Contrast Security MCP — Security skill for Claude Code

Contrast MCP Server

[](https://github.com/Contrast-Labs/mcp-contrast/actions/workflows/build.yml) [](https://opensource.org/licenses/Apache-2.0)

The Contrast MCP Server allows you to connect Contrast Security to your AI coding agent to automatically remediate vulnerabilities, update insecure libraries, and analyze security coverage—all through natural language prompts.

• Remediate vulnerabilities directly from Contrast Assess data
• Identify and update insecure third-party libraries with Contrast SCA insights
• Review route coverage, Protect/ADR findings, and other security metadata on demand

[!WARNING] **CRITICAL SECURITY WARNING:** Exposing Contrast vulnerability data to an AI service that trains on your prompts can leak sensitive information. Only use mcp-contrast with environments that contractually guarantee data isolation and prohibit model training on your inputs.

**Verify AI Data Privacy:** Confirm that your service agreement prevents model training on your prompts and consult your security team before sharing Contrast data.

**UNSAFE:** Public consumer LLM sites (e.g., free ChatGPT, Gemini, Claude) that use prompts for training.

**POTENTIALLY SAFE:** Enterprise services with contractual privacy guarantees (e.g., Google Cloud AI, AWS Bedrock, Azure OpenAI).

What's New

See [CHANGELOG.md](CHANGELOG.md) for the complete release history, including breaking changes and new features.

Available Tools

The Contrast MCP Server provides 13 tools for security analysis and vulnerability management:

Applications

Tool	Description
search_applications	Search applications by name, tag, or metadata filters
get_session_metadata	Get session metadata fields available for an application

Vulnerabilities

Tool	Description
search_vulnerabilities	Search vulnerabilities across all applications (org-level)

...