Contrast-Security-OSS/mcp-contrast
If you are the rightful owner of mcp-contrast and would like to certify it and/or have it hosted online, please leave a comment on the right or send an email to henry@mcphub.com.
Contrast MCP Server is designed to help developers and security professionals quickly remediate vulnerabilities using Contrast's unique vulnerability data combined with LLM and coding agents.
Tools
Functions exposed to the LLM to take actions
list_application_libraries_by_app_id
Takes a application ID and returns the libraries used in the application, note if class usage count is 0 the library is unlikely to be used
get_ADR_Protect_Rules
takes a application name and returns the protect / adr rules for the application
get_application_route_coverage_by_app_id
takes a application id and return the route coverage data for that application. If a route/endpoint is DISCOVERED, it means it has been found by Assess but that route has had no inbound http requests. If it is EXERCISED, it means it has had atleast one inbound http request to that route/endpoint.
list_session_metadata_for_application
Takes an application name ( app_name ) and returns a list of session metadata for the latest session matching that application name. This is useful for getting the most recent session metadata without needing to specify session metadata.
get_applications_by_tag
Takes a tag name and returns a list of applications that have that tag.
list_Scan_Results
takes a scan project name and returns the latest results in Sarif format
get_application_route_coverage_by_app_name_latest_session
takes a application name and return the route coverage data for that application from the latest session. If a route/endpoint is DISCOVERED, it means it has been found by Assess but that route has had no inbound http requests. If it is EXERCISED, it means it has had atleast one inbound http request to that route/endpoint.
list_Scan_Project
takes a scan project name and returns the project details
list_vulnerabilities
Takes an application name ( app_name ) and returns a list of vulnerabilities, please remember to include the vulnID in the response.
get_vulnerability_by_id
takes a vulnerability ID ( vulnID ) and Application ID ( appID ) and returns details about the specific security vulnerability. If based on the stacktrace, the vulnerability looks like it is in code that is not in the codebase, the vulnerability may be in a 3rd party library, review the CVE data attached to that stackframe you believe the vulnerability exists in and if possible upgrade that library to the next non vulnerable version based on the remediation guidance.
list_application_libraries
takes a application name and returns the libraries used in the application, note if class usage count is 0 the library is unlikely to be used
get_ADR_Protect_Rules_by_app_id
takes a application ID and returns the protect / adr rules for the application
list_vulnerabilities_by_application_and_latest_session
Takes an application name ( app_name ) and returns a list of vulnerabilities for the latest session matching that application name. This is useful for getting the most recent vulnerabilities without needing to specify session metadata.
get_applications_by_metadata_name
Takes a metadata name a list of applications that have that metadata name.
get_vulnerability
Takes a vulnerability ID (vulnID) and application name (app_name) and returns details about the specific security vulnerability. If based on the stacktrace, the vulnerability looks like it is in code that is not in the codebase, the vulnerability may be in a 3rd party library, review the CVE data attached to that stackframe you believe the vulnerability exists in and if possible upgrade that library to the next non vulnerable version based on the remediation guidance.
list_applications_with_name
Takes an application name (app_name) returns a list of active applications that contain that name. Please remember to display the name, status and ID.
list_vulnerabilities_by_application_and_session_metadata
Takes an application name ( app_name ) and session metadata in the form of name / value. and returns a list of vulnerabilities matching that application name and session metadata.
get_applications_by_metadata
Takes a metadata name and value and returns a list of applications that have that metadata name value pair.
list_vulnerabilities_with_id
Takes a Application ID ( appID ) and returns a list of vulnerabilities, please remember to include the vulnID in the response.
get_application_route_coverage_by_app_name_and_session_metadata
takes a application name and return the route coverage data for that application for the specified session metadata name and value. If a route/endpoint is DISCOVERED, it means it has been found by Assess but that route has had no inbound http requests. If it is EXERCISED, it means it has had at least one inbound http request to that route/endpoint.
list_applications_vulnerable_to_cve
takes a cve id and returns the applications and servers vulnerable to the cve. Please note if the application class usage is 0, its unlikely to be vulnerable
get_application_route_coverage_by_app_id_latest_session
takes a application id and return the route coverage data for that application from the latest session. If a route/endpoint is DISCOVERED, it means it has been found by Assess but that route has had no inbound http requests. If it is EXERCISED, it means it has had atleast one inbound http request to that route/endpoint.
get_application_route_coverage_by_app_id_and_session_metadata
takes a application id and return the route coverage data for that application for the specified session metadata name and value. If a route/endpoint is DISCOVERED, it means it has been found by Assess but that route has had no inbound http requests. If it is EXERCISED, it means it has had at least one inbound http request to that route/endpoint.
list_all_applications
Takes no argument and list all the applications
get_application_route_coverage
takes a application name and return the route coverage data for that application. If a route/endpoint is DISCOVERED, it means it has been found by Assess but that route has had no inbound http requests. If it is EXERCISED, it means it has had atleast one inbound http request to that route/endpoint.
Prompts
Interactive templates invoked by user choice
No prompts
Resources
Contextual data attached and managed by the client
