StackHawk MCP Server – DAST Security Testing

Overview

StackHawk MCP Server is an open-source Model Context Protocol server for connecting AI agents to StackHawk's dynamic application security testing workflow. It is designed for AI coding environments where the agent can help a developer set up StackHawk, run HawkScan, interpret results, and guide remediation while the application is still under development.

The server is implemented in Python and requires Python 3.10 or higher. It is published as the stackhawk-mcp package and expects a StackHawk API key so it can call StackHawk platform APIs and organize work around the authenticated organization, applications, scans, and findings.

What the MCP server enables

StackHawk documents seven MCP tools organized around the developer workflow:

• get_organization_info retrieves organization details, teams, and applications.
• list_applications lists StackHawk applications in an organization.
• setup_stackhawk_for_project detects the project language, finds or creates an application, and generates a stackhawk.yml file.
• validate_stackhawk_config validates StackHawk YAML against the official StackHawk schema.
• validate_field_exists checks field paths against the schema to reduce hallucinated configuration fields.
• run_stackhawk_scan runs a StackHawk scan through the StackHawk CLI and returns installation help if the CLI is missing.
• get_app_findings_for_triage returns findings at or above the configured failure threshold for remediation.

When to use it

Use this MCP server when an AI coding agent needs runtime application security feedback, not just static code analysis. It is useful during local development, pull request hardening, API security testing, and secure onboarding of an application into StackHawk. A practical workflow is: generate a valid stackhawk.yml, run the app locally, execute HawkScan, review findings, update code, and rescan to verify that fixes are effective.

Connection and authentication

The verified local MCP configuration uses stdio. StackHawk's documented examples run the server with Python using python3 -m stackhawk_mcp.server, and GitHub Copilot Coding Agent examples use uvx stackhawk-mcp. Authentication is provided with the STACKHAWK_API_KEY environment variable. StackHawk also documents an HTTP server entry point, but no universal public hosted endpoint is documented, so this provider file lists only the local stdio transport.

Key considerations

The MCP server can run scans and query platform findings, so the API key should be scoped and stored as a secret in the MCP host or CI environment. Scans require a reachable running application and the StackHawk CLI for scan execution. The server is most effective when used with least-privilege StackHawk credentials, review of agent-proposed changes, and normal application security controls for authenticated scanning configuration.