Dlp Mcp

io.github.cx-anand-nandeshwarPublished by GitHub account cx-anand-nandeshwarv1.0.0Updated Nov 2, 2026

The DLP MCP provides the compliance violation in the one drive, google drive documents.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & MonitoringData & Analytics

Overview

AI-generated overview

Connects an AI assistant to the DLP One application security platform to run scans, inspect findings and get remediation advice.

What you can do
  • Plan, trigger and monitor SAST, SCA, IaC and secret-detection scans, and list scans or findings with severity filters
  • Inspect individual findings and update risk result statuses
  • Create, search and configure projects, and group them into applications
  • Read tenant-wide vulnerability summaries, risk scores and time-windowed trends
  • Generate AI remediation for code, vulnerable packages and container images
When to use it
Useful when a team already runs DLP One and wants an assistant to start scans, triage vulnerabilities and draft fixes from inside the IDE or agent instead of switching to the platform's web UI.
Requirements
A remote HTTP endpoint at the DLP API host with the tenant path. A DLP One tenant and valid DLP credentials are required; either an API key sent in the Authorization header or OAuth2 login through the client. Network access to the DLP host.
Before you install
The server holds security-scanning access to your code and repositories: triggering scans can send local code or repository URLs to DLP One. It creates projects and applications and changes finding statuses, so writes affect shared tenant data. An API key in the Authorization header is a credential to protect; OAuth2 redirects the client to a DLP One login page.

Installation

In SourceWeft

  1. Open Dlp Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Other MCP clients

Follow the launch instructions in the repository.

README

DLP MCP Server

[License]

A production-ready Model Context Protocol (MCP) server that connects AI coding assistants to DLP One — enabling real-time security scanning, vulnerability management, and AI-generated remediation directly inside your IDE or AI agent.

Table of Contents

Overview

The DLP Security MCP server bridges your AI assistant (Claude, Cursor, Copilot, etc.) with DLP One's enterprise application security platform. It exposes security workflows as natural-language-accessible MCP tools, allowing developers to scan code, investigate findings, and receive context-aware fixes without leaving their development environment.

Supported scan engines:

  • SAST — Static Application Security Testing (30+ languages)
  • SCA — Software Composition Analysis (open-source dependencies)
  • KICS — Infrastructure as Code security (Terraform, CloudFormation, Kubernetes, Dockerfile)
  • Secret Detection — Hardcoded credentials, API keys, tokens

Supported transport protocols

Multi-protocol support to facilitate secure and efficient communication between clients and the server:

  • stdio: Standard input/output for CLI or embedded agents
  • sse (Server-Sent Events): For real-time streaming to web-based clients
  • httpstreamableHttp: HTTP-compatible protocol for stream-based messaging

Features

CategoryCapabilities
ScanningPlan, trigger, and monitor multi-engine security scans (CLI or API mode)
FindingsList, filter, and inspect vulnerabilities with severity and state tracking
RemediationAI-generated fixes for code vulnerabilities, insecure packages, and container images
Project ManagementCreate, configure, and search DLP One projects
Application ManagementGroup projects into applications and get org-wide security metrics
AnalyticsTenant-wide vulnerability summaries, risk scores, and time-windowed trends
Supply ChainDetect malicious npm/Maven/PyPI/Go/NuGet packages via Dustico integration
Enterprise AuthJWT (JWKS-verified), OAuth2 token exchange, Redis session caching
ObservabilityStructured logging (zerolog), OpenTelemetry tracing

Authentication

The server uses API Key and OAuth2 authentication.

API Key Authentication

  1. Clients authenticate to DLP One and get an API key.
  2. This API key will be used during MCP client configuration, include the API Key in the Authorization header as mentioned in the MCP Client Configuration section.

OAuth2 Authentication

DLP MCP supports Dynamic Client Registration (DCR) flow allows an AI client (such as Cursor or Claude Desktop) to connect securely.

  1. User only needs to configure the MCP client as mentioned in the MCP Client Configuration section.
  2. When the client attempts to connect to the MCP server, it will be redirected to DLP One login page for authentication.
  3. Once authentication is successful with valid DLP credentials, the MCP client can use the tools provided by the MCP server.

Note: You required valid DLP credentials to get the API Key or connect to the MCP server.

Refer Authentication for detailed authentication instructions and troubleshooting.

MCP Client Configuration

Prerequisites

  • A DLP One tenant
  • DLP API Host
  • API Key (with required access if using API key authentication)

JSON Configuration

Below are examples to add the server to your MCP client configuration. See the examples/ folder for ready-to-use client config files.

Cursor IDE

API Key Authentication:

json
{  "mcpServers": {    "DLP": {      "url": "https://{api_host}/api/security-mcp/mcp/{tenant}",      "headers": {        "cx-origin": "Curosr",        "Authorization": "API_KEY"      }    }  }}

OAuth2 Authentication

json
{  "mcpServers": {    "DLP": {      "url": "https://{api_host}/api/security-mcp/mcp/{tenant}"    }  }}
Claude Desktop / Claude Code

API Key Authentication:

json
{  "mcpServers": {    "DLP": {      "type": "http",      "url": "https://{api_host}/api/security-mcp/mcp/{tenant}",      "headers": {        "Authorization": "<API_KEY>"      }    }  }}

Available Tools

Refer usage for detail information.

Scanning

ToolDescription
planScanRecommend scan engines based on the project
triggerScanStart a scan (CLI for local code, API for repository URL)
getScanDetailsGet scan status, progress, and severity summary
getLatestScansRetrieve recent scans for a project
listScansList scans with status, date, and branch filters
listFindingsList vulnerabilities from a scan with severity filtering
getFindingDetailsGet detailed information for a specific finding

Project management

ToolDescription
resolveProjectLook up a project by name
createProjectCreate a new DLP One project
listProjectsBrowse or search all projects
getProjectConfigGet full project configuration

Application management

ToolDescription
listApplicationsBrowse or search applications
createApplicationCreate a new application
getApplicationDetailsGet application details by ID
associateProjectLink projects to an application

Analytics & risk

ToolDescription
listProjectsOverviewHigh-level project security status
getProjectsOverviewAggregateOrganization-wide project metrics
getApplicationsOverviewAggregateOrganization-wide application metrics
getTenantVulnerabilitiesSummaryTime-windowed vulnerability analytics
getRiskSummaryOverall risk assessment
listRiskResultsRisk findings with filtering
updateRiskResultStatusUpdate finding status (CONFIRMED, URGENT, NOT_EXPLOITABLE, …)

Remediation

ToolDescription
codeRemediationAI-generated fixes for SAST findings, secrets, and IaC misconfigurations
packageRemediationSafe upgrade paths for vulnerable open-source packages
imageRemediationSecure base image alternatives for vulnerable container images

License

Apache 2.0 — see LICENSE for details.

Contributing

See CONTRIBUTING.md for development setup, module architecture, and contribution guidelines.

Website: DLP.

© 2026 DLP Ltd. All Rights Reserved.

Source: README.md at commit 5e4696a

Tools

0
SourceWeft has not read this server's tools yet.

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declaredRequired10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts