M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
A

AI Security Crew

Community
Security review MCP server for vibe coding
How to install ↓ Compare GitHub source repository ↗
Category
Dev Tools #95 of 438
Stars
★ 73 Popular
Transport
stdio (local process) · Streamable HTTP · SSE
Runtime
Docker · Python
Credentials
Optional API key
License
MIT
Last commit
Tools
8
62FMRS · C

AI Security Crew is a practical MCP server tailored for vibe coding, offering security review, dependency scanning, and threat modeling. It integrates OWASP guidelines and supports Jira/Confluence integration. It suits individuals and teams who prioritize security while developing rapidly, but users should be aware of configuration requirements and limitations in reachability analysis.

Strongest · Security and permissions 16/20 Weakest · Reliability 7/20

Reliability
7/20
Security and permissions
16/20
Maintenance
12/20
Documentation
15/20
Setup experience
12/20
Why each score
Reliability 7/20
The server manifest is not cached, and there is no direct evidence verifying that the declared tools match real behavior. The README claims to send workflow instructions via the MCP initialize handshake, but lacks verification such as samples or test output. The repository includes CI badges, but the actual CI configuration or test code is not present in the provided files. Therefore, reliability is conservatively set to 7, as while there is a badge, there is no executable evidence.
Security and permissions 16/20
The server runs in Docker and accepts Jira/Confluence credentials via environment variables, avoiding hardcoding in config files. The README recommends API tokens or OAuth and explicitly warns against committing API tokens, so there is no red-line credential exposure. However, the config example includes placeholder 'auth' fields, which is inappropriate, and there is no explicit statement of least privilege for the tools or confirmation mechanisms for dangerous operations. Hence a deduction, but not red-line, resulting in 16.
Maintenance 12/20
The repository has an MIT license and shows 68 stars and 4 open issues, indicating some community interest. However, commit history, version releases, or dependency update information are not provided. Given limited activity signals and lack of evidence for maintenance timeline, score is 12.
Documentation 15/20
The README provides installation instructions, tool list, authentication methods, and example configs, covering major aspects. However, detailed parameter descriptions, limitations, and troubleshooting guides are missing. For example, specific input/output parameters for each tool are not specified, and common issue resolutions are absent. Thus, documentation is usable but not comprehensive, score 15.
Setup experience 12/20
Docker build and IDE config examples are provided, along with HTTP transport options, but no non-Docker installation methods like npx or uvx. Full client configuration examples, such as for Claude Desktop or Cursor, are not given. Therefore, the installation path is clear but limited in flexibility, score 12.

Static review · not runListed 2026-08-07

Read the FMRS scoring method →

Fit and risk

What it can accessUses the network

Best for

  • Developers who want security guidance while coding fast
  • Users of AI coding tools like Claude Code and Cursor
  • Teams using Jira and Confluence for issue tracking

Not for

  • Enterprises needing deep security audits or compliance reports
  • Users without Docker (or can use plugin instead)
  • Projects that don't require threat modeling or CVE scanning

Required permissions

  • File system access (writing threat-model.md)
  • Network access (calling OSV.dev, Jira, Confluence APIs)
  • API tokens in environment variables (Jira, Confluence)

Risks and side effects

  • Security reviews are based on OWASP guidelines but may not cover all scenarios
  • Reachability analysis in dependency scanning may be inaccurate
  • Requires configuring Jira/Confluence tokens; improper handling may leak credentials
  • Automatic injection of security requirements may alter coding workflow

Setup

Before you start

Runtime：Docker · Python

JIRA_API_TOKEN optionalsecret Jira Cloud API token, created in Atlassian account settings.
JIRA_PERSONAL_TOKEN optionalsecret Personal access token for Jira Server/Data Center, alternative to API token.
CONFLUENCE_API_TOKEN optionalsecret Confluence Cloud API token, created in Atlassian account settings.
CONFLUENCE_PERSONAL_TOKEN optionalsecret Personal access token for Confluence Server/Data Center.
Other optional settings (4)
JIRA_URL optional Your Jira site URL (e.g. https://your-domain.atlassian.net), used by assess_ticket_security to read tickets.
JIRA_USERNAME optional Your Jira account email, used with API token auth.
CONFLUENCE_URL optional Your Confluence site URL, used for threat model search and persistence.
CONFLUENCE_USERNAME optional Your Confluence account email.
  1. Build the image: docker build -t mcp-security-review:latest .
  2. Configure your MCP client (e.g., Claude Desktop, Cursor) using the config example.
  3. Or use the Claude Code plugin: /plugin install Srajangpt1/ai_security_crew
  4. Or manually add the slash commands from .claude/commands/ to your project.
claude_desktop_config.json 
{
  "mcpServers": {
    "sec-review": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "-e",
        "JIRA_URL",
        "-e",
        "JIRA_USERNAME",
        "-e",
        "JIRA_API_TOKEN",
        "-e",
        "CONFLUENCE_URL",
        "-e",
        "CONFLUENCE_USERNAME",
        "-e",
        "CONFLUENCE_API_TOKEN",
        "mcp-security-review:latest"
      ],
      "env": {
        "PATH": "/usr/local/bin:/usr/bin:/bin",
        "JIRA_URL": "https://your-domain.atlassian.net",
        "JIRA_USERNAME": "[email protected]",
        "JIRA_API_TOKEN": "your-token"
      }
    }
  }
}

Shown for Claude Desktop. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json
{
  "servers": {
    "sec-review": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "-e",
        "JIRA_URL",
        "-e",
        "JIRA_USERNAME",
        "-e",
        "JIRA_API_TOKEN",
        "-e",
        "CONFLUENCE_URL",
        "-e",
        "CONFLUENCE_USERNAME",
        "-e",
        "CONFLUENCE_API_TOKEN",
        "mcp-security-review:latest"
      ],
      "env": {
        "PATH": "/usr/local/bin:/usr/bin:/bin",
        "JIRA_URL": "https://your-domain.atlassian.net",
        "JIRA_USERNAME": "[email protected]",
        "JIRA_API_TOKEN": "your-token"
      }
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal
claude mcp add sec-review -e PATH=/usr/local/bin:/usr/bin:/bin -e JIRA_URL=https://your-domain.atlassian.net -e [email protected] -e JIRA_API_TOKEN=your-token -- docker run --rm -i -e JIRA_URL -e JIRA_USERNAME -e JIRA_API_TOKEN -e CONFLUENCE_URL -e CONFLUENCE_USERNAME -e CONFLUENCE_API_TOKEN mcp-security-review:latest

Run it in a terminal; replace any <…> placeholders with your own values first.

Generate and validate client config

Check that it works

After building the image and connecting the client, lightweight_security_review should appear in the client's tool list; calling it and getting security requirements back proves the connection works.

Troubleshooting

  1. Check that Docker is running and the image is built
  2. Verify environment variables (JIRA_URL, CONFLUENCE_URL, etc.) are set correctly
  3. Ensure API tokens are valid and have necessary permissions
  4. For HTTP transport, ensure port 8000 is not occupied

Things to try

Once connected, you can ask your AI assistant things like:

  • Run a lightweight security review for my tech stack before I start coding
  • Verify these packages exist and scan the code that uses them for reachable CVEs
  • Review the code I just generated for security vulnerabilities against OWASP guidelines
  • Create a threat model for this new feature and save it to threat-model.md

Tools 8

lightweight_security_review read-only
Call before any coding task to get security requirements and guidelines for your tech stack.
assess_ticket_security read-only
Pull security requirements directly from a Jira ticket before coding.
perform_threat_model read-only
Generate a structured threat model (STRIDE, attack surfaces) for significant new features.
verify_packages read-only
Confirm packages exist with valid versions to catch hallucinated package names.
scan_dependencies read-only
Scan for CVEs and check reachability in your code when adding packages.
verify_code_security read-only
AI-powered security review of generated code against OWASP guidelines.
search_previous_threat_models read-only
Check Confluence for existing threat models before creating a new one.
update_threat_model_file writes
Write the threat model to threat-model.md in the repo after perform_threat_model.

Use cases

Ensuring security while vibe coding
Getting security requirements before coding
Scanning dependencies for CVEs
Generating threat models
Verifying code security after generation

Supported clients

Claude Desktop
Cursor
Claude Code

Listed from the project's documentation, not tested by this site.

Overview

AI Security Crew is a lightweight MCP server for security reviews built for vibe coding. It injects security requirements before code generation, scans dependencies for CVEs, and verifies generated code without breaking your coding rhythm. It provides tools for security reviews, Jira ticket assessment, threat modeling, package verification, dependency scanning, and code security verification. It also works as a Claude Code plugin with commands /sec-review, /verify-code, and /threat-model.

Similar servers

Context7 80 · B

Upstash's official server providing up-to-date third-party library docs for AI coding assistants

★ 63.3k · Tools 2 Compare with this →
Compare with other MCP servers

Source revision 0e1390b0b18b Data synced 2026-10-19 Read the FMRS scoring method