Endor Labs MCP server in Gemini CLI

The Endor Labs MCP server integrates directly into Gemini CLI to scan your code as you write, catching security issues before they reach production.

You can install the MCP server with Gemini CLI or as a Gemini extension.

The Endor Labs MCP server has two editions:

• Developer Edition: A free edition that requires no configuration. A browser window opens on first use for authentication via GitHub, GitLab, or Google. The Developer Edition provides access to default security policies from Endor Labs.
• Enterprise Edition: A paid edition that enforces your organization’s specific security policies. Authenticate using GitHub, GitLab, Google, or SSO. You must specify your namespace to access your organization’s policies.

Additionally, if you already have Endor Labs configured locally (for example, from a previous endorctl init command), the MCP server can use your pre-existing configuration.

Developer Edition

The Developer Edition is free and uses default security policies from Endor Labs. When you use the MCP server for the first time, a browser window opens for authentication through GitHub, GitLab, or Google.

Run the following command to add the MCP server to your project. This adds the server with -s project (shared with everyone in the project). See Scope options for other scopes.

gemini mcp add endor-cli-tools -- npx -y endorctl ai-tools mcp-server

Alternatively, add the following to your .gemini/settings.json file in the root of your repository. This uses project scope, which is shared with everyone working on the repository.

{
  "mcpServers": {
    "endor-cli-tools": {
      "command": "npx",
      "args": [
        "-y",
        "endorctl",
        "ai-tools",
        "mcp-server"
      ]
    }
  }
}

Enterprise Edition

The Enterprise Edition enforces your organization’s specific security policies. You need your Endor Labs namespace and an authentication method. Ensure that your developers have Read-Only permissions to Endor Labs. See Authorization policies for more details.

Configure the Enterprise Edition using the tool.

Verify the installation

/mcp list

Confirm that endor-cli-tools appears in the list. You can also use /mcp in Gemini CLI to view active MCP servers.

Try a test prompt

After installing the MCP server, try the following prompt in your AI chat or CLI to verify that the tools are working.

Check if the npm package lodash version 4.17.20 has any vulnerabilities

The MCP server uses the check_dependency_for_vulnerabilities tool to check for known vulnerabilities and return the results. If you see a response with vulnerability details, the MCP server is working correctly.

Scope options

Gemini CLI supports two MCP configuration scopes:

• -s project: Shared with everyone in the project via .gemini/settings.json file (default).
• -s user: Available to you across all projects via ~/.gemini/settings.json.

Manage MCP servers

/mcp list

In Gemini CLI, use /mcp to view and manage your active MCP servers.

Configure GEMINI.md

To enhance the MCP server integration, you can add instructions in GEMINI.md at the root of your repository. Gemini CLI reads GEMINI.md files to guide AI development with your project-specific instructions.

1. Navigate to the root of your repository.

2. Create or edit the GEMINI.md file in the root of your repository.

3. Add appropriate rules for your project. For example, you can add a rule to check if the code is free from vulnerabilities.

Example GEMINI.md instructions

You can use the following GEMINI.md instructions as a quick start for the Endor Labs MCP server. Modify the instructions to meet your specific organization’s needs. For more information, refer to the Gemini CLI documentation.

• SCA Rule Example
• Secrets Rule Example
• SAST Rule Example

# Software Composition Analysis (SCA) Rule (Endor Labs via MCP)

This project uses Endor Labs for automated dependency (SCA) scanning, integrated through the MCP server.

## Workflow

Every time a manifest or lockfile (package.json, requirements.txt, go.mod, pom.xml, etc.) is created or modified in any way, immediately do the following prior to performing your next task.

**Important**: Do not proceed after creating or modifying a manifest file without running this first.

- Run `endor-cli-tools` using the `check_dependency_for_vulnerabilities` tool via the MCP server.
- Provide the **ecosystem**, **dependency name**, and **version** always when making this tool call.
- If a vulnerability or error is identified:
  - Upgrade to the suggested safe version, or
  - Replace the dependency with a non-vulnerable alternative.
- Re-run the check using `endor-cli-tools` to confirm the issue is resolved.

## Notes
- All scans must be performed using the MCP server integration (`endor-cli-tools`). Do not invoke `endorctl` directly.

# Leaked Secrets Detection Rule (Endor Labs via MCP)

This project uses [Endor Labs](https://docs.endorlabs.com/) for automated security scanning, integrated through the MCP server.

## Workflow

Whenever a file is modified in the repository, and before the end of an agent session:

- Run `endor-cli-tools` using the `scan` tool via the MCP server to check for leaked secrets.
- If any secrets or errors are detected:
  - Remove the exposed secret or correct the error immediately.
  - Re-run the scan to verify the secret has been properly removed.
- Save scan results and remediation steps in a security log or as comments for audit purposes.

## Notes
- All scans must be performed using the MCP server integration (`endor-cli-tools`). Do not invoke `endorctl` directly.
- This scan must use the path of the directory from which the changed files are in. Use absolute paths.

# Static Application Security Testing (SAST) Rule (Endor Labs via MCP)

This project uses [Endor Labs](https://docs.endorlabs.com/) for automated SAST, integrated through the MCP server.

## Workflow

Whenever a file is modified in the repository, and before the end of an agent session:

- Run `endor-cli-tools` using the `scan` tool via the MCP server to perform SAST scans.
- If any vulnerabilities or errors are found:
  - Present the issues to the user.
  - Recommend and apply appropriate fixes (e.g., input sanitization, validation, escaping, secure APIs).
- Save scan results and remediation steps in a security log or as comments for audit purposes.

## Notes
- All scans must be performed using the MCP server integration (`endor-cli-tools`). Do not invoke `endorctl` directly.
- Do not invoke Opengrep directly.
- This scan must use the path of the directory from which the changed files are in. Use absolute paths.

Install the MCP server as a Gemini extension

As an alternative to the MCP server configuration, you can install the Endor Labs MCP server as a Gemini extension. You can find the extension on GitHub.

gemini extensions install https://github.com/endorlabs/gemini-extension.git

No additional configuration is required for Developer Edition. When you first use a tool, a browser window opens allowing you to authenticate with GitHub, GitLab, or Google.

For Enterprise Edition, use a natural language command in Gemini CLI to initiate an authentication flow with your organization’s namespace after installing the extension. For example:

Initialize Endor Labs with Google authentication using the command endorctl init --auth-mode=google

How to use the Endor Labs MCP server

Troubleshooting

"command": "endorctl",
"args": ["ai-tools", "mcp-server"]

npx --version