ide

MCP (Model Context Protocol)

MCP (Model Context Protocol) is an open standard that defines a consistent way for applications to share relevant context and information with Large Language Models (LLMs). MCP servers expose specific capabilities through the standardized Model Context Protocol. For more information on MCP, refer to the MCP documentation. The Endor Labs MCP server integrates seamlessly into your development workflow, scanning your code as you write. You can catch issues long before they’re a problem in production. It plugs directly into your IDE, tightening the feedback loop for both human and AI-generated code. Thus, you can quickly secure your code from the start. With Endor Labs, you’re bringing security all the way left, getting real-time, proactive insights and automated fixes in your editor, while you build, minimizing last-minute security scrambles.

You can also connect the Endor Labs documentation MCP server to get accurate, real-time answers about Endor Labs directly in your AI tools.

The Endor Labs MCP server runs locally on your machine as a lightweight process. Your IDE or CLI launches it through npx or a system-installed endorctl and communicates with it over stdio. When the AI agent needs security context, the server calls the Endor Labs cloud platform and returns the results. The server uses the stdio transport only, so configure it with a command and args entry rather than an HTTP (type: http) URL.

How Endor Labs MCP server helps your development workflow

The Endor Labs MCP server helps developers and AI agents in the following ways:

Provide guardrails for agents before code review: Reduce the number of known vulnerabilities entering your code and save developers time by checking AI agent suggestions in real time. Integrate security before an issue is discovered in CI or in production.
Improve the speed of remediating security risks: Agents use vulnerability context from Endor Labs to help implement secure changes, from writing more secure code to upgrading dependencies.

How to use the Endor Labs MCP server

The Endor Labs MCP server provides the following tools:

check_dependency_for_vulnerabilities: Check if a dependency in your project is vulnerable.
check_dependency_for_risks: Check a dependency for security risks including vulnerabilities and malware.
get_endor_vulnerability: Get the details of a specific vulnerability from the Endor Labs vulnerability database.
get_resource: Retrieve additional context from commonly used Endor Labs resources about your software, such as findings, vulnerabilities, and projects.
scan: Run an Endor Labs security scan to detect risks in your open source dependencies, find common security issues, and spot any credentials accidentally exposed in your Git repository.
security_review: Perform security review analysis on code diffs. Analyzes local uncommitted changes (both staged and unstaged) compared to HEAD, or diffs between the main branch and the last commit. The tool sets the --diff-scope scan option automatically based on the review type. Requires the Enterprise Edition. You must specify your namespace in the MCP server configuration. You must also enable AI security code review for your namespace in the Endor Labs platform. See AI security code review for setup instructions.

After you set up the MCP server, you can choose to disable the tools that you do not want to use.

Choose your IDE or platform to get started

Related: To run Endor Labs security workflows such as finding triage, dependency remediation, and onboarding checks through your AI coding agent, see the Endor Labs Agent Kit.