@kubbisec/mcp

Official KubbiSec MCP server for IDEs and agents - connect Cursor, Claude Desktop, or any MCP client to your KubbiSec organization.

Use it to resolve projects by repository, list vulnerabilities, trigger scans, run AI remediation, validate Naus pipeline YAML, and read kubbisec:// documentation resources.

Requirements

• Node.js 18 or newer
• A KubbiSec account and organization access

Installation

npm install -g @kubbisec/mcp

Or run without installing:

npx -y @kubbisec/mcp

Authentication

Preferred: device login

kubbisec mcp login

This writes ~/.kubbisec/mcp.json (mode 0600). The MCP server loads credentials from that file when env vars are unset.

Refresh before expiry:

kubbisec mcp login --refresh

Legacy: environment variables

export KUBBISEC_API_URL="https://api.kubbisec.com"
export KUBBISEC_API_KEY="kbs_…"
export KUBBISEC_ORGANIZATION_SLUG="my-company"

Precedence: env vars > ~/.kubbisec/mcp.json > defaults.

Cursor / Claude Desktop (stdio)

After kubbisec mcp login:

{
  "mcpServers": {
    "kubbisec": {
      "command": "npx",
      "args": ["-y", "@kubbisec/mcp"],
      "env": {}
    }
  }
}

No secrets in the config file - credentials come from ~/.kubbisec/mcp.json.

Tools (overview)

| Tool | Purpose | |------|---------| | resolve_project_by_repository | Map a Git URL to a KubbiSec project | | list_vulnerabilities | Paginated findings for a project | | trigger_kubbisec_scan | Enqueue a security scan | | get_kubbisec_scan_status | Poll scan execution status | | generate_remediation_plan | AI remediation plan for a finding | | start_ai_remediation_run | Start an AI fix run | | validate_naus_pipeline_yaml | Validate Naus pipeline YAML (@kubbisec/naus-validation) | | list_pipeline_generation_jobs | CI pipeline generation jobs |

Resources

• kubbisec://naus/README - Naus docs index
• kubbisec://naus/validation - pipeline validation rules
• kubbisec://aspm/README - ASPM CLI docs index
• kubbisec://ai/* - AI / MCP login docs

Read kubbisec://naus/validation before editing pipeline YAML under pressure.

Hosted MCP (cloud IDE)

For browser-based IDEs, KubbiSec also offers a hosted endpoint:

• URL: https://mcp.kubbisec.com/mcp
• Auth: OAuth2 via https://app.kubbisec.com

See KubbiSec docs → Integrations → MCP for the full OAuth snippet.

Self-hosted HTTP mode

For internal deployments, run with Streamable HTTP:

export KUBBISEC_MCP_TRANSPORT=http
export KUBBISEC_MCP_AUTH_TOKEN="your-bearer-token"
export PORT=3000
kubbisec-mcp

Clients send Authorization: Bearer <token> and may pass x-api-key + x-organization-id on the MCP initialize request.

Troubleshooting

| Issue | Fix | |-------|-----| | KUBBISEC_API_KEY error | Run kubbisec mcp login or set env vars | | Ambiguous repository | Pass path (monorepo) or project_id | | YAML validation failures | Read diagnostics from validate_naus_pipeline_yaml |

Links

• MCP public docs (tools, resources, runbook)
• KubbiSec

Terms

The KubbiSec MCP server is distributed for use with the KubbiSec platform. Not open source. Use is subject to your agreement with KubbiSec.

Trademarks

KubbiSec and related marks are property of their respective owners.