Home / Developers / MCP Server
20 AI Tools

MCP Server

Give your AI assistant 20 security superpowers. Scan code, detect secrets, check dependencies, and analyze infrastructure -- all from natural language.

MCP Server

Model Context Protocol server with 20 security tools for AI assistants

What is MCP?

The Model Context Protocol (MCP) is an open standard that lets AI assistants use external tools. Instead of copy-pasting code into ChatGPT, your AI assistant can directly call Fortly's security tools during conversation.

This means you can say "analyze this code for vulnerabilities" in Claude Desktop or Cursor, and it will automatically run Fortly's SAST engine, secrets scanner, or dependency checker -- returning real results, not guesses.

Why it matters: Fortly is one of the first security platforms to offer an MCP server. Your AI assistant becomes a security expert with access to real scanning engines, not just training data.

Setup

Choose between remote (no installation) or local (via npx) mode.

// No installation needed — connects to Fortly's hosted MCP server
// Works with Claude Desktop, Cursor, Windsurf, and any MCP client
// Claude Desktop: ~/Library/Application Support/Claude/claude_desktop_config.json
// Cursor: .cursor/mcp.json
{
  "mcpServers": {
    "fortly": {
      "url": "https://fortly-security.com/mcp",
      "headers": {
        "Authorization": "Bearer ft_sk_your_api_key"
      }
    }
  }
}

Claude Desktop

~/Library/Application Support/Claude/claude_desktop_config.json

Cursor

.cursor/mcp.json

20 Available Tools

Tool Description Mode
fortly_scan_codeSAST analysis (45 rules, JS/Python/Java/Go)OFFLINE
fortly_check_secretsDetect 16 secret patterns in codeOFFLINE
fortly_scan_iacTerraform/Docker/K8s misconfig (22 rules)OFFLINE
fortly_generate_sbomCycloneDX/SPDX bill of materialsOFFLINE
fortly_check_dependencyCVE check via OSV.devOFFLINE
fortly_explain_cvePlain-language CVE explanationOFFLINE
fortly_scanDAST URL scanningAPI
fortly_get_remediationAI-powered fix previewAPI
fortly_apply_fixApply AI-generated fixAPI
fortly_batch_remediateFix all vulnerabilities in a scanAPI
fortly_scan_scaSoftware Composition AnalysisAPI
fortly_scan_diffCompare two scansAPI
fortly_compliance_checkCompliance verificationAPI
fortly_gap_analysisLATAM compliance gap analysisAPI
fortly_list_frameworks12 frameworks (6 LATAM)API
fortly_export_complianceAuditor evidence exportAPI
fortly_purple_teamMITRE ATT&CK attack chainsAPI
fortly_dashboardSecurity metrics overviewAPI
fortly_scan_historyTrend analysis over timeAPI
fortly_evaluate_policyPolicy evaluation engineAPI

Real Usage Examples

Just describe what you want in natural language. Your AI assistant picks the right tool automatically.

"Analyze this code for security vulnerabilities"

OFFLINE fortly_scan_code

Claude runs SAST analysis with 45 rules across JS, Python, Java, and Go. Returns vulnerability findings with severity, CWE, and remediation suggestions.

"Is it safe to use lodash 4.17.15?"

OFFLINE fortly_check_dependency

Checks the dependency against OSV.dev for known CVEs. Returns vulnerability details and recommended upgrade version.

"Detect secrets in this config file"

OFFLINE fortly_check_secrets

Scans for 16 secret patterns: AWS keys, GitHub tokens, database URLs, JWT secrets, private keys, and more. Works without any API key.

Prompts & Resources

Prompts (ask your AI)

security-review

Full security review of a codebase: SAST, secrets, dependencies, IaC, and compliance.

threat-model

STRIDE-based threat model generation with MITRE ATT&CK mapping.

Resources (reference data)

OWASP Top 10

Complete OWASP Top 10 2021 reference with descriptions, examples, and mitigations.

JS Secure Coding

JavaScript/TypeScript secure coding guide: XSS prevention, input validation, auth patterns.

Next Steps