Stackhawk MCP Server

Current Version: 1.2.5 _Requires Python 3.10 or higher_ A Model Context Protocol (MCP) server for integrating with StackHawk's security scanning platform. Helps developers set up StackHawk, run security scans, and triage findings to fix vulnerabilities - all from within an LLM-powered IDE or chat. Its 7 documented tools cover stackhawk, for, validate.

People connecting security tools to Claude, Cursor, VS Code, or another MCP client. The project is written in Python.

VERIFIED ACTIVE

LAST COMMIT 2026-04-13 · ★ 9 · #104 OF 182 MAINTAINED SECURITY · VERIFIED 2026-08-25

NOASSERTION · Python servers · how we verify → /methodology

01 · Install Stackhawk

before you install - you'll need

Set STACKHAWK_API_KEY before connecting.

Claude Code

claude mcp add stackhawk-stackhawk-mcp -- uvx stackhawk-mcp

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "stackhawk-stackhawk-mcp": {
      "command": "uvx",
      "args": [
        "stackhawk-mcp"
      ]
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as local process (stdio) - runs on your machine with your user's permissions

license no standard license detected - usage rights unclear; check the repo before commercial use

pypi package stackhawk-mcp - check the name against the project README before installing (PyPI has no namespace ownership)

registry vendor namespace com.stackhawk - domain-verified with the official MCP registry

03 · What Stackhawk can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

What you can build

With this server connected, an agent can get org details, teams, and applications, list applications in an organization, detect language, find/create app, generate stackhawk.yml, and check if a field path is valid in the schema (anti-hallucination).

Capability map

Tools grouped from the project's README - what Stackhawk lets an agent do.

read & search

3 tools - e.g. Get org details, teams, and applications; List applications in an organization; Get findings at/above the configured failure threshold

get_organization_info · list_applications · get_app_findings_for_triage

Validate

2 tools - e.g. Validate YAML against the official StackHawk schema; Check if a field path is valid in the schema (anti-hallucination)

validate_stackhawk_config · validate_field_exists

update

1 tool - e.g. Detect language, find/create app, generate stackhawk.yml

setup_stackhawk_for_project

run & execute

1 tool - e.g. Run a StackHawk scan via the CLI (returns install help if CLI is missing)

run_stackhawk_scan

Latest releases

v0.1.0 · 2025-07-07

04 · Who maintains Stackhawk

stackhawk is maintained by stackhawk. It's the only MCP server we track from this author; the repo dates to Jul 2025.

05 · Facts

repository: github.com/stackhawk/stackhawk-mcp
category: security - ranked #104 of 182 actively-maintained security servers as of 2026-08-25.
registry: com.stackhawk/stackhawk (active, first published 2025-10-31)
packages: pypi:stackhawk-mcp

06 · Stackhawk FAQ

Is Stackhawk still maintained?

Yes - as of 2026-08-25, its last commit was 2026-04-13. We re-verify nightly.

What can Stackhawk do?

How do I install Stackhawk?

Run `uvx stackhawk-mcp`. The README documents one environment variable (STACKHAWK_API_KEY) to set first. Set STACKHAWK_API_KEY before connecting. You can also paste the ready-made client config above.

Does Stackhawk run locally?

Yes - it's a stdio server: it runs on your machine (via uvx) with your user's permissions. Your data stays local unless the server itself calls external APIs.

07 · Alternatives to Stackhawk

Alternatives to Stackhawk

Maintained security servers if Stackhawk isn't the fit.

Pairs well with

Servers that cover what Stackhawk doesn't - only shown when the pairing reason fits the companion.

More security MCP servers · Starlog · Code Inspectus · Wass MCP · Universal Connector MCP · Totem

More Python MCP servers · SEC EDGAR Filings MCP · Cyberbro MCP Server · Inav MCP · Apache Pinot MCP Server · Sec Edgar MCP · see all