Best for
- Developers who want security guidance while coding fast
- Users of AI coding tools like Claude Code and Cursor
- Teams using Jira and Confluence for issue tracking
A
62FMRS · C
AI Security Crew is a practical MCP server tailored for vibe coding, offering security review, dependency scanning, and threat modeling. It integrates OWASP guidelines and supports Jira/Confluence integration. It suits individuals and teams who prioritize security while developing rapidly, but users should be aware of configuration requirements and limitations in reachability analysis.
AI Security Crew is a lightweight MCP server for security reviews built for vibe coding. It injects security requirements before code generation, scans dependencies for CVEs, and verifies generated code without breaking your coding rhythm. It provides tools for security reviews, Jira ticket assessment, threat modeling, package verification, dependency scanning, and code security verification. It also works as a Claude Code plugin with commands /sec-review, /verify-code, and /threat-model.
Tools
lightweight_security_review
Call before any coding task to get security requirements and guidelines for your tech stack.
assess_ticket_security
Pull security requirements directly from a Jira ticket before coding.
perform_threat_model
Generate a structured threat model (STRIDE, attack surfaces) for significant new features.
verify_packages
Confirm packages exist with valid versions to catch hallucinated package names.
scan_dependencies
Scan for CVEs and check reachability in your code when adding packages.
verify_code_security
AI-powered security review of generated code against OWASP guidelines.
search_previous_threat_models
Check Confluence for existing threat models before creating a new one.
update_threat_model_file
Write the threat model to threat-model.md in the repo after perform_threat_model.
Setup
- Build the image: docker build -t mcp-security-review:latest .
- Configure your MCP client (e.g., Claude Desktop, Cursor) using the config example.
- Or use the Claude Code plugin: /plugin install Srajangpt1/ai_security_crew
- Or manually add the slash commands from .claude/commands/ to your project.
claude_desktop_config.json
{
"mcpServers": {
"sec-review": {
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"-e",
"JIRA_URL",
"-e",
"JIRA_USERNAME",
"-e",
"JIRA_API_TOKEN",
"-e",
"CONFLUENCE_URL",
"-e",
"CONFLUENCE_USERNAME",
"-e",
"CONFLUENCE_API_TOKEN",
"mcp-security-review:latest"
],
"env": {
"PATH": "/usr/local/bin:/usr/bin:/bin",
"JIRA_URL": "https://your-domain.atlassian.net",
"JIRA_USERNAME": "[email protected]",
"JIRA_API_TOKEN": "your-token"
}
}
}
}
Fit and risk
Not for
- Enterprises needing deep security audits or compliance reports
- Users without Docker (or can use plugin instead)
- Projects that don't require threat modeling or CVE scanning
Required permissions
- File system access (writing threat-model.md)
- Network access (calling OSV.dev, Jira, Confluence APIs)
- API tokens in environment variables (Jira, Confluence)
Risks and side effects
- Security reviews are based on OWASP guidelines but may not cover all scenarios
- Reachability analysis in dependency scanning may be inaccurate
- Requires configuring Jira/Confluence tokens; improper handling may leak credentials
- Automatic injection of security requirements may alter coding workflow
Troubleshooting
- Check that Docker is running and the image is built
- Verify environment variables (JIRA_URL, CONFLUENCE_URL, etc.) are set correctly
- Ensure API tokens are valid and have necessary permissions
- For HTTP transport, ensure port 8000 is not occupied
Use cases
Ensuring security while vibe coding
Getting security requirements before coding
Scanning dependencies for CVEs
Generating threat models
Verifying code security after generation
Supported clients
Claude DesktopFull support
CursorFull support
Claude CodeFull support