O360 Mcp

com.offensive360Published by offensive360.comv1.0.2Updated Oct 24, 2026

Run Offensive360 SAST scans (60+ languages) on local code; findings with file/line and fixes

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Runs Offensive360 SAST scans on local code from an AI assistant, returning findings with file/line, severity and fixes.

What you can do
Scan code: zip a local directory and run a full SAST scan across 60+ languages with taint/data-flow analysis, returning findings with file/line, severity and fixes, with junk directories excluded automatically and extra exclusions configurable. Check scans: query the queue position of a running scan. Follow up: read findings and start patching them in the assistant.
When to use it
Useful when you want an assistant to security-scan a local project and then act on the results, for example asking it to scan a project and fix the critical findings. Suited to teams already using Offensive360, cloud or on-premise.
Requirements
Runs locally via npx, so Node 18+ is needed. Requires an Offensive360 external scan token in O360_TOKEN (free for open-source/public repos, otherwise created by an instance admin) and the instance base URL in O360_URL, which can point at an on-premise or air-gapped instance. Network access to that instance is required.
Before you install
The token in O360_TOKEN is a credential; keep it out of shared configs. The tool uploads a zip of your local directory to the configured Offensive360 instance, so source code leaves your machine. Scans are synchronous and can take 1-5 minutes, with a default 900s client timeout. Commercial use may involve paid plans.

Installation

In SourceWeft

  1. Open O360 Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Offensive360 MCP Server

Run Offensive360 SAST scans from inside your AI assistant. This Model Context Protocol server gives Claude Code, Claude Desktop, Cursor, and any other MCP client two tools:

ToolWhat it does
o360_scan_pathZips a local directory, runs a full SAST scan (60+ languages, taint/data-flow analysis), returns findings with file/line, severity, and fixes
o360_scan_statusQueue position of a running scan

Ask your assistant things like "scan this project with Offensive360 and fix the criticals" — it scans, reads the findings, and starts patching.

Setup

You need an Offensive360 External scan token:

Claude Code

bash
claude mcp add offensive360 \  -e O360_URL=https://sast.offensive360.com \  -e O360_TOKEN=<your-token> \  -- npx -y o360-mcp

Claude Desktop / Cursor (JSON)

json
{  "mcpServers": {    "offensive360": {      "command": "npx",      "args": ["-y", "o360-mcp"],      "env": {        "O360_URL": "https://sast.offensive360.com",        "O360_TOKEN": "<your-token>"      }    }  }}

O360_URL can point at your own on-premise or air-gapped instance — the server talks only to the instance you configure.

Notes

  • Scans are synchronous; typical duration is 1–5 minutes depending on codebase size. The default client timeout is 900s (timeout_seconds parameter to override).
  • Common junk directories (node_modules, .git, dist, …) are excluded from the upload automatically; add more via the exclude parameter.
  • Findings are also visible in your Offensive360 dashboard with full data-flow traces.
  • Requires Node 18+.

About Offensive360

One platform for SAST, DAST, MAST, SCA, malware & binary analysis, and license compliance — flat pricing, cloud or fully air-gapped on-premise. offensive360.com · Book a demo

Source: README.md at commit e1e17c4

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.2LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts