gl-tches/altais-mcp

altais-mcp is an open-source server that helps AI coding agents check code for security problems. It follows a standard called the Model Context Protocol, which is the way tools like Claude Code talk to outside helpers. The server offers 132 different tools grouped into 24 modules. An AI agent can call those tools to scan code for vulnerabilities, model threats, audit dependencies, check compliance, or get advice on fixes. A key design choice is that every tool is read-only. The server looks at code, configuration, and architecture, but it never changes, runs, or sends anywhere the code it inspects. It also makes no network calls while running, because all the reference data such as CWE, OWASP, and OSV lists are bundled inside the package itself. The project is written in TypeScript and needs Node.js version 20 or higher. You install it by cloning the repo, running npm install, then npm run build. After that, you point your MCP client at the built file. There are two ways to connect: stdio for local use with something like Claude Code, and a streamable HTTP transport for remote or multi-agent setups. The HTTP mode binds only to localhost and requires a bearer token on every request. The 24 modules cover a wide spread of security topics. Some are on by default, including general scanning, threat modeling, OWASP coverage, secrets detection, HTTP header checks, supply chain audits, and authentication review. Others are opt-in and cover cryptography, containers, infrastructure as code, APIs, compliance mapping, machine learning security, agent security, runtime advice, and more. The configuration is a single TOML file where you switch modules on or off. The project is MIT licensed and the name comes from Altais, a star in the constellation Draco.