MCP Setup

Connect your AI coding assistant to Nullify using the Model Context Protocol (MCP)

The Nullify CLI includes a built-in MCP server that gives AI coding assistants access to your security findings, triage tools, and more.

Prerequisites

• Install the Nullify CLI

• Authenticate with your Nullify instance

Claude Code

Add Nullify as an MCP server:

claude mcp add nullify -- nullify mcp serve

The Nullify tools will be automatically available in your Claude Code sessions.

Cursor

Add to your project's .cursor/mcp.json:

{
  "mcpServers": {
    "nullify": {
      "command": "nullify",
      "args": ["mcp", "serve"]
    }
  }
}

To register a different set of tools, append the optional --tools flag (see Tool Sets):

{
  "mcpServers": {
    "nullify": {
      "command": "nullify",
      "args": ["mcp", "serve", "--tools", "all"]
    }
  }
}

Codex

Add to your Codex MCP configuration:

{
  "mcpServers": {
    "nullify": {
      "command": "nullify",
      "args": ["mcp", "serve"]
    }
  }
}

The optional --tools flag selects which tool set is exposed (see Tool Sets):

{
  "mcpServers": {
    "nullify": {
      "command": "nullify",
      "args": ["mcp", "serve", "--tools", "findings"]
    }
  }
}

Tool Sets

The --tools flag controls which tools the MCP server registers. If omitted, the default set is used.

Value	Tools registered
default	Unified finding tools, composite workflow tools, plus Context, Manager, and Admin tools
all	Every tool, including the scanner-specific SAST/SCA/Secrets/Pentest/Bug Hunt/CSPM tools
minimal	Composite workflow tools only
findings	Unified finding tools plus composite workflow tools
admin	Admin, Context, Manager, and composite tools

nullify mcp serve --tools all

Available Tools

The exact tools registered depend on the selected tool set. The default set exposes the unified, composite, Context, Manager, and Admin tools listed below. Use --tools all to additionally expose the per-scanner tools.

Unified findings tools

These work across every scanner type (sast, sca_dependency, sca_container, secrets, pentest, bughunt, cspm); pass the type argument to scope to one scanner, or omit it to query across all of them.

• nullify_search_findings - Search findings across all or a specific scanner type (filters: severity, status, repository)

• nullify_get_finding - Get details of a specific finding by type and ID

• nullify_triage_finding - Update the triage status of a finding

• nullify_create_ticket - Create a ticket for a finding

• nullify_get_finding_events - Get the event history for a finding

• nullify_fix_finding - Generate an autofix and optionally open a PR

Composite workflow tools

• get_security_posture_summary - High-level counts by severity across every finding type

• get_findings_for_repo - All findings for a specific repository across every scanner

• get_critical_path - Critical and high severity findings across all types

• get_security_trends - How the security posture has changed over time

• remediate_finding - Orchestrate generate-autofix → diff → create-PR for a finding

Context tools

• list_repositories - List repositories monitored by Nullify

• get_repository - Get details of a specific monitored repository

• list_applications - List applications (logical groupings of repositories and services)

• get_application - Get details of a specific application

• list_dependencies - List third-party dependencies across monitored repositories

• get_sbom - Get the SBOM for a repository project

• get_dependency_exposure - Get exposure analysis for a dependency

Manager tools

• list_campaigns - List remediation campaigns

• get_campaign - Get details of a specific campaign

• list_escalations - List current escalations

Admin tools

• get_metrics_overview - High-level finding counts by severity and type

• get_metrics_over_time - Security metrics trends over a time period

• get_global_config - The organization's global Nullify configuration

• list_teams - List teams in the organization

• list_sla_policies - List SLA policies

• get_organization - Get organization details

Scanner-specific tools (--tools all)

These per-scanner tools are registered only when the all tool set is selected. They mirror the unified tools above but are bound to a single scanner. Examples:

• SAST: list_sast_findings, get_sast_finding, list_sast_repositories, triage_sast_finding, generate_sast_autofix, get_sast_autofix_diff, create_sast_autofix_pr, create_sast_ticket, get_sast_finding_events

• SCA: list_sca_dependency_findings, get_sca_dependency_finding, list_sca_container_findings, get_sca_container_finding, triage_sca_dependency_finding, triage_sca_container_finding, generate_sca_autofix, get_sca_autofix_diff, create_sca_autofix_pr, create_sca_ticket, get_sca_finding_events

• Secrets: list_secrets_findings, get_secrets_finding, triage_secrets_finding, create_secrets_ticket, get_secrets_finding_events

• Pentest: list_pentest_findings, get_pentest_finding, list_pentest_scans, get_pentest_scan, start_pentest, stop_pentest_scan, get_pentest_report, triage_pentest_finding, create_pentest_ticket, get_pentest_finding_events

• Bug Hunt: list_bughunt_findings

• CSPM: list_cspm_findings, get_cspm_finding, list_cspm_scans

Verifying the Connection

After configuring your AI assistant, you can verify the connection by asking:

"List my critical SAST findings"

With the default tool set the assistant uses nullify_search_findings (with type: sast) and returns results from your Nullify instance.

Troubleshooting

"Not authenticated" error

Run nullify auth status to check your login status. If not authenticated, run nullify auth login.

Tools not appearing

Ensure the nullify binary is in your PATH. Run which nullify to verify.

Connection issues

Check that your host is correctly configured with nullify auth config.