> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/cli/cli/mcp-setup.md).

# MCP Setup

The Nullify CLI includes a built-in MCP server that gives AI coding assistants access to your security findings, triage tools, and more.

## Prerequisites

* [Install the Nullify CLI](/cli/cli/install.md)
* [Authenticate with your Nullify instance](/cli/cli/authentication.md)

## Claude Code

Add Nullify as an MCP server:

```bash
claude mcp add nullify -- nullify mcp serve
```

The Nullify tools will be automatically available in your Claude Code sessions.

## Cursor

Add to your project's `.cursor/mcp.json`:

```json
{
  "mcpServers": {
    "nullify": {
      "command": "nullify",
      "args": ["mcp", "serve"]
    }
  }
}
```

To register a different set of tools, append the optional `--tools` flag (see [Tool Sets](#tool-sets)):

```json
{
  "mcpServers": {
    "nullify": {
      "command": "nullify",
      "args": ["mcp", "serve", "--tools", "all"]
    }
  }
}
```

## Codex

Add to your Codex MCP configuration:

```json
{
  "mcpServers": {
    "nullify": {
      "command": "nullify",
      "args": ["mcp", "serve"]
    }
  }
}
```

The optional `--tools` flag selects which tool set is exposed (see [Tool Sets](#tool-sets)):

```json
{
  "mcpServers": {
    "nullify": {
      "command": "nullify",
      "args": ["mcp", "serve", "--tools", "findings"]
    }
  }
}
```

## Tool Sets

The `--tools` flag controls which tools the MCP server registers. If omitted, the `default` set is used.

| Value      | Tools registered                                                                        |
| ---------- | --------------------------------------------------------------------------------------- |
| `default`  | Unified finding tools, composite workflow tools, plus Context, Manager, and Admin tools |
| `all`      | Every tool, including the scanner-specific SAST/SCA/Secrets/Pentest/Bug Hunt/CSPM tools |
| `minimal`  | Composite workflow tools only                                                           |
| `findings` | Unified finding tools plus composite workflow tools                                     |
| `admin`    | Admin, Context, Manager, and composite tools                                            |

```bash
nullify mcp serve --tools all
```

## Available Tools

The exact tools registered depend on the selected [tool set](#tool-sets). The `default` set exposes the unified, composite, Context, Manager, and Admin tools listed below. Use `--tools all` to additionally expose the per-scanner tools.

### Unified findings tools

These work across every scanner type (`sast`, `sca_dependency`, `sca_container`, `secrets`, `pentest`, `bughunt`, `cspm`); pass the `type` argument to scope to one scanner, or omit it to query across all of them.

* `nullify_search_findings` - Search findings across all or a specific scanner type (filters: severity, status, repository)
* `nullify_get_finding` - Get details of a specific finding by type and ID
* `nullify_triage_finding` - Update the triage status of a finding
* `nullify_create_ticket` - Create a ticket for a finding
* `nullify_get_finding_events` - Get the event history for a finding
* `nullify_fix_finding` - Generate an autofix and optionally open a PR

### Composite workflow tools

* `get_security_posture_summary` - High-level counts by severity across every finding type
* `get_findings_for_repo` - All findings for a specific repository across every scanner
* `get_critical_path` - Critical and high severity findings across all types
* `get_security_trends` - How the security posture has changed over time
* `remediate_finding` - Orchestrate generate-autofix → diff → create-PR for a finding

### Context tools

* `list_repositories` - List repositories monitored by Nullify
* `get_repository` - Get details of a specific monitored repository
* `list_applications` - List applications (logical groupings of repositories and services)
* `get_application` - Get details of a specific application
* `list_dependencies` - List third-party dependencies across monitored repositories
* `get_sbom` - Get the SBOM for a repository project
* `get_dependency_exposure` - Get exposure analysis for a dependency

### Manager tools

* `list_campaigns` - List remediation campaigns
* `get_campaign` - Get details of a specific campaign
* `list_escalations` - List current escalations

### Admin tools

* `get_metrics_overview` - High-level finding counts by severity and type
* `get_metrics_over_time` - Security metrics trends over a time period
* `get_global_config` - The organization's global Nullify configuration
* `list_teams` - List teams in the organization
* `list_sla_policies` - List SLA policies
* `get_organization` - Get organization details

### Scanner-specific tools (`--tools all`)

These per-scanner tools are registered only when the `all` tool set is selected. They mirror the unified tools above but are bound to a single scanner. Examples:

* SAST: `list_sast_findings`, `get_sast_finding`, `list_sast_repositories`, `triage_sast_finding`, `generate_sast_autofix`, `get_sast_autofix_diff`, `create_sast_autofix_pr`, `create_sast_ticket`, `get_sast_finding_events`
* SCA: `list_sca_dependency_findings`, `get_sca_dependency_finding`, `list_sca_container_findings`, `get_sca_container_finding`, `triage_sca_dependency_finding`, `triage_sca_container_finding`, `generate_sca_autofix`, `get_sca_autofix_diff`, `create_sca_autofix_pr`, `create_sca_ticket`, `get_sca_finding_events`
* Secrets: `list_secrets_findings`, `get_secrets_finding`, `triage_secrets_finding`, `create_secrets_ticket`, `get_secrets_finding_events`
* Pentest: `list_pentest_findings`, `get_pentest_finding`, `list_pentest_scans`, `get_pentest_scan`, `start_pentest`, `stop_pentest_scan`, `get_pentest_report`, `triage_pentest_finding`, `create_pentest_ticket`, `get_pentest_finding_events`
* Bug Hunt: `list_bughunt_findings`
* CSPM: `list_cspm_findings`, `get_cspm_finding`, `list_cspm_scans`

## Verifying the Connection

After configuring your AI assistant, you can verify the connection by asking:

> "List my critical SAST findings"

With the `default` tool set the assistant uses `nullify_search_findings` (with `type: sast`) and returns results from your Nullify instance.

## Troubleshooting

### "Not authenticated" error

Run `nullify auth status` to check your login status. If not authenticated, run `nullify auth login`.

### Tools not appearing

Ensure the `nullify` binary is in your PATH. Run `which nullify` to verify.

### Connection issues

Check that your host is correctly configured with `nullify auth config`.