@runsec/mcp

RunSec MCP Server

AI-powered MCP server for secure coding — zero noise, instant proof.

RunSec connects your IDE or CI agent to local-first security analysis: deterministic rules, cognitive filtering, and evidence-backed findings you can verify in seconds.

Installation

Run via npx (recommended for Cursor, VS Code, Windsurf, and Claude Desktop):

npx @runsec/mcp@latest --api-key="YOUR_RUNSEC_API_KEY"

Get an API key from RunSec Hub under API Keys, then wire the server in your editor MCP config:

{
  "mcpServers": {
    "runsec": {
      "command": "npx",
      "args": ["-y", "@runsec/mcp@latest"],
      "env": {
        "RUNSEC_API_KEY": "YOUR_RUNSEC_API_KEY"
      }
    }
  }
}

Hub & documentation

• Website: https://runsec.io
• IDE setup guide: https://runsec.io/setup
• Trust center: https://runsec.io/security

What it does

• Runs security scans locally in your workspace (source stays on your machine)
• Syncs metadata and finding summaries to RunSec Hub for dashboards and compliance views
• Maps results to frameworks such as OWASP, PCI DSS, SOC 2, and HIPAA

License

The @runsec/mcp connector is released under the MIT License.

Optional platform engine packages (@runsec/engine-*) may download third-party security scanners (Syft, Semgrep, TruffleHog) at install time. Those tools are governed by their upstream licenses when bundled; review your compliance requirements before enabling engines in regulated environments.

Support

Questions or enterprise onboarding: [e-mail]