RunSec connects your IDE or CI agent to local-first security analysis: deterministic rules, cognitive filtering, and evidence-backed findings you can verify in seconds.

Installation

Run via npx (recommended for Cursor, VS Code, Windsurf, and Claude Desktop):

npx @runsec/mcp@latest --api-key="YOUR_RUNSEC_API_KEY"

Get an API key from RunSec Hub under API Keys, then wire the server in your editor MCP config:

{
  "mcpServers": {
    "runsec": {
      "command": "npx",
      "args": ["-y", "@runsec/mcp@latest"],
      "env": {
        "RUNSEC_API_KEY": "YOUR_RUNSEC_API_KEY"
      }
    }
  }
}

Hub & documentation

Website: https://runsec.io
IDE setup guide: https://runsec.io/setup
Trust center: https://runsec.io/security

What it does

Runs security scans locally in your workspace (source stays on your machine)
Syncs metadata and finding summaries to RunSec Hub for dashboards and compliance views
Maps results to frameworks such as OWASP, PCI DSS, SOC 2, and HIPAA