Offensive360 SAST

Offensive360 MCP伺服器：在60多種語言中執行靜態應用程式安全（SAST）掃描，並從Claude、Cursor及其他MCP客戶端讀取帶有安全程式碼修復的發現結果。可與Offensive3搭配使用。

文件

Offensive360 MCP Server

Run Offensive360 SAST scans from inside your AI assistant. This Model Context Protocol server gives Claude Code, Claude Desktop, Cursor, and any other MCP client two tools:

Tool	What it does
`o360_scan_path`	Zips a local directory, runs a full SAST scan (60+ languages, taint/data-flow analysis), returns findings with file/line, severity, and fixes
`o360_scan_status`	Queue position of a running scan

Ask your assistant things like "scan this project with Offensive360 and fix the criticals" — it scans, reads the findings, and starts patching.

Setup

You need an Offensive360 External scan token:

Open-source / public repos: free — request one at offensive360.com/free-for-open-source
Commercial: any admin of your instance can create one under Settings → Tokens

Claude Code

claude mcp add offensive360 \
  -e O360_URL=https://sast.offensive360.com \
  -e O360_TOKEN=<your-token> \
  -- npx -y o360-mcp

Claude Desktop / Cursor (JSON)

{
  "mcpServers": {
    "offensive360": {
      "command": "npx",
      "args": ["-y", "o360-mcp"],
      "env": {
        "O360_URL": "https://sast.offensive360.com",
        "O360_TOKEN": "<your-token>"
      }
    }
  }
}

O360_URL can point at your own on-premise or air-gapped instance — the server talks only to the instance you configure.

Notes

Scans are synchronous; typical duration is 1–5 minutes depending on codebase size. The default client timeout is 900s (timeout_seconds parameter to override).
Common junk directories (node_modules, .git, dist, …) are excluded from the upload automatically; add more via the exclude parameter.
Findings are also visible in your Offensive360 dashboard with full data-flow traces.
Requires Node 18+.

About Offensive360

One platform for SAST, DAST, MAST, SCA, malware & binary analysis, and license compliance — flat pricing, cloud or fully air-gapped on-premise. offensive360.com · Book a demo