stackhawk — Claude Code MCP server: what it does, how to install
Connects coding assistants with StackHawk for automated vulnerability checks. It inspects configurations and brings scan alerts directly into the chat.
claude mcp add stackhawk -e STACKHAWK_API_KEY=<STACKHAWK_API_KEY> -- uvx stackhawk-mcpWhat stackhawk does
This MCP bridge connects coding assistants to the StackHawk security platform. It generates a valid stackhawk.yml file and verifies configuration fields against the official schema. Schema validation stops the model from hallucinating syntax.
Developers can initiate security scans and inspect findings that meet the alert threshold directly in chat. Running the server requires Python 3.10 or newer. Without the STACKHAWK_API_KEY environment variable, API requests cannot execute.
What it helps with
- generate a
stackhawk.ymlfile for your codebase - validate configuration parameters against the official schema
- start dynamic application scans from the chat window
- review security vulnerabilities exceeding the failure threshold
Example prompts for the agent
- Validate our stackhawk.yml file against the official schema.
- Create a new StackHawk configuration for this application.
- Fetch scan findings that exceed our failure threshold.
How to install stackhawk
Platform CLI
claude mcp add stackhawk -e STACKHAWK_API_KEY=<STACKHAWK_API_KEY> -- uvx stackhawk-mcpReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from stackhawk-mcp <command>
Platform CLI
codex mcp add stackhawk --env STACKHAWK_API_KEY=<STACKHAWK_API_KEY> -- uvx stackhawk-mcpReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from stackhawk-mcp <command>
Config file
{
"mcpServers": {
"stackhawk": {
"command": "uvx",
"args": [
"stackhawk-mcp"
],
"env": {
"STACKHAWK_API_KEY": "<STACKHAWK_API_KEY>"
}
}
}
}Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from stackhawk-mcp <command>
Config file
{
"servers": {
"stackhawk": {
"type": "stdio",
"command": "uvx",
"args": [
"stackhawk-mcp"
],
"env": {
"STACKHAWK_API_KEY": "<STACKHAWK_API_KEY>"
}
}
}
}Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from stackhawk-mcp <command>
Platform CLI
gemini mcp add -e STACKHAWK_API_KEY=<STACKHAWK_API_KEY> stackhawk uvx stackhawk-mcpReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from stackhawk-mcp <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about stackhawk
How do I install stackhawk in Claude Code?
Run claude mcp add stackhawk -e STACKHAWK_API_KEY=<STACKHAWK_API_KEY> -- uvx stackhawk-mcp. Replace <STACKHAWK_API_KEY> with your actual token before running the command.
What does the stackhawk MCP server do?
It exposes StackHawk security tools to your coding assistant. The server validates YAML configurations against schemas and fetches vulnerability reports directly into the conversation.
What are the runtime requirements for stackhawk?
The package requires Python 3.10 or higher. You must also supply a valid STACKHAWK_API_KEY variable inside your working environment.
