Endor Labs MCP server

MCP (Model Context Protocol) is an open standard that defines a consistent way for applications to share relevant context and information with Large Language Models (LLMs). MCP servers expose specific capabilities through the standardized Model Context Protocol. For more information on MCP, refer to the MCP documentation.

The Endor Labs MCP server slots right into your development workflow, scanning your code as you write. You can catch issues long before they’re a problem in production. It plugs directly into your IDE, tightening the feedback loop for both human and AI-generated code can quickly be secured from the start. With Endor Labs, you’re bringing security all the way left, getting real-time, proactive insights and automated fixes in your editor, while you build, minimizing last-minute security scrambles.

Tools in the Endor Labs MCP server

The Endor Labs MCP server provides the following tools:

• check_dependency_for_vulnerabilities: Check if the dependencies in your project are vulnerable.
• get_endor_vulnerability: Get the details of a specific vulnerability from the Endor Labs vulnerability database.
• get_resource: Add additional context from commonly used Endor Labs resources about your software such as findings, vulnerabilities, and projects.
• scan: Run an Endor Labs security scan to detect risks in your open source dependencies, find common security issues, and spot any credentials accidentally exposed in your Git repo.

After you set up the MCP server, you can choose to disable the tools that you do not want to use.

Prerequisites to run the Endor Labs MCP server

Before running the Endor Labs MCP server, ensure that you install the latest version of endorctl and authenticate to Endor Labs.

If you wish to run SAST scans, ensure that you install Semgrep in your local system. See Download and install Semgrep to learn how you can download and install the specific version of Semgrep that is compatible with Endor Labs.

Configure the MCP server in Cursor

Complete the following tasks to configure the Endor Labs MCP server in Cursor.

Add the Endor Labs MCP server to local Cursor settings

We recommend that you add the MCP server to the local Cursor settings rather than the user settings to keep the configuration project-specific.

1. Navigate to the root of your repository.

2. Create a .cursor directory if it doesn’t exist and create an mcp.json file in the .cursor directory.

   mkdir -p .cursor && touch .cursor/mcp.json
   

Configure the MCP server

Add the following configuration to the .cursor/mcp.json file.

{
  "mcpServers": {
    "endor-cli-tools": {
      "type": "stdio",
      "command": "endorctl",
      "args": [
        "ai-tools",
        "mcp-server"
      ],
      "env": {
        "MCP_ENDOR_SCAN_LANGUAGES": "<languages to scan>"
      }
    }
  }
}

Configure Cursor rules

To enhance the MCP server integration you can add custom rules for your project. These rules are custom prompts specific to your project.

1. Navigate to the root of your repository.

2. In the .cursor directory, create an .mdc file to add the specific instructions.

   touch .cursor/rules.mdc
   

3. Add appropriate rules for your project in the .cursor/endorlabs-rules.mdc file.

   For example, you can add a rule to check if the code is free from vulnerabilities.

Manage Endor Labs MCP server tools in Cursor

1. Navigate to the Settings > Cursor Settings > MCP.

2. Click the tool that you want to disable under endor-mcp-tools.

   Click on a disabled tool to enable it.

Configure the MCP server in Visual Studio Code

Complete the following tasks to configure the Endor Labs MCP server in Visual Studio Code.

Prerequisites for Visual Studio Code

Before running the Endor Labs MCP server, ensure that you have Visual Studio Code version 1.99 or later and enable MCP support by setting chat.mcp.enabled to true in your Visual Studio Code settings.

Add the Endor Labs MCP server to local Visual Studio Code settings

We recommend that you add the MCP server to the local Visual Studio Code settings rather than the user settings to keep the configuration project-specific.

1. Navigate to the root of your repository.

2. Create a .vscode directory if it doesn’t exist and create an mcp.json file in the .vscode directory.

   mkdir -p .vscode && touch .vscode/mcp.json
   

3. Add the following configuration to the .vscode/mcp.json file.

{
  "servers": {
    "endor-cli-tools": {
      "type": "stdio",
      "command": "endorctl",
      "args": [
        "ai-tools",
        "mcp-server"
      ],
      "env": {
        "MCP_ENDOR_SCAN_LANGUAGES": "<languages to scan>"
      }
    }
  }
}

Use the MCP server with GitHub Copilot

To use the Endor Labs MCP server with GitHub Copilot in Visual Studio Code:

1. Open the Chat view by pressing Cmd+Option+I.

2. Switch to the Agent mode.

3. Click the Settings icon.

4. Select MCP Server: endor-cli-tools from the dropdown menu.

   You can now use Endor Labs tools in your chat prompts to scan for vulnerabilities.

Manage Endor Labs MCP server tools in Visual Studio Code

1. Open the Chat view by pressing Cmd+Option+I.

2. Switch to the Agent mode.

3. Click the Settings icon.

4. Select the tools that you want to enable or disable under MCP Server: endor-cli-tools.