o360-mcp — Claude Code MCP server: what it does, how to install
Connects Offensive360 SAST security scanning directly to your coding assistant to spot flaws and draft fixes.
claude mcp add --env O360_URL=<O360_URL> --env O360_TOKEN=<O360_TOKEN> --transport stdio o360-mcp -- npx -y o360-mcpWhat o360-mcp does
The server provides two primary actions: o360_scan_path and o360_scan_status. When called, it zips the target directory and uploads it to an Offensive360 instance. The platform analyzes source code across 60+ programming languages, returning findings complete with file paths, line numbers, severity markers, and remediation suggestions.
Node 18+ is required on the host system. You need an O360_TOKEN environment variable, while O360_URL allows redirecting traffic to private or air-gapped instances. Standard junk folders like dist or node_modules stay out of the upload bundle automatically.
What it helps with
- detect security vulnerabilities across 60+ programming languages
- receive exact file paths and line numbers for automated patching
- monitor active scan progress inside the processing queue
- audit code against private or air-gapped instances
Example prompts for the agent
- Scan this repository with Offensive360 and patch any critical issues
- Check the current status of my Offensive360 security scan
- Run SAST analysis on the ./backend directory excluding tests
How to install o360-mcp
Platform CLI
claude mcp add --env O360_URL=<O360_URL> --env O360_TOKEN=<O360_TOKEN> --transport stdio o360-mcp -- npx -y o360-mcpReplace <…> with your own values
Platform CLI
codex mcp add o360-mcp --env O360_URL=<O360_URL> --env O360_TOKEN=<O360_TOKEN> -- npx -y o360-mcpReplace <…> with your own values
Config file
{
"mcpServers": {
"o360-mcp": {
"command": "npx",
"args": [
"-y",
"o360-mcp"
],
"env": {
"O360_URL": "<O360_URL>",
"O360_TOKEN": "<O360_TOKEN>"
}
}
}
}Replace <…> with your own values
Config file
{
"servers": {
"o360-mcp": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"o360-mcp"
],
"env": {
"O360_URL": "<O360_URL>",
"O360_TOKEN": "<O360_TOKEN>"
}
}
}
}Replace <…> with your own values
Platform CLI
gemini mcp add -e O360_URL=<O360_URL> -e O360_TOKEN=<O360_TOKEN> o360-mcp npx -y o360-mcpReplace <…> with your own values
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about o360-mcp
How to install o360-mcp in Claude Code?
Run claude mcp add o360-mcp -e O360_TOKEN=<O360_TOKEN> -- npx -y o360-mcp in your terminal. Replace <O360_TOKEN> with your external scan key.
What does o360-mcp do?
It registers two tools (o360_scan_path and o360_scan_status) so your AI assistant can trigger static security scans and fix reported issues.
Can o360-mcp work with self-hosted servers?
Yes, pass your private server address through the O360_URL environment variable during client setup.
