Skip to main content

MCP server

The Harness Code Security MCP server connects AI coding agents to Harness SAST and SCA. Agents can analyze code, list and triage findings, fetch data flows, request AutoFix recommendations, and look up package CVEs—without leaving the editor.

The npm package ships a bundled stdio MCP runtime and a launcher binary (harness-code-security-mcp). Analysis runs locally through the Harness SAST and SCA CLI (sl analyze); results upload to Qwiet AI by Harness.

Prerequisites​

  • Node.js 20 or later
  • A Qwiet AI by Harness account and the Harness SAST and SCA CLI, authenticated with sl auth, so ~/.shiftleft/config.json contains orgId and accessToken
  • An MCP-compatible agent host (for example Cursor or Claude Code)

Install​

Install the MCP server globally:

npm install -g harness-code-security-mcp

Alternatively, use npx in your MCP client configuration without a global install (see below).

Configure your agent​

Add the MCP server to your agent's MCP settings. After saving the configuration, restart the agent host so the tools load (a new chat alone is usually not enough).

Add the following to your Cursor MCP configuration (for example Cursor Settings → MCP, or .cursor/mcp.json):

{
  "mcpServers": {
    "harness-code-security-mcp": {
      "command": "harness-code-security-mcp"
    }
  }
}

Or with npx (no global install):

{
  "mcpServers": {
    "harness-code-security-mcp": {
      "command": "npx",
      "args": ["-y", "harness-code-security-mcp"]
    }
  }
}

Restart Cursor (quit and reopen, or Developer: Reload Window), then confirm tools such as sl_whoami appear in the MCP tool list.

Optional environment variables​

Defaults are usually enough (QWIET_API_HOST=app.shiftleft.io, SL_HOME=~/.shiftleft). Override only when needed:

{
  "mcpServers": {
    "harness-code-security-mcp": {
      "command": "harness-code-security-mcp",
      "env": {
        "QWIET_API_HOST": "app.shiftleft.io",
        "SL_HOME": "${HOME}/.shiftleft"
      }
    }
  }
}

You can also set WORKSPACE_FOLDER when the agent needs an explicit project path for AutoFix edits.

Authenticate​

  1. Install and authenticate the Harness SAST and SCA CLI if you have not already:

    sl auth

  2. Confirm ~/.shiftleft/config.json contains orgId and accessToken.

  3. In a new agent session after MCP is connected, call sl_whoami. Success returns an activeOrganizationId that matches the orgId in your config.

API tools use the organization from config.json only. To work in another organization, re-run sl auth with that org's credentials, then restart or reconnect the MCP server.

The MCP server can install or update the CLI under ~/.shiftleft. Prefer calling sl_ensure_cli before the first sl_analyze so install errors return quickly; sl_analyze can also install or update the CLI when it is missing.

What you can do​

Typical agent workflows:

  1. Analyze — sl_ensure_cli, then sl_analyze on the workspace (optional app and branch; defaults to the folder name and current git branch)
  2. Triage — sl_list_findings for counts and top actionable findings, then sl_get_findings / dataflow tools for detail
  3. Remediate — request and fetch AutoFix recommendations, then apply suggested edits
  4. Package CVEs — sl_lookup_package_cves with package URLs (PURLs) for CVEs and licenses

Tools​

ToolDescription
sl_whoamiShow the authenticated user and active organization (orgId from config)
sl_ensure_cliInstall or update the Harness SAST and SCA CLI under ~/.shiftleft
sl_analyzeRun local sl analyze --wait, upload results, and return scan_id (creates the app if needed)
sl_list_applicationsList applications in the active organization (optional; not required before analyze)
sl_list_branch_scansList scans for an application branch
sl_list_findingsSummarize findings for a scan (counts, top_actionable)
sl_get_finding / sl_get_findingsFetch one or more findings by ID
sl_get_finding_dataflow / sl_get_finding_dataflowsFetch data flows for findings
sl_request_finding_fixRequest generation of an AutoFix for a finding (async)
sl_get_recommended_fix / sl_get_recommended_fixesFetch AutoFix recommendations (may include edits[])
sl_list_branch_autofixesList AutoFix metadata for findings on a branch
sl_lookup_package_cvesLook up CVEs and licenses for package URLs (PURLs)

Your agent host may prefix tool names (for example mcp__harness-code-security-mcp__sl_whoami).

Agent Skills​

To help agents use these tools effectively, Harness SAST and SCA provides Agent Skills for analyzing code, triaging findings, and applying fixes. Install them from the ShiftLeftSecurity/skills repository:

npx skills add ShiftLeftSecurity/skills --skill '*'

Launcher options​

The harness-code-security-mcp launcher checks for a newer npm-published runtime at startup at most once per day and falls back to the bundled runtime if the update check fails.

FlagDescription
--no-auto-updateDisable startup update checks
--version-pin x.y.zRun a specific npm package version from the launcher's local cache
--debugPrint launcher diagnostics to stderr

The launcher never writes progress to stdout during normal MCP operation; stdout is reserved for MCP JSON-RPC.