Contrast MCP Server

What is Contrast MCP Server?

The Contrast MCP Server connects Contrast Security to your AI coding agent so you can remediate vulnerabilities, update insecure libraries, and analyze security coverage through natural language. It comes in two forms—a hosted remote server for SaaS customers (recommended, with OAuth sign-in) and a local open-source server for on-premises and Enterprise On-Premises instances.

How to use Contrast MCP Server?

For the hosted server, add it to your MCP client using the endpoint URL https://<your-contrast-host>/mcp over Streamable HTTP with OAuth 2.0 PKCE (e.g., claude mcp add --transport http contrast-hosted-mcp https://app.contrastsecurity.com/mcp). For the local server, run it as a stdio process using Docker or Java 21+ with Contrast API credentials.

Key features of Contrast MCP Server

• Two deployment options: hosted (remote, OAuth) and local (open-source, API keys)
• Read-only hosted server prevents data modification
• Tools for vulnerabilities, applications, libraries, attacks, route coverage, SAST, and issues/incidents
• OAuth for hosted server; API keys for local server
• Organization-scoped sessions with existing role-based access control
• No data storage by the hosted server

Use cases of Contrast MCP Server

• Search and view vulnerabilities across applications using natural language
• List libraries used by an application and find apps affected by a specific CVE
• Search attack events and get protection rules for an application
• Retrieve route coverage data showing exercised vs. discovered routes
• Get SAST scan results in SARIF format (local server only)