MCP server for Claude Code

Security scanning for AI-generated code — directly inside Claude Code.

SixthWall's MCP server integrates with Claude Code so you can scan for vulnerabilities, get explanations, and check your security score without leaving the conversation. Every finding includes a Fix Pack that Claude can apply automatically.

#Setup

The easiest way is npx @sixthwall/cli init, which writes a project .mcp.json. To register it yourself, run claude mcp add sixthwall -- npx -y @sixthwall/mcp-server, or add this to the project's .mcp.json:

{
  "mcpServers": {
    "sixthwall": {
      "command": "npx",
      "args": ["-y", "@sixthwall/mcp-server"]
    }
  }
}

Or point to a local install:

{
  "mcpServers": {
    "sixthwall": {
      "command": "node",
      "args": ["/path/to/node_modules/@sixthwall/mcp-server/dist/index.js"]
    }
  }
}

Restart Claude Code after adding the config.

#Tools

#scan_code

Scan code for security vulnerabilities.

Try it: "Scan my current changes for security issues"

Returns findings sorted by severity with file locations, evidence, plain English explanations, and fix prompts Claude can execute directly.

#explain_finding

Get a detailed explanation of a specific security rule.

Try it: "Explain rule AI-AUTH-003"

Returns what the rule detects, why it matters, how to fix it, and example vulnerable vs. safe code.

#security_score

Get the current security score for the project.

Try it: "What's my security score?"

Returns a 0–100 score with letter grade, finding breakdown by severity, and scan metadata.

#What It Detects

15 rules targeting patterns that AI coding tools generate constantly:

Secrets — Hardcoded API keys, env vars leaked to client bundles, .env not gitignored

Authentication — Missing auth middleware, client-side only auth checks, JWT without expiration, insecure cookies, plain text passwords

Injection — No input validation on req.body/req.query, SQL string concatenation

Configuration — CORS origin: '*', debug mode on, no rate limiting, verbose error messages

Headers — Express apps without helmet or security headers

Every finding includes a Fix Pack with a Claude prompt. When Claude Code receives the scan results, it can read the prompt and apply the fix in the same conversation.

#How It Works

The MCP server imports the SixthWall scanner engine directly — no subprocess spawning, no network calls. It uses tree-sitter for AST parsing and YAML-defined rules for deterministic pattern matching.

Same vulnerability → same finding → every time. No LLM involved in detection. Fully offline.

#CLI

For standalone usage outside Claude Code, install the CLI:

npm install -g @sixthwall/cli
sixthwall scan

Full documentation: @sixthwall/cli

sixthwall.dev · GitHub · @sixthwall