English Français العربية

com.offensive360/o360-mcp

Official registry Developer tools

Run Offensive360 SAST scans (60+ languages) on local code; findings with file/line and fixes

Source code Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

NPM package o360-mcp
Claude Code 
claude mcp add o360-mcp -e 'O360_URL=https://sast.offensive360.com' -e 'O360_TOKEN=<your o360_token>' -- npx -y o360-mcp@1.0.2
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "o360-mcp": {
            "command": "npx",
            "args": [
                "-y",
                "o360-mcp@1.0.2"
            ],
            "env": {
                "O360_URL": "https://sast.offensive360.com",
                "O360_TOKEN": "<your o360_token>"
            }
        }
    }
}

Environment variables

  • O360_URL Offensive360 instance base URL
  • O360_TOKEN required secret External scan token (free for public repos: https://offensive360.com/free-for-open-source/)

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. Offensive360 MCP Server
  2. Setup
  3. Notes
  4. About Offensive360

Offensive360 MCP Server

Run Offensive360 SAST scans from inside your AI assistant. This Model Context Protocol server gives Claude Code, Claude Desktop, Cursor, and any other MCP client two tools:

ToolWhat it does
o360_scan_pathZips a local directory, runs a full SAST scan (60+ languages, taint/data-flow analysis), returns findings with file/line, severity, and fixes
o360_scan_statusQueue position of a running scan

Ask your assistant things like "scan this project with Offensive360 and fix the criticals" — it scans, reads the findings, and starts patching.

Setup

You need an Offensive360 External scan token:

Claude Code
claude mcp add offensive360 \
  -e O360_URL=https://sast.offensive360.com \
  -e O360_TOKEN=<your-token> \
  -- npx -y o360-mcp
Claude Desktop / Cursor (JSON)
{
  "mcpServers": {
    "offensive360": {
      "command": "npx",
      "args": ["-y", "o360-mcp"],
      "env": {
        "O360_URL": "https://sast.offensive360.com",
        "O360_TOKEN": "<your-token>"
      }
    }
  }
}

O360_URL can point at your own on-premise or air-gapped instance — the server talks only to the instance you configure.

Notes

  • Scans are synchronous; typical duration is 1–5 minutes depending on codebase size. The default client timeout is 900s (timeout_seconds parameter to override).
  • Common junk directories (node_modules, .git, dist, …) are excluded from the upload automatically; add more via the exclude parameter.
  • Findings are also visible in your Offensive360 dashboard with full data-flow traces.
  • Requires Node 18+.

About Offensive360

One platform for SAST, DAST, MAST, SCA, malware & binary analysis, and license compliance — flat pricing, cloud or fully air-gapped on-premise. offensive360.com · Book a demo

Frequently asked questions

What is com.offensive360/o360-mcp?

Run Offensive360 SAST scans (60+ languages) on local code; findings with file/line and fixes

How do I install com.offensive360/o360-mcp?

It runs on your machine. In Claude Code: claude mcp add o360-mcp -e 'O360_URL=https://sast.offensive360.com' -e 'O360_TOKEN=<your o360_token>' -- npx -y o360-mcp@1.0.2. For other clients, paste the JSON configuration from this page into their MCP settings.

Does com.offensive360/o360-mcp need an API key?

Yes. It expects O360_TOKEN, which you set in its configuration.

Is com.offensive360/o360-mcp open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains com.offensive360/o360-mcp?

It is published by offensive360. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.