# o360-mcp

Connects Offensive360 SAST security scanning directly to your coding assistant to spot flaws and draft fixes.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI
- Author: offensive360
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/offensive360/mcp-server
- Updated: 2026-08-02
- HTML: https://affpapa.org/en/nevibecode/mcp/o360-mcp

## What it does

The server provides two primary actions: `o360_scan_path` and `o360_scan_status`. When called, it zips the target directory and uploads it to an Offensive360 instance. The platform analyzes source code across 60+ programming languages, returning findings complete with file paths, line numbers, severity markers, and remediation suggestions.

Node 18+ is required on the host system. You need an `O360_TOKEN` environment variable, while `O360_URL` allows redirecting traffic to private or air-gapped instances. Standard junk folders like `dist` or `node_modules` stay out of the upload bundle automatically.

## Requirements
- Needs: Node.js (commands run via npx)
- Environment variables: `O360_URL`, `O360_TOKEN` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add --env O360_URL=<O360_URL> --env O360_TOKEN=<O360_TOKEN> --transport stdio o360-mcp -- npx -y o360-mcp
```
Replace <…> with your own values

### Codex

**Platform CLI**
```bash
codex mcp add o360-mcp --env O360_URL=<O360_URL> --env O360_TOKEN=<O360_TOKEN> -- npx -y o360-mcp
```
Replace <…> with your own values

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "o360-mcp": {
            "command": "npx",
            "args": [
                "-y",
                "o360-mcp"
            ],
            "env": {
                "O360_URL": "<O360_URL>",
                "O360_TOKEN": "<O360_TOKEN>"
            }
        }
    }
}
```
Replace <…> with your own values

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "o360-mcp": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "o360-mcp"
            ],
            "env": {
                "O360_URL": "<O360_URL>",
                "O360_TOKEN": "<O360_TOKEN>"
            }
        }
    }
}
```
Replace <…> with your own values

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e O360_URL=<O360_URL> -e O360_TOKEN=<O360_TOKEN> o360-mcp npx -y o360-mcp
```
Replace <…> with your own values

## When to use it
- detect security vulnerabilities across 60+ programming languages
- receive exact file paths and line numbers for automated patching
- monitor active scan progress inside the processing queue
- audit code against private or air-gapped instances

## Example prompts
- Scan this repository with Offensive360 and patch any critical issues
- Check the current status of my Offensive360 security scan
- Run SAST analysis on the ./backend directory excluding tests

## Similar
- [security-reviewer](https://affpapa.org/en/nevibecode/skills/security-reviewer.md) — skill · 6000 installs
- [golang-security](https://affpapa.org/en/nevibecode/skills/golang-security.md) — skill · 42300 installs
- [find-security-vulnerabilities-in-code](https://affpapa.org/en/nevibecode/skills/find-security-vulnerabilities-in-code.md) — skill · 12500 installs
- [codeql](https://affpapa.org/en/nevibecode/skills/trailofbits-codeql.md) — skill · 8300 installs
- [security-review](https://affpapa.org/en/nevibecode/skills/security-review.md) — skill · 5500 installs
- [ghost-scan-code](https://affpapa.org/en/nevibecode/skills/ghost-scan-code.md) — skill · 5200 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md