Stackhawk MCP Server
Current Version: 1.2.5 _Requires Python 3.10 or higher_ A Model Context Protocol (MCP) server for integrating with StackHawk's security scanning platform. Helps developers set up StackHawk, run security scans, and triage findings to fix vulnerabilities - all from within an LLM-powered IDE or chat. Its 7 documented tools cluster into read & search, validate, update, run & execute.
People who work with stackhawk and want it reachable from Claude, Cursor, VS Code, or another MCP client. The project is written in Python.
VERIFIED ACTIVE
LAST COMMIT 2026-04-13 · ★ 10 · #128 OF 204 MAINTAINED SECURITY · VERIFIED 2026-09-18
NOASSERTION · Python servers · how we verify → /methodology
01 · Install Stackhawk
before you install - you'll need
Set STACKHAWK_API_KEY before connecting.
Claude Code
claude mcp add stackhawk-stackhawk-mcp -- uvx stackhawk-mcpClaude Desktop / Cursor / VS Code - add to config
{
"mcpServers": {
"stackhawk-stackhawk-mcp": {
"command": "uvx",
"args": [
"stackhawk-mcp"
]
}
}
}Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.
Using another client? Same JSON, different key
Claude Desktop · mcpServers
Cursor · mcpServers
VS Code · servers
Windsurf · mcpServers
Zed · context_servers
Cline · mcpServers
Roo Code · mcpServers
Continue · mcpServers
LibreChat · mcpServers
Gemini CLI · mcpServers
Codex CLI · mcp_servers
Full setup guides: every client.
02 · Evidence
Security posture
What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.
runs as local process (stdio) - runs on your machine with your user's permissions
license no standard license detected - usage rights unclear; check the repo before commercial use
pypi package stackhawk-mcp - check the name against the project README before installing (PyPI has no namespace ownership)
registry vendor namespace com.stackhawk - domain-verified with the official MCP registry
03 · What Stackhawk can do
Prose above is summarized from the project's README and registry record - no invented capabilities.
What you can build
With this server connected, an agent can get org details, teams, and applications, list applications in an organization, detect language, find/create app, generate stackhawk.yml, and check if a field path is valid in the schema (anti-hallucination).
Capability map
Tools grouped from the project's README - what Stackhawk lets an agent do.
read & search
3 tools - e.g. Get org details, teams, and applications; List applications in an organization; Get findings at/above the configured failure threshold
get_organization_info · list_applications · get_app_findings_for_triage
Validate
2 tools - e.g. Validate YAML against the official StackHawk schema; Check if a field path is valid in the schema (anti-hallucination)
validate_stackhawk_config · validate_field_exists
update
1 tool - e.g. Detect language, find/create app, generate stackhawk.yml
setup_stackhawk_for_project
run & execute
1 tool - e.g. Run a StackHawk scan via the CLI (returns install help if CLI is missing)
run_stackhawk_scan
Latest releases
v0.1.0 · 2025-07-07
04 · Who maintains Stackhawk
stackhawk is maintained by stackhawk. It's the only MCP server we track from this author; the repo dates to Jul 2025.
05 · Facts
- repository
- github.com/stackhawk/stackhawk-mcp
- category
- security - ranked #128 of 204 actively-maintained security servers as of 2026-09-18.
- registry
- com.stackhawk/stackhawk (active, first published 2025-10-31)
- packages
- pypi:stackhawk-mcp
06 · Stackhawk FAQ
Is Stackhawk still maintained?
Yes - as of 2026-09-18, its last commit was 2026-04-13. We re-verify nightly.
What can Stackhawk do?
With this server connected, an agent can get org details, teams, and applications, list applications in an organization, detect language, find/create app, generate stackhawk.yml, and check if a field path is valid in the schema (anti-hallucination).
How do I install Stackhawk?
Run `uvx stackhawk-mcp`. The README documents one environment variable (STACKHAWK_API_KEY) to set first. Set STACKHAWK_API_KEY before connecting. You can also paste the ready-made client config above.
Does Stackhawk run locally?
Yes - it's a stdio server: it runs on your machine (via uvx) with your user's permissions. Your data stays local unless the server itself calls external APIs.
07 · Alternatives to Stackhawk
Alternatives to Stackhawk
Maintained security servers if Stackhawk isn't the fit.
- Treg To OpenRouter for tools and data. Compare catalog providers and call them from one hosted MCP endpoint. ★ 1,627 · 2026-09-18
- SafeDep Vet MCP Protect your AI agents and IDEs from malicious open-source packages. ★ 1,105 · 2026-09-16
- SonarQube MCP Server Analyze code quality and security with SonarQube Server or Cloud directly in AI assistants. ★ 652 · 2026-09-17
- HOL Guard Local-first AI agent security evidence and approval workflows through HOL Guard's stdio MCP server. ★ 625 · 2026-09-18
- Decionis CommerceGate MCP Commerce preflights, D365 authorization, signed evidence, and reports; no marketplace or ERP writes. ★ 533 · 2026-09-18
- Emisar Let AI operate servers without SSH. Choose actions, approve risky changes, and audit every step. ★ 353 · 2026-09-15
Pairs well with
Servers that cover what Stackhawk doesn't - only shown when the pairing reason fits the companion.
More security MCP servers · Starlog · Strac MCP DLP · AI AppSec · Tenant Isolation
More Python MCP servers · SEC EDGAR Filings MCP · Cyberbro MCP Server · Fireweed · Inav MCP · Apache Pinot MCP Server · see all