What is com.offensive360/o360-mcp?

Run Offensive360 SAST scans (60+ languages) on local code; findings with file/line and fixes

How do I install com.offensive360/o360-mcp?

Clone com.offensive360/o360-mcp from https://github.com/offensive360/mcp-server and configure it as an MCP server in your client (Claude Desktop, Cursor, or VS Code).

Is com.offensive360/o360-mcp open source?

Yes, com.offensive360/o360-mcp is open source under the MIT license. Source code is available at https://github.com/offensive360/mcp-server.

What category does com.offensive360/o360-mcp belong to?

com.offensive360/o360-mcp is listed under File Systems MCP servers on MCPFind.

com.offensive360/o360-mcp — MCP Server for File Systems

Offensive360 MCP Server

Run Offensive360 SAST scans from inside your AI assistant. This Model Context Protocol server gives Claude Code, Claude Desktop, Cursor, and any other MCP client two tools:

Tool	What it does
`o360_scan_path`	Zips a local directory, runs a full SAST scan (60+ languages, taint/data-flow analysis), returns findings with file/line, severity, and fixes
`o360_scan_status`	Queue position of a running scan

Ask your assistant things like "scan this project with Offensive360 and fix the criticals" — it scans, reads the findings, and starts patching.

Setup

You need an Offensive360 External scan token:

Open-source / public repos: free — request one at offensive360.com/free-for-open-source
Commercial: any admin of your instance can create one under Settings → Tokens

Claude Code

claude mcp add offensive360 \
  -e O360_URL=https://sast.offensive360.com \
  -e O360_TOKEN=<your-token> \
  -- npx -y o360-mcp

Claude Desktop / Cursor (JSON)

{
  "mcpServers": {
    "offensive360": {
      "command": "npx",
      "args": ["-y", "o360-mcp"],
      "env": {
        "O360_URL": "https://sast.offensive360.com",
        "O360_TOKEN": "<your-token>"
      }
    }
  }
}

O360_URL can point at your own on-premise or air-gapped instance — the server talks only to the instance you configure.

Notes

Scans are synchronous; typical duration is 1–5 minutes depending on codebase size. The default client timeout is 900s (timeout_seconds parameter to override).
Common junk directories (node_modules, .git, dist, …) are excluded from the upload automatically; add more via the exclude parameter.
Findings are also visible in your Offensive360 dashboard with full data-flow traces.
Requires Node 18+.

About Offensive360

One platform for SAST, DAST, MAST, SCA, malware & binary analysis, and license compliance — flat pricing, cloud or fully air-gapped on-premise. offensive360.com · Book a demo

Set up in your AI client

AI clientOperating system

Merge this template into ~/Library/Application Support/Claude/claude_desktop_config.json. Keep existing servers. Add any arguments, credentials, and permissions required by the maintainer; this template has not been install-tested.

json

{
  "mcpServers": {
    "com-offensive360-o360-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "o360-mcp"
      ]
    }
  }
}

Restart Claude Desktop completely for changes to take effect. Confirm the server appears connected in the client’s tool list, then try a read-only example from its documentation.

Claude Desktop setup reference

Compatible MCP Clients

com.offensive360/o360-mcp works with any MCP-compatible client. Copy the config snippet from the Configuration section above and add it to the file shown for your client, then restart the application.

Claude Desktop~/Library/Application Support/Claude/claude_desktop_config.jsonRestart Claude Desktop completely for changes to take effect.

Cursor~/.cursor/mcp.jsonRestart Cursor for changes to take effect.

VS Code.vscode/mcp.jsonReload VS Code window for changes to take effect.

Windsurf~/.codeium/windsurf/mcp_config.jsonRestart Windsurf for changes to take effect.

Claude Code.mcp.jsonSave at the project root, then start Claude Code in that project and review the MCP server approval prompt. Keep real credentials out of shared files.

com.offensive360/o360-mcp