MCP Security Suite Demo

MCP Security Suite

Demo-ready DevSecOps + Supply-Chain Security MCP suite: SBOM (Syft), Vulnerabilities (Trivy), Policy (OPA), Reporting (aggregator). Pinned, non-root, reproducible.

• Tools: Syft v0.95.0, Trivy v0.47.0, OPA v0.58.0, Python 3.12
• MCP servers: sbom, vuln, policy, report
• Demo scripts: scripts/demo_supplychain.py, scripts/chain_cli.py

Key features:

• Robust MCP capability negotiation for mcp==1.17.0 (with shims for older behavior)
• Structured logging (set LOG_FORMAT=json, LOG_LEVEL=DEBUG|INFO|...)
• External tool timeouts via TOOL_TIMEOUT (seconds)
• Health tools on all servers and a Policy Docker healthcheck wired to --health

1‑Minute Demo

Prereqs: Syft/Trivy/OPA on PATH, Python 3.12.

• Linux/macOS:

- python3 -m venv .venv && source .venv/bin/activate - pip install -r tests/requirements.txt - cp .env.example .env || true - make demo - make print-report

• Windows (PowerShell):

- py -m venv .venv; .\.venv\Scripts\Activate.ps1 - pip install -r tests\requirements.txt - Copy-Item .env.example .env - $env:DEMO_IMAGE="nginx:1.27"; py .\scripts\demo_supplychain.py - Get-Content .\demo-report.json

Artifacts:

• demo-report.json (summary), sbom.json, vuln.json, policy.json (via scripts/chain_cli.py)

Quickstart (servers)

python3 -m venv .venv
source .venv/bin/activate
pip install -r servers/sbom/requirements.txt -r servers/vuln/requirements.txt -r servers/policy/requirements.txt -r servers/report/requirements.txt
python -m servers.sbom.app
python -m servers.vuln.app
python -m servers.policy.app
python -m servers.report.app

# Rebuild (optional)
docker build -t mcp-sbom:test servers/sbom
docker build -t mcp-vuln:test servers/vuln
docker build -t mcp-policy:test servers/policy
docker build -t mcp-report:test servers/report

# Confirm non-root (expect 10001)
docker run --rm --entrypoint id mcp-sbom:test -u
docker run --rm --entrypoint id mcp-vuln:test -u
docker run --rm --entrypoint id mcp-policy:test -u
docker run --rm --entrypoint id mcp-report:test -u

# Embedded tool versions (fast exit)
docker run --rm --entrypoint syft  mcp-sbom:test version
docker run --rm --entrypoint trivy mcp-vuln:test --version
docker run --rm --entrypoint opa   mcp-policy:test version | Select-String Version

# Server health (all servers expose a health tool; policy also exposes a CLI):
docker run --rm mcp-policy:test --health

Use VS Code with .copilot/servers.json to connect Copilot to these servers.

Makefile

• make venv — prepare virtualenv
• make demo — run end‑to‑end demo
• make print-report — show demo-report.json summary
• make lint — run pre-commit if installed
• make docker-build — build server images

CI

• GitHub Actions: .github/workflows/security.yml (pinned tool installs, caching, smoke tests, Markdown summary)
• Jenkins: Jenkinsfile (pinned tools; set TRIVY_CACHE_DIR for faster, stable builds)

Coverage gates:

• Pytest: target ≥ 80% for servers/ (integration tests stub external tools for determinism)

Developer setup

• Pre-commit (optional):

- pip install pre-commit && pre-commit install - run checks: make lint

Chain CLI (alternative to Makefile demo)

python scripts/chain_cli.py --image ${DEMO_IMAGE:-nginx:1.27}
cat demo-report.json

Configuration (env vars)

• LOG_FORMAT: set to json for JSON logs; default is plain text
• LOG_LEVEL: DEBUG, INFO (default), WARNING, ERROR
• TOOL_TIMEOUT: seconds to wait for syft/trivy/opa; default 60 (health uses 10 by default)
• DEMO_IMAGE: image for scripts/demo_supplychain.py; default nginx:1.27

Health

• All servers implement a health tool that returns {status: ok|error, ...}
• Policy exposes a CLI health endpoint for container healthchecks:

python -m servers.policy.app --health   # or: docker run --rm mcp-policy:test --health

Changelog

See CHANGELOG.md for recent changes.

Public Demo Notes

• This repository is a sanitized demo of the MCP Security Suite.
• No secrets, client-specific configs, or production endpoints are included.
• For enterprise rollout (signing/provenance, PR gates), contact the maintainer.