# stackhawk

Connects coding assistants with StackHawk for automated vulnerability checks. It inspects configurations and brings scan alerts directly into the chat.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 9
- Author: stackhawk
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/stackhawk/stackhawk-mcp
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/mcp/stackhawk

## What it does

This MCP bridge connects coding assistants to the StackHawk security platform. It generates a valid `stackhawk.yml` file and verifies configuration fields against the official schema. Schema validation stops the model from hallucinating syntax.

Developers can initiate security scans and inspect findings that meet the alert threshold directly in chat. Running the server requires Python 3.10 or newer. Without the `STACKHAWK_API_KEY` environment variable, API requests cannot execute.

## Requirements
- Needs: Python and uv (commands run via uvx)
- Environment variables: `STACKHAWK_API_KEY` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add stackhawk -e STACKHAWK_API_KEY=<STACKHAWK_API_KEY> -- uvx stackhawk-mcp
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from stackhawk-mcp <command>

### Codex

**Platform CLI**
```bash
codex mcp add stackhawk --env STACKHAWK_API_KEY=<STACKHAWK_API_KEY> -- uvx stackhawk-mcp
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from stackhawk-mcp <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "stackhawk": {
            "command": "uvx",
            "args": [
                "stackhawk-mcp"
            ],
            "env": {
                "STACKHAWK_API_KEY": "<STACKHAWK_API_KEY>"
            }
        }
    }
}
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from stackhawk-mcp <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "stackhawk": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "stackhawk-mcp"
            ],
            "env": {
                "STACKHAWK_API_KEY": "<STACKHAWK_API_KEY>"
            }
        }
    }
}
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from stackhawk-mcp <command>

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e STACKHAWK_API_KEY=<STACKHAWK_API_KEY> stackhawk uvx stackhawk-mcp
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from stackhawk-mcp <command>

## When to use it
- generate a `stackhawk.yml` file for your codebase
- validate configuration parameters against the official schema
- start dynamic application scans from the chat window
- review security vulnerabilities exceeding the failure threshold

## Example prompts
- Validate our stackhawk.yml file against the official schema.
- Create a new StackHawk configuration for this application.
- Fetch scan findings that exceed our failure threshold.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12110
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7718
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2066
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1816

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md