Ctrlk
Sign UpGet a DemoContact Us
For the complete documentation index, see llms.txt. This page is also available as Markdown.

MCP server

Integrating the Harness Code Security MCP server with AI coding agents

The Harness Code Security MCP server connects AI coding agents to Harness SAST and SCA. Agents can analyze code, list and triage findings, fetch data flows, request AutoFix recommendations, and look up package CVEs — without leaving the editor.

The npm package ships a bundled stdio MCP runtime and a launcher binary (harness-code-security-mcp). Analysis runs locally through the Harness SAST and SCA CLI (sl analyze); results upload to Qwiet AI by Harness.

Prerequisites

  • Node.js 20 or later

  • A Qwiet AI by Harness account and the Harness SAST and SCA CLI, authenticated with sl auth, so ~/.shiftleft/config.json contains orgId and accessToken

  • An MCP-compatible agent host (for example Cursor or Claude Code)

Install

Install the MCP server globally:

npm install -g harness-code-security-mcp

Alternatively, use npx in your MCP client configuration without a global install (see below).

Configure your agent

Add the MCP server to your agent's MCP settings. After saving the configuration, restart the agent host so the tools load (a new chat alone is usually not enough).

Add the following to your Cursor MCP configuration (for example Cursor Settings → MCP, or .cursor/mcp.json):

{
  "mcpServers": {
    "harness-code-security-mcp": {
      "command": "harness-code-security-mcp"
    }
  }
}

Or with npx (no global install):

{
  "mcpServers": {
    "harness-code-security-mcp": {
      "command": "npx",
      "args": ["-y", "harness-code-security-mcp"]
    }
  }
}

Restart Cursor (quit and reopen, or Developer: Reload Window), then confirm tools such as sl_whoami appear in the MCP tool list.

From a terminal (or via Bash inside a Claude Code session):

claude mcp add harness-code-security-mcp -- npx -y harness-code-security-mcp

If -- parsing fails, use JSON:

claude mcp add-json harness-code-security-mcp '{"type":"stdio","command":"npx","args":["-y","harness-code-security-mcp"]}'

Windows:

claude mcp add harness-code-security-mcp -- cmd /c npx -y harness-code-security-mcp

Fully exit and restart Claude Code, then run /mcp to verify the connection. Tool names may be prefixed (for example mcp__harness-code-security-mcp__sl_whoami).

Point your MCP client at the harness-code-security-mcp command (or npx -y harness-code-security-mcp) over stdio. See your client's documentation for where to register MCP servers.

Optional environment variables

Defaults are usually enough (QWIET_API_HOST=app.shiftleft.io, SL_HOME=~/.shiftleft). Override only when needed:

You can also set WORKSPACE_FOLDER when the agent needs an explicit project path for AutoFix edits.

Authenticate

Install and authenticate the Harness SAST and SCA CLI if you have not already:

Confirm ~/.shiftleft/config.json contains orgId and accessToken.

In a new agent session after MCP is connected, call sl_whoami. Success returns an activeOrganizationId that matches the orgId in your config.

API tools use the organization from config.json only. To work in another organization, re-run sl auth with that org's credentials, then restart or reconnect the MCP server.

The MCP server can install or update the CLI under ~/.shiftleft. Prefer calling sl_ensure_cli before the first sl_analyze so install errors return quickly; sl_analyze can also install or update the CLI when it is missing.

What you can do

Typical agent workflows:

  • Analyze — sl_ensure_cli, then sl_analyze on the workspace (optional app and branch; defaults to the folder name and current git branch)

  • Triage — sl_list_findings for counts and top actionable findings, then sl_get_findings / dataflow tools for detail

  • Remediate — request and fetch AutoFix recommendations, then apply suggested edits

  • Package CVEs — sl_lookup_package_cves with package URLs (PURLs) for CVEs and licenses

Tools

Tool
Description

sl_whoami

Show the authenticated user and active organization (orgId from config)

sl_ensure_cli

Install or update the Harness SAST and SCA CLI under ~/.shiftleft

sl_analyze

Run local sl analyze --wait, upload results, and return scan_id (creates the app if needed)

sl_list_applications

List applications in the active organization (optional; not required before analyze)

sl_list_branch_scans

List scans for an application branch

sl_list_findings

Summarize findings for a scan (counts, top_actionable)

sl_get_finding / sl_get_findings

Fetch one or more findings by ID

sl_get_finding_dataflow / sl_get_finding_dataflows

Fetch data flows for findings

sl_request_finding_fix

Request generation of an AutoFix for a finding (async)

sl_get_recommended_fix / sl_get_recommended_fixes

Fetch AutoFix recommendations (may include edits[])

sl_list_branch_autofixes

List AutoFix metadata for findings on a branch

sl_lookup_package_cves

Look up CVEs and licenses for package URLs (PURLs)

Your agent host may prefix tool names (for example mcp__harness-code-security-mcp__sl_whoami).

Agent Skills

To help agents use these tools effectively, Harness SAST and SCA provides Agent Skills for analyzing code, triaging findings, and applying fixes. Install them from the ShiftLeftSecurity/skills repository:

Launcher options

The harness-code-security-mcp launcher checks for a newer npm-published runtime at startup at most once per day and falls back to the bundled runtime if the update check fails.

Flag
Description

--no-auto-update

Disable startup update checks

--version-pin x.y.z

Run a specific npm package version from the launcher's local cache

--debug

Print launcher diagnostics to stderr

The launcher never writes progress to stdout during normal MCP operation; stdout is reserved for MCP JSON-RPC.

Related

PreviousClaude Code
NextSAML integration and SSO

Last updated

Was this helpful?