o360 mcp

Offensive360 MCP Server

Run Offensive360 SAST scans from inside your AI assistant. This Model Context Protocol server gives Claude Code, Claude Desktop, Cursor, and any other MCP client two tools:

Tool	What it does
o360_scan_path	Zips a local directory, runs a full SAST scan (60+ languages, taint/data-flow analysis), returns findings with file/line, severity, and fixes
o360_scan_status	Queue position of a running scan

Ask your assistant things like "scan this project with Offensive360 and fix the criticals" — it scans, reads the findings, and starts patching.

Setup

You need an Offensive360 External scan token:

• Open-source / public repos: free — request one at offensive360.com/free-for-open-source
• Commercial: any admin of your instance can create one under Settings → Tokens

Claude Code

claude mcp add offensive360 \
  -e O360_URL=https://sast.offensive360.com \
  -e O360_TOKEN=<your-token> \
  -- npx -y o360-mcp

Claude Desktop / Cursor (JSON)

{
  "mcpServers": {
    "offensive360": {
      "command": "npx",
      "args": ["-y", "o360-mcp"],
      "env": {
        "O360_URL": "https://sast.offensive360.com",
        "O360_TOKEN": "<your-token>"
      }
    }
  }
}

O360_URL can point at your own on-premise or air-gapped instance — the server talks only to the instance you configure.

Notes

• Scans are synchronous; typical duration is 1–5 minutes depending on codebase size. The default client timeout is 900s (timeout_seconds parameter to override).
• Common junk directories (node_modules, .git, dist, …) are excluded from the upload automatically; add more via the exclude parameter.
• Findings are also visible in your Offensive360 dashboard with full data-flow traces.
• Requires Node 18+.

About Offensive360

One platform for SAST, DAST, MAST, SCA, malware & binary analysis, and license compliance — flat pricing, cloud or fully air-gapped on-premise. offensive360.com · Book a demo