contrast/mcp-contrast repository overview

Contrast's MCP server allows you as a developer or security professional to quickly remediate vulnerabilities found by Contrast products. By combining the abilities of a LLM and Coding Agent of your choice and Contrast's unique vulnerability data it is possible to easily remediate vulnerabilities in your code or 3rd party libraries.

⁠Sample Prompts

⁠For the Developer

⁠Remediate Vulnerability in code

1. Please list vulnerabilities for Application Y
2. Give me details about vulnerability X on Application Y
3. Review the vulnerability X and fix it.

⁠3rd Party Library Remediation

1. Which libraries in Application X have vulnerabilities High or Critical and are also being actively used.
2. Update library X with Critical vulnerability to the Safe version.

• Which libraries in Application X are not being used?

⁠For the Security Professional

• Please give me a breakdown of applications and servers vulnerable to CVE-xxxx-xxxx
• Please list the libraries for application named xxx and tell me what version of commons-collections is being used
• Which Vulnerabilities in application X are being blocked by a Protect / ADR Rule?

⁠Data Privacy

The Contrast MCP Server provides a bridge between your Contrast Data and the AI Agent/LLM of your choice. By using Contrast's MCP server you will be providing your Contrast Data to your AI Agent/LLM, it is your responsibility to ensure that the AI Agent/LLM you use complies with your data privacy policy. Depending on what questions you ask the following information will be provided to your AI Agent/LLM.

• Application Details
• Application Rule configuration
• Vulnerability Details
• Route Coverage data
• ADR/Protect Attack Event Details

⁠Configuration

If using VSCode + Copilot the easiest way is to click the VSCode Docker link at the top of the page. Otherwise you can add the following MCP Server to your JSON configuration

"mcp": {
    "inputs": [],
    "servers": {
        "contrastmcp": {
            "command": "docker",
            "args": [
            "run",
            "-e",
            "CONTRAST_HOST_NAME",
            "-e",
            "CONTRAST_API_KEY",
            "-e",
            "CONTRAST_SERVICE_KEY",
            "-e",
            "CONTRAST_USERNAME",
            "-e",
            "CONTRAST_ORG_ID",
            "-i",
            "--rm",
            "contrast/mcp-contrast:latest",
            "-t",
            "stdio"
            ],
            "env": {
                "CONTRAST_HOST_NAME": "example.contrastsecurity.com",
                "CONTRAST_API_KEY": "example",
                "CONTRAST_SERVICE_KEY": "example",
                "CONTRAST_USERNAME": "[email protected]",
                "CONTRAST_ORG_ID": "example"
            }
    }
}

Details of your API/Service key and ORG Id can be found by logging in to Contrast's Web UI and going to User Settings.