querying ZeroPath security issues, patches, and scans using Claude, Cursor, Windsurf, or any AI assistant.

#security #appsec #security-automation #devsecops #mcp-server

Basic information

Config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "zeropath-mcp-server": {
      "command": "uv",
      "args": [
        "sync"
      ]
    }
  }
}

Tools

No tools detected

We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.

Overview

What is ZeroPath MCP Server?

It lets MCP-compatible clients (e.g. Claude Desktop, Cursor) interact with ZeroPath security scan findings by calling ZeroPath's tRPC V2 procedures directly and returning structured JSON responses.

How to use ZeroPath MCP Server?

Install via pip install git+https://github.com/ZeroPathAI/zeropath-mcp-server or use uvx to run without installing. Set environment variables ZEROPATH_TOKEN_ID, ZEROPATH_TOKEN_SECRET, ZEROPATH_ORG_ID and optionally ZEROPATH_BASE_URL. Add the server configuration to your MCP client’s config file using command uvx (GitHub source) or zeropath-mcp-server (PyPI install) with the required env vars.

Key features of ZeroPath MCP Server

Direct tRPC V2 calls (no REST wrapper)
Dynamic tool surface loaded from MCP manifest
Client‑side input validation (best‑effort)
Structured JSON responses (wrapper removed)
Supports both queries and mutations

Use cases of ZeroPath MCP Server

List pending‑review issues filtered by status and score
Archive multiple issues with a reason
Create custom detection rules for repositories
Fetch organization‑wide stats summary

FAQ from ZeroPath MCP Server

What runtime dependencies does ZeroPath MCP Server require?

Python and either pip or uvx (for the no‑install path). The package installs from GitHub or optionally from PyPI.

How do I authenticate with ZeroPath via this server?

Set the environment variables ZEROPATH_TOKEN_ID and ZEROPATH_TOKEN_SECRET (an API key generated from ZeroPath Settings). The server uses these directly for tRPC authentication.

Can I point the server to a different ZeroPath environment?

Yes. Override the ZEROPATH_BASE_URL environment variable to target staging or another environment (defaults to https://zeropath.com).

What transport does the server use?

All tool calls use tRPC V2 over HTTP: queries via GET /trpc/<procedure>, mutations via POST /trpc/<procedure>. The server communicates directly with ZeroPath’s tRPC endpoints.

Does the server validate input before sending to ZeroPath?

It performs best‑effort client‑side validation using each tool’s inputSchema from the manifest. If the schema uses unsupported JSON Schema features, client‑side validation is skipped and server‑side validation remains authoritative.