> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/ai-sca/prezero/integrations/mcp.md).

# MCP server

Integrating the Harness Code Security MCP server with AI coding agents

The Harness Code Security MCP server connects AI coding agents to Harness SAST and SCA. Agents can analyze code, list and triage findings, fetch data flows, request AutoFix recommendations, and look up package CVEs — without leaving the editor.

The npm package ships a bundled stdio MCP runtime and a launcher binary (`harness-code-security-mcp`). Analysis runs locally through the Harness SAST and SCA CLI (`sl analyze`); results upload to Qwiet AI by Harness.

## Prerequisites <a href="#prerequisites" id="prerequisites"></a>

* Node.js 20 or later
* A Qwiet AI by Harness account and the Harness SAST and SCA CLI, authenticated with `sl auth`, so `~/.shiftleft/config.json` contains `orgId` and `accessToken`
* An MCP-compatible agent host (for example Cursor or Claude Code)

## Install <a href="#install" id="install"></a>

Install the MCP server globally:

```bash
npm install -g harness-code-security-mcp
```

Alternatively, use `npx` in your MCP client configuration without a global install (see below).

## Configure your agent <a href="#configure-your-agent" id="configure-your-agent"></a>

Add the MCP server to your agent's MCP settings. After saving the configuration, restart the agent host so the tools load (a new chat alone is usually not enough).

{% tabs %}
{% tab title="Cursor" %}
Add the following to your Cursor MCP configuration (for example Cursor Settings → MCP, or `.cursor/mcp.json`):

```json
{
  "mcpServers": {
    "harness-code-security-mcp": {
      "command": "harness-code-security-mcp"
    }
  }
}
```

Or with `npx` (no global install):

```json
{
  "mcpServers": {
    "harness-code-security-mcp": {
      "command": "npx",
      "args": ["-y", "harness-code-security-mcp"]
    }
  }
}
```

Restart Cursor (quit and reopen, or **Developer: Reload Window**), then confirm tools such as `sl_whoami` appear in the MCP tool list.
{% endtab %}

{% tab title="Claude Code" %}
From a terminal (or via Bash inside a Claude Code session):

```bash
claude mcp add harness-code-security-mcp -- npx -y harness-code-security-mcp
```

If `--` parsing fails, use JSON:

```bash
claude mcp add-json harness-code-security-mcp '{"type":"stdio","command":"npx","args":["-y","harness-code-security-mcp"]}'
```

Windows:

```bash
claude mcp add harness-code-security-mcp -- cmd /c npx -y harness-code-security-mcp
```

Fully exit and restart Claude Code, then run `/mcp` to verify the connection. Tool names may be prefixed (for example `mcp__harness-code-security-mcp__sl_whoami`).
{% endtab %}

{% tab title="Other agents" %}
Point your MCP client at the `harness-code-security-mcp` command (or `npx -y harness-code-security-mcp`) over stdio. See your client's documentation for where to register MCP servers.

```json
{
  "mcpServers": {
    "harness-code-security-mcp": {
      "command": "harness-code-security-mcp"
    }
  }
}
```

{% endtab %}
{% endtabs %}

### Optional environment variables <a href="#optional-environment-variables" id="optional-environment-variables"></a>

Defaults are usually enough (`QWIET_API_HOST=app.shiftleft.io`, `SL_HOME=~/.shiftleft`). Override only when needed:

```json
{
  "mcpServers": {
    "harness-code-security-mcp": {
      "command": "harness-code-security-mcp",
      "env": {
        "QWIET_API_HOST": "app.shiftleft.io",
        "SL_HOME": "${HOME}/.shiftleft"
      }
    }
  }
}
```

You can also set `WORKSPACE_FOLDER` when the agent needs an explicit project path for AutoFix edits.

## Authenticate <a href="#authenticate" id="authenticate"></a>

Install and authenticate the Harness SAST and SCA CLI if you have not already:

```bash
sl auth
```

Confirm `~/.shiftleft/config.json` contains `orgId` and `accessToken`.

In a new agent session after MCP is connected, call `sl_whoami`. Success returns an `activeOrganizationId` that matches the `orgId` in your config.

API tools use the organization from `config.json` only. To work in another organization, re-run `sl auth` with that org's credentials, then restart or reconnect the MCP server.

The MCP server can install or update the CLI under `~/.shiftleft`. Prefer calling `sl_ensure_cli` before the first `sl_analyze` so install errors return quickly; `sl_analyze` can also install or update the CLI when it is missing.

## What you can do <a href="#what-you-can-do" id="what-you-can-do"></a>

Typical agent workflows:

* **Analyze** — `sl_ensure_cli`, then `sl_analyze` on the workspace (optional app and branch; defaults to the folder name and current git branch)
* **Triage** — `sl_list_findings` for counts and top actionable findings, then `sl_get_findings` / dataflow tools for detail
* **Remediate** — request and fetch AutoFix recommendations, then apply suggested edits
* **Package CVEs** — `sl_lookup_package_cves` with package URLs (PURLs) for CVEs and licenses

### Tools <a href="#tools" id="tools"></a>

| Tool                                                   | Description                                                                                     |
| ------------------------------------------------------ | ----------------------------------------------------------------------------------------------- |
| `sl_whoami`                                            | Show the authenticated user and active organization (`orgId` from config)                       |
| `sl_ensure_cli`                                        | Install or update the Harness SAST and SCA CLI under `~/.shiftleft`                             |
| `sl_analyze`                                           | Run local `sl analyze --wait`, upload results, and return `scan_id` (creates the app if needed) |
| `sl_list_applications`                                 | List applications in the active organization (optional; not required before analyze)            |
| `sl_list_branch_scans`                                 | List scans for an application branch                                                            |
| `sl_list_findings`                                     | Summarize findings for a scan (counts, top\_actionable)                                         |
| `sl_get_finding` / `sl_get_findings`                   | Fetch one or more findings by ID                                                                |
| `sl_get_finding_dataflow` / `sl_get_finding_dataflows` | Fetch data flows for findings                                                                   |
| `sl_request_finding_fix`                               | Request generation of an AutoFix for a finding (async)                                          |
| `sl_get_recommended_fix` / `sl_get_recommended_fixes`  | Fetch AutoFix recommendations (may include `edits[]`)                                           |
| `sl_list_branch_autofixes`                             | List AutoFix metadata for findings on a branch                                                  |
| `sl_lookup_package_cves`                               | Look up CVEs and licenses for package URLs (PURLs)                                              |

Your agent host may prefix tool names (for example `mcp__harness-code-security-mcp__sl_whoami`).

## Agent Skills <a href="#agent-skills" id="agent-skills"></a>

To help agents use these tools effectively, Harness SAST and SCA provides Agent Skills for analyzing code, triaging findings, and applying fixes. Install them from the `ShiftLeftSecurity/skills` repository:

```bash
npx skills add ShiftLeftSecurity/skills --skill '*'
```

## Launcher options <a href="#launcher-options" id="launcher-options"></a>

The `harness-code-security-mcp` launcher checks for a newer npm-published runtime at startup at most once per day and falls back to the bundled runtime if the update check fails.

| Flag                  | Description                                                        |
| --------------------- | ------------------------------------------------------------------ |
| `--no-auto-update`    | Disable startup update checks                                      |
| `--version-pin x.y.z` | Run a specific npm package version from the launcher's local cache |
| `--debug`             | Print launcher diagnostics to stderr                               |

The launcher never writes progress to stdout during normal MCP operation; stdout is reserved for MCP JSON-RPC.

## Related <a href="#related" id="related"></a>

* [Secure AI Coding](/ai-sca/prezero/secure-ai-coding-ai-assisted-development.md) — real-time hooks in Cursor, Windsurf, and Claude Code
* [Cursor](/ai-sca/prezero/integrations/cursor.md), [Windsurf](/ai-sca/prezero/integrations/windsurf.md), and [Claude Code](/ai-sca/prezero/integrations/claude.md) IDE extensions
* [AutoFix](/ai-sca/prezero/autofix.md)
* [npm package](https://www.npmjs.com/package/harness-code-security-mcp)

{% @harness-feedback/feedback %}