Skip to main content

Cybrium MCP Server — Step-by-Step Setup

Connect Cybrium's security scanning tools to your AI coding assistant via MCP (Model Context Protocol). Works with Claude Code, Claude Desktop, Cursor, and Windsurf.

What You Get​

Once configured, you can ask your AI assistant to scan code, find secrets, check dependencies, and fix vulnerabilities — all in natural language.

ToolWhat you can say
Scan"Scan this project for vulnerabilities"
Secrets"Are there any hardcoded API keys?"
Supply Chain"Check for vulnerable dependencies"
License"Do we have any GPL dependencies?"
Repo Health"What's our security score?"
Frameworks"What frameworks does this project use?"
Web Scan"Scan example.com for vulnerabilities"
Fix"Fix the security issues you found"

Prerequisites​

Step 1: Install cyscan​

brew tap cybrium-ai/cli
brew install cyscan

Verify:

cyscan --version

You should see cyscan 0.8.1 or later.

Step 2: Install cyweb (optional — for web scanning)​

brew install cyweb

Step 3: Install cyprobe (optional — for network discovery)​

brew install cyprobe

Claude Code (CLI)​

Step 1: Add the MCP server​

Run this single command:

claude mcp add cybrium -- npx -y @cybrium-ai/mcp-server

Step 2: Verify​

Type /mcp in Claude Code:

/mcp

You should see cybrium listed with 7 tools.

Step 3: Try it​

Ask Claude:

Scan this project for security vulnerabilities

Alternative: Manual Configuration​

If you prefer manual setup, edit ~/.claude/settings.json:

{
  "mcpServers": {
    "cybrium": {
      "command": "npx",
      "args": ["-y", "@cybrium-ai/mcp-server"]
    }
  }
}

Claude Desktop​

Step 1: Open Settings​

Open Claude Desktop and click the gear icon in the bottom-left corner.

Step 2: Go to Developer Settings​

Click Developer in the settings sidebar, then click Edit Config.

Step 3: Add the MCP Server​

Add this to claude_desktop_config.json:

{
  "mcpServers": {
    "cybrium": {
      "command": "npx",
      "args": ["-y", "@cybrium-ai/mcp-server"]
    }
  }
}

Config file location:

  • macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
  • Windows: %APPDATA%\Claude\claude_desktop_config.json

Step 4: Restart Claude Desktop​

Quit and reopen Claude Desktop. You should see a hammer icon in the chat input area.

Step 5: Try it​

Click the hammer icon to see available tools, then ask Claude:

What frameworks does this codebase use?

Cursor​

Step 1: Open Settings​

Press Cmd+, (macOS) or Ctrl+, (Windows/Linux).

Step 2: Search for MCP​

Type "MCP" in the settings search bar.

Step 3: Add Server​

Click Add MCP Server and fill in:

FieldValue
Namecybrium
Commandnpx
Args-y @cybrium-ai/mcp-server

Step 4: Restart Cursor​

Windsurf​

Add to your Windsurf MCP configuration file:

{
  "mcpServers": {
    "cybrium": {
      "command": "npx",
      "args": ["-y", "@cybrium-ai/mcp-server"]
    }
  }
}

Usage Examples​

Scan for vulnerabilities​

Scan this project for security vulnerabilities

The AI will run cyscan scan . and analyze the 1,815-rule engine results.

Check for hardcoded secrets​

Are there any hardcoded API keys or secrets in this codebase?

Uses cyscan's 296 secret detection patterns + entropy analysis.

Supply chain audit​

Check our dependencies for known vulnerabilities and license issues

Parses lockfiles, queries OSV/NVD/GHSA, checks for typosquats and risky licenses.

Repository health check​

How healthy is this repo's security posture? Give me a score.

Runs 14 checks: SECURITY.md, branch protection, dependency pinning, etc.

Web scanning​

Scan https://staging.myapp.com for security issues

Runs cyweb against the target URL.

Auto-fix​

Fix the SQL injection issue you found in src/api/users.py

Applies cyscan's autofix patches.

Troubleshooting​

"No tools showing up"​

  1. Check the MCP server runs: npx @cybrium-ai/mcp-server
  2. Verify cyscan is installed: which cyscan
  3. Restart your AI tool completely (quit + reopen)

"cyscan: command not found"​

The MCP server calls cyscan from your PATH. Install it:

brew tap cybrium-ai/cli && brew install cyscan

"Permission denied" on macOS​

chmod +x $(which cyscan) $(which cyweb) $(which cyprobe)

Architecture​

┌─────────────────────────────┐
│  Your AI Assistant          │
│  (Claude/Cursor/Windsurf)   │
└──────────┬──────────────────┘
           │ MCP Protocol (stdio)
           v
┌─────────────────────────────┐
│  Cybrium MCP Server         │
│  (@cybrium-ai/mcp-server)   │
└──────────┬──────────────────┘
           │ spawns CLI processes
           v
┌──────┬──────┬───────┐
│cyscan│cyweb │cyprobe│
│ SAST │ DAST │Network│
│ SCA  │ Web  │ OT    │
│Secret│      │       │
└──────┴──────┴───────┘
      │
      v
  JSON results → AI analyzes + explains + fixes

Everything runs locally. No API keys, no cloud calls, no data leaves your machine.