README.md
An MCP server to query Veracode security services from Claude Code.
MCP Veracode
MCP server para consultar Veracode desde Claude Code.
Tools
| Tool | Descripcion |
|---|---|
veracode_applications |
Listar y buscar aplicaciones |
veracode_findings |
Vulnerabilidades y flaws de una aplicacion |
veracode_scan_status |
Estado de scans y summary report |
veracode_policy_compliance |
Estado de cumplimiento de politicas |
Instalacion
Agregar a ~/.claude/mcp.json:
{
"mcpServers": {
"veracode-mcp": {
"command": "npx",
"args": ["-y", "github:landscapedotcl/mcp-veracode"],
"env": {
"VERACODE_API_ID": "tu_api_id",
"VERACODE_API_SECRET": "tu_api_secret"
}
}
}
}
Reiniciar Claude Code para que cargue el MCP server.
Autenticacion
Usa HMAC-SHA-256 con API ID y API Secret, el metodo estandar de Veracode.
Las credenciales se generan en Veracode > Account Settings > API Credentials.
Uso
# Listar aplicaciones
veracode_applications({ name: "mi-app" })
# Findings de una aplicacion
veracode_findings({ applicationGuid: "guid-aqui", scanType: "STATIC", severityGte: 3 })
# Estado de scans
veracode_scan_status({ applicationGuid: "guid-aqui" })
# Apps que no cumplen politica
veracode_policy_compliance({ policyCompliance: "DID_NOT_PASS" })
Tools (4)
veracode_applicationsList and search for applications within the Veracode platform.veracode_findingsRetrieve vulnerabilities and flaws for a specific application.veracode_scan_statusCheck the status of scans and retrieve summary reports.veracode_policy_complianceCheck the policy compliance status of applications.Environment Variables
VERACODE_API_IDrequiredThe API ID for Veracode authentication.VERACODE_API_SECRETrequiredThe API Secret for Veracode authentication.Configuration
claude_desktop_config.json
{"mcpServers": {"veracode-mcp": {"command": "npx", "args": ["-y", "github:landscapedotcl/mcp-veracode"], "env": {"VERACODE_API_ID": "tu_api_id", "VERACODE_API_SECRET": "tu_api_secret"}}}}Try it
→List all applications in my Veracode account.
→Find all high-severity static vulnerabilities for the application with GUID 'guid-aqui'.
→What is the current scan status for my application?
→Show me all applications that are currently failing their security policy compliance.