Mend MCP Server – AI Code Security Checks
Mend Agentic Integration exposes Mend security guidance through an MCP server so AI coding agents can check generated code, proposed dependencies, and selected Mend AppSec Platform findings during development.
Overview
Mend provides an MCP server as part of its Agentic Integration for AI-assisted development. The integration lets an IDE agent call Mend tools while code is being written, so the agent can check generated source code for CWEs and proposed dependencies for known CVEs before changes are accepted into a project.
What the MCP server enables
The Mend MCP server is documented for workflows such as Cursor, Claude Code, Windsurf, Gemini CLI, Gemini Code Assist, VS Code Copilot, Kiro, and Antigravity. In the Cursor documentation, Mend identifies two security-oriented MCP tools: mend-code-security-assistant for generated-code analysis and mend-dependencies-assistant for dependency checks.
Mend documents several supported use cases: manually triggered security checks, automatic checks through IDE rules, listing SAST and SCA findings from a selected Mend AppSec Platform project, explaining a specific finding by finding ID, CVE, or CWE, and returning remediation guidance for some SAST findings. The SCA workflow is focused on direct dependencies and Mend explicitly notes that it does not include transitive dependencies.
When to use it
Use this MCP server when an AI coding assistant is proposing source code, adding dependencies, or reviewing application security findings and the team wants Mend-backed security feedback inside the development loop. Practical examples include scanning newly generated code before it is committed, checking a new npm or Maven library before it is added, asking for top findings in the current repository, or asking the agent to explain a specific CVE or CWE already reported by Mend.
Connection and authentication
Mend documents a remote MCP configuration that points the client to the organization’s Mend environment URL with /mcp appended, for example https://saas.mend.io/mcp. The documented headers are X-UserEmail, X-UserKey, and optional X-OrgId when the account belongs to more than one organization. Mend recommends creating and specifying a service user for this integration.
Key considerations
Access requires a Mend account with Agentic Integration access, a valid user email and user key, and access to the correct Mend environment URL. Mend notes that the feature uses AI and may require contractual AI terms or an addendum. Keep user keys secret, rotate credentials regularly, and review automated security fixes before production use. For dependency checks, communicate that Mend’s documented SCA MCP workflow reports direct-library results rather than transitive dependency coverage.
Supported Transports
streamable_http
URL: https://saas.mend.io/mcp
Frequently Asked Questions
- When should an AI agent use the Mend MCP server?
- Use it when an AI coding agent needs Mend-backed application-security feedback while generating code, adding libraries, reviewing direct dependency risk, or explaining SAST and SCA findings from a Mend AppSec Platform project.
- What security checks does the Mend MCP server support?
- Mend documents generated-code analysis for CWEs and dependency checks for known CVEs. It also documents listing SAST and SCA findings from a selected project and explaining findings by finding ID, CVE, CWE name, or CWE number.
- What can the AI agent access through this server?
- The agent can call Mend MCP tools such as the code security assistant and dependencies assistant, and can request selected Mend AppSec Platform findings when the workspace can be matched to a project by Git URL or when the user supplies the project name.
- How is authentication configured for Mend MCP?
- The documented remote MCP configuration uses the Mend environment URL with `/mcp` and headers for `X-UserEmail` and `X-UserKey`. `X-OrgId` is optional and should be supplied only for users who belong to more than one Mend organization.
- Which transport should be used for the Mend MCP server?
- Use the remote HTTP MCP endpoint documented by Mend, such as `https://saas.mend.io/mcp` for the Mend SaaS environment. Configure the endpoint with the required Mend user headers and do not add local stdio or SSE transports unless Mend documents them for the chosen client.