Contrast MCP Server

What is Contrast MCP Server about?

The server connects Contrast’s vulnerability platform with configurable LLM or coding agents. By exposing application details, vulnerability reports, route coverage, and ADR/Protect events to an AI model, developers can query, analyze, and automatically generate fixes for identified security problems.

How to use Contrast MCP Server?

Build – Ensure Java 17+ is installed and run mvn clean install to produce the JAR.
Configure – Edit a config.json (or VS Code settings) to add an entry under mcpServers with the required Contrast credentials (CONTRAST_HOST_NAME, CONTRAST_API_KEY, CONTRAST_SERVICE_KEY, CONTRAST_USERNAME, CONTRAST_ORG_ID).
Run – Execute the JAR directly (java -jar …) or launch the provided Docker image (docker run … contrast/mcp-contrast:latest).
Integrate – Point your AI client (e.g., Copilot, Claude Desktop, oterm) to the configured MCP server and start issuing prompts that reference Contrast data.

Key Features

Secure exposure of Contrast application, rule, vulnerability, and route‑coverage data to an LLM.
Supports Java standalone execution and Docker deployment.
Proxy configuration for corporate environments (HTTP/HTTPS proxy settings).
Debug logging and custom trust‑store handling for SSL certificates.
Ready‑made integration snippets for VS Code, IntelliJ, Cline plugin, Claude Desktop, and oterm.

Use Cases

Developer assistance – Ask the LLM to list vulnerabilities, retrieve details, and automatically generate patched code snippets.
Third‑party library upgrades – Query libraries with high‑severity issues and receive version upgrade recommendations.
Security analyst reporting – Summarize CVE exposure across applications or identify protected vs. unprotected findings.
CI/CD automation – Embed the server in pipelines to fetch latest session metadata and enforce remediation before release.

FAQ

Q: Will my vulnerability data be sent to public LLM services? A: No, the server only forwards data to the LLM you configure. It is your responsibility to use an enterprise‑grade model that guarantees data privacy.

Q: Which Java version is required? A: Java 17 or newer.

Q: How do I enable debug logs? A: Add --logging.level.root=DEBUG to the command‑line arguments.

Q: What if the Contrast API uses a self‑signed certificate? A: Import the certificate into a Java truststore and pass -Djavax.net.ssl.trustStore=… -Djavax.net.ssl.trustStorePassword=… when launching the server.

Q: Can I run the server behind a corporate proxy? A: Yes, set http_proxy_host and http_proxy_port either as JVM flags or environment variables in the Docker command.

${\color{red} ** WARNING ** WARNING ** WARNING ** WARNING ** WARNING **}$

Never under any circumstances use mcp-contrast functions which pull sensitive data with a LLM that trains on your data as it will potentially expose your vulnerability data to the outside world.

⚠️ Critical Security Warning: Verify AI Data Privacy Before sending vulnerability data to an AI, you must confirm that your service agreement guarantees your data will not be used for model training.

UNSAFE: Public consumer websites (e.g., the free versions of ChatGPT, Gemini, Claude). These services often use your input for training.

POTENTIAL-SAFE: Enterprise-grade services (e.g., Google Cloud AI, AWS Bedrock, Azure OpenAI) or paid plans that contractually ensure data privacy and prevent model training on your prompts, verify with your information security teams.

Contrast's MCP server allows you as a developer or security professional to quickly remediate vulnerabilities found by Contrast products. By combining the abilities of a LLM and Coding Agent of your choice and Contrast's unique vulnerability data it is possible to easily remediate vulnerabilities in your code or 3rd party libraries.

Sample Prompts
- For the Developer
  - Remediate Vulnerability in code
  - 3rd Party Library Remediation
- For the Security Professional
Data Privacy
Build
Run
Docker
Proxy Configuration
- Java Process
- Docker

Sample Prompts

For the Developer

Remediate Vulnerability in code

Please list vulnerabilities for Application Y
Give me details about vulnerability X on Application Y
Review the vulnerability X and fix it.

3rd Party Library Remediation

Which libraries in Application X have vulnerabilities High or Critical and are also being actively used.
Update library X with Critical vulnerability to the Safe version.

Which libraries in Application X are not being used?

Retrieving application based on Tags

please give me the applications tagged with "backend"

Retrieving application based on Metadata

please give me the applications with metadata "dev-team" "backend-team"

Retrieving vulnerabilities based on Session Metadata

give me the sesssion metadata for application x
give me the vulnerabilities in the latest session for application X
give me the vulnerabilities for session metadata "Branch Name" "feature/some-new-fix" for application X
give me the route coverage for the latest session for application X
give me the route coverage for session metadata "Branch Name" "feature/some-new-fix" for application X

For the Security Professional

Please give me a breakdown of applications and servers vulnerable to CVE-xxxx-xxxx
Please list the libraries for application named xxx and tell me what version of commons-collections is being used
Which Vulnerabilities in application X are being blocked by a Protect / ADR Rule?

Data Privacy

The Contrast MCP Server provides a bridge between your Contrast Data and the AI Agent/LLM of your choice. By using Contrast's MCP server you will be providing your Contrast Data to your AI Agent/LLM, it is your responsibility to ensure that the AI Agent/LLM you use complies with your data privacy policy. Depending on what questions you ask the following information will be provided to your AI Agent/LLM.

Application Details
Application Rule configuration
Vulnerability Details
Route Coverage data
ADR/Protect Attack Event Details

Build

Requires Java 17+

mvn clean install

Run

To add the MCP Server to your local AI system, modify the config.json file and add the following

"mcpServers": {
    "contrast-mcp": {
      "command": "/usr/bin/java", "args": ["-jar","/Users/name/workspace/mcp-contrast/mcp-contrast/target/mcp-contrast-0.0.1-SNAPSHOT.jar",
        "--CONTRAST_HOST_NAME=example.contrastsecurity.com",
        "--CONTRAST_API_KEY=xxx",
        "--CONTRAST_SERVICE_KEY=xxx",
        "--CONTRAST_USERNAME=xxx.xxx@contrastsecurity.com",
        "--CONTRAST_ORG_ID=xxx"]
    }
}

You obviously need to configure the above to match your contrast API Creds.

Docker

Build Docker Image

docker build -t mcp-contrast .

Using Copilot + Petclinic

Download the Vulnerable Pet Clinic. git clone https://github.com/Contrast-Security-OSS/vulnerable-spring-petclinic.git Open the project in VSCode or Intellij. Edit the contrast_security.yaml file and configure it with your AGENT credentials

api:
  url: https://xxx/Contrast
  api_key: xxx
  service_key: xxx
  user_name: xxx
# All other contrast config is done in the docker-compose file. Do not check this file in to git!

Then you can build and run using docker-compose docker compose up --build It will build and run the services that make up petclinic. To build out the vulnerabilites and attack events run ./testscript.sh Select option 25. ( this will exercise the app and perform attacks to populate the vulnerabilities and attack events)

Install via Link in VScode

Click following link >>> <<< Allow the extension to be installed in your VSCode instance. Select Install Server

This will install the MCP Server. You will need to configure the server with your Contrast API credentials.

Manual Install of MCP Server

In VSCode go to settings and search for "mcp" Edit the Settings.json or select modify in workspace. If you want to enable this MCP sever just for this workspace. Then add the following to the settings.json file.

"mcp": {
    "inputs": [],
    "servers": {
        "contrastmcp": {
            "command": "docker",
            "args": [
            "run",
            "-e",
            "CONTRAST_HOST_NAME",
            "-e",
            "CONTRAST_API_KEY",
            "-e",
            "CONTRAST_SERVICE_KEY",
            "-e",
            "CONTRAST_USERNAME",
            "-e",
            "CONTRAST_ORG_ID",
            "-i",
            "--rm",
            "contrast/mcp-contrast:latest",
            "-t",
            "stdio"
            ],
            "env": {
                "CONTRAST_HOST_NAME": "example.contrastsecurity.com",
                "CONTRAST_API_KEY": "example",
                "CONTRAST_SERVICE_KEY": "example",
                "CONTRAST_USERNAME": "example@example.com",
                "CONTRAST_ORG_ID": "example"
            }
    }
}

Please note the credentials here are the API Credentials, not Agent credentials. You should also see a small start button appear in the json file as you can see above. Click it to start the MCP server.

Once complete you should see the Contrast MCP Tools in the Tools drop down and you should be ready to perform queries!

Install in Intellij

To install the MCP Server in Copilot for Intellij.

Select the Agent Mode in Copilot
Click on the Tools drop down
Select add more tools
Add the below configuration to the mcp.json file
Add your credentials to the env section.

{
  "servers": {
    "contrastmcp": {
      "command": "docker",
      "args": [
        "run",
        "-e",
        "CONTRAST_HOST_NAME",
        "-e",
        "CONTRAST_API_KEY",
        "-e",
        "CONTRAST_SERVICE_KEY",
        "-e",
        "CONTRAST_USERNAME",
        "-e",
        "CONTRAST_ORG_ID",
        "-i",
        "--rm",
        "contrast/mcp-contrast:latest",
        "-t",
        "stdio"
      ],
      "env": {
        "CONTRAST_HOST_NAME": "example.contrastsecurity.com",
        "CONTRAST_API_KEY": "example",
        "CONTRAST_SERVICE_KEY": "example",
        "CONTRAST_USERNAME": "example@example.com",
        "CONTRAST_ORG_ID": "example"
      }
    }
  }
}

Using Cline Plugin

With the Cline plugin installed, select the MCP button in the top right corner of the screen. Then select configure MCP Servers. This will open up a the JSON configuration for MCP. Add the following the json configuration

{
  "mcpServers": {
    "contrastmcp": {
      "command": "docker",
      "args": [
        "run",
        "-e",
        "CONTRAST_HOST_NAME",
        "-e",
        "CONTRAST_API_KEY",
        "-e",
        "CONTRAST_SERVICE_KEY",
        "-e",
        "CONTRAST_USERNAME",
        "-e",
        "CONTRAST_ORG_ID",
        "-i",
        "--rm",
        "contrast/mcp-contrast:latest",
        "-t",
        "stdio"
      ],
      "env": {
        "CONTRAST_HOST_NAME": "example.contrastsecurity.com",
        "CONTRAST_API_KEY": "example",
        "CONTRAST_SERVICE_KEY": "example",
        "CONTRAST_USERNAME": "example@example.com",
        "CONTRAST_ORG_ID": "example"
      },
      "disabled": false,
      "autoApprove": []
    }
  }
}

Once done you should see the contrast mcp server appear in the list of MCP servers, if you expand it you should see a list of available tools.

Using Claude Desktop

Claude Desktop is a desktop application that allows you to use the Claude AI model locally. It can be configured to use the Contrast MCP server for enhanced functionality. To setup Claude Desktop with the Contrast MCP server, follow these steps: In Claude Desktop, go to the settings and then the Developer tab. Then select Edit Config and edit the claude_desktop_config.json file. Add the following configuration to the claude_desktop_config.json file:

{
  "mcpServers": {
    "contrastmcp": {
      "command": "docker",
      "args": [
        "run",
        "-e",
        "CONTRAST_HOST_NAME",
        "-e",
        "CONTRAST_API_KEY",
        "-e",
        "CONTRAST_SERVICE_KEY",
        "-e",
        "CONTRAST_USERNAME",
        "-e",
        "CONTRAST_ORG_ID",
        "-i",
        "--rm",
        "contrast/mcp-contrast:latest",
        "-t",
        "stdio"
      ],
      "env": {
        "CONTRAST_HOST_NAME": "example.contrastsecurity.com",
        "CONTRAST_API_KEY": "xxx",
        "CONTRAST_SERVICE_KEY": "xxx",
        "CONTRAST_USERNAME": "xxx.xxx@example.com",
        "CONTRAST_ORG_ID": "xxx"
      }
    }
  }
}

Once you have added the configuration you will need to restart the Claude Desktop application for the change to take effect. After you have restarted the application, you should be able to use Claude Desktop to interact with the Contrast MCP server. For example :

Using oterm

oterm is terminal wrapper for ollama. One of its features is the ability to add MCP servers to specific LLM Models. https://ggozad.github.io/oterm/

Proxy Configuration

Java Process

If you need to configure a proxy for your Java process when using the standalone JAR, you can set the Java system properties for HTTP and HTTPS proxies:

java -Dhttp_proxy_host=proxy.example.com -Dhttp_proxy_port=8080 -jar /path/to/mcp-contrast-0.0.1-SNAPSHOT.jar --CONTRAST_HOST_NAME=example.contrastsecurity.com --CONTRAST_API_KEY=example --CONTRAST_SERVICE_KEY=example --CONTRAST_USERNAME=example@example.com --CONTRAST_ORG_ID=example

When configuring in your config.json file, include the proxy settings in the args array:

"mcpServers": {
  "contrast-assess": {
    "command": "/usr/bin/java", 
    "args": [
      "-Dhttp_proxy_host=proxy.example.com", 
      "-Dhttp_proxy_port=8080",
      "-jar",
      "/Users/name/workspace/mcp-contrast/mcp-contrast/target/mcp-contrast-0.0.1-SNAPSHOT.jar",
      "--CONTRAST_HOST_NAME=example.contrastsecurity.com",
      "--CONTRAST_API_KEY=example",
      "--CONTRAST_SERVICE_KEY=example",
      "--CONTRAST_USERNAME=example@example.com",
      "--CONTRAST_ORG_ID=example"
    ]
  }
}

Docker

When running the MCP server in Docker, you can configure the proxy by passing the relevant environment variables:

docker run \
  -e http_proxy_host="proxy.example.com" \
  -e http_proxy_port="8080" \
  -e CONTRAST_HOST_NAME=example.contrastsecurity.com \
  -e CONTRAST_API_KEY=example \
  -e CONTRAST_SERVICE_KEY=example \
  -e CONTRAST_USERNAME=example \
  -e CONTRAST_ORG_ID=example \
  -i \
  contrast/mcp-contrast:latest \
  -t stdio

For VS Code configuration with Docker and proxy, modify the settings.json like this:

"mcp": {
  "inputs": [],
  "servers": {
    "contrast-mcp": {
      "command": "docker",
        "args": [
        "run",
        "-e",
        "CONTRAST_HOST_NAME",
        "-e",
        "CONTRAST_API_KEY",
        "-e",
        "CONTRAST_SERVICE_KEY",
        "-e",
        "CONTRAST_USERNAME",
        "-e",
        "CONTRAST_ORG_ID",
        "-e", "http_proxy_host",
        "-e", "http_proxy_port",
        "-i",
        "--rm",
        "contrast/mcp-contrast:latest",
        "-t",
        "stdio"
        ],
        "env": {
            "CONTRAST_HOST_NAME": "example.contrastsecurity.com",
            "CONTRAST_API_KEY": "example",
            "CONTRAST_SERVICE_KEY": "example",
            "CONTRAST_USERNAME": "example@example.com",
            "CONTRAST_ORG_ID": "example",
            "http_proxy_host": "proxy.example.com",
            "http_proxy_port": "8080"
        }
    }
  }
}

Common Issues

If you are experiencing issues with the MCP server, here are some common troubleshooting steps:

Review Log

A log will be created, by default under /tmp/mcp-contrast.log either locally or witin the docker container. You can view this log to see if there are any errors or issues with the MCP server.

Enable Debug Logging

To enable debug logging you can add the following flag to the command line arguments when running the MCP server: --logging.level.root=DEBUG This can be added at this part of the docker command

        "--rm",
        "contrast/mcp-contrast:latest",
        "-t",
         "--logging.level.root=DEBUG",
        "stdio"
        ],

Certificate Issues

If the SSL Certificate for the Teamserver URL is not trusted, you may see the following error:

Failed to list applications: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

If this occurs you will need to add the certificate to the Java Truststore and then add the following to the command line arguments when running the MCP server: -Djavax.net.ssl.trustStore=/loctaion/to/mcp-truststore.jks, -Djavax.net.ssl.trustStorePassword=yourpassword More details on how to do this can be found in the Java documentation. Or ask your LLM to help you with this.

Contrast MCP Server