O360

Name: O360
Author: offensive360

@offensive360MCP server · External

Run Offensive360 SAST scans (60+ languages) on local code; findings with file/line and fixes

Penetration testingv1.0.2MITJavaScript

Freeno charge per call

How to install

Runs on your machine from its package; the steps are below.

What it does

Reads
Writes
High impact

At most: moves money, runs code or commands, deletes data, or sends messages for you.

What it costs

Free

Odel charges nothing per call. The publisher may charge for its own service.

Runs locally over stdio

This server isn't hosted — your MCP client launches it from a package registry. Use one of the commands below, or drop the config into your client (e.g. Claude Desktop).

npmo360-mcpv1.0.2

Run

npx -y o360-mcp

MCP client config

{
  "mcpServers": {
    "o360": {
      "command": "npx",
      "args": [
        "-y",
        "o360-mcp"
      ]
    }
  }
}

README1 min readView on GitHub

Offensive360 MCP Server

Run Offensive360 SAST scans from inside your AI assistant. This Model Context Protocol server gives Claude Code, Claude Desktop, Cursor, and any other MCP client two tools:

Tool	What it does
`o360_scan_path`	Zips a local directory, runs a full SAST scan (60+ languages, taint/data-flow analysis), returns findings with file/line, severity, and fixes
`o360_scan_status`	Queue position of a running scan

Ask your assistant things like "scan this project with Offensive360 and fix the criticals" — it scans, reads the findings, and starts patching.

Setup

You need an Offensive360 External scan token:

Open-source / public repos: free — request one at offensive360.com/free-for-open-source
Commercial: any admin of your instance can create one under Settings → Tokens

Claude Code

bash

claude mcp add offensive360 \
  -e O360_URL=https://sast.offensive360.com \
  -e O360_TOKEN=<your-token> \
  -- npx -y o360-mcp

Claude Desktop / Cursor (JSON)

json

{
  "mcpServers": {
    "offensive360": {
      "command": "npx",
      "args": ["-y", "o360-mcp"],
      "env": {
        "O360_URL": "https://sast.offensive360.com",
        "O360_TOKEN": "<your-token>"
      }
    }
  }
}

O360_URL can point at your own on-premise or air-gapped instance — the server talks only to the instance you configure.

Notes

Scans are synchronous; typical duration is 1–5 minutes depending on codebase size. The default client timeout is 900s (timeout_seconds parameter to override).
Common junk directories (node_modules, .git, dist, …) are excluded from the upload automatically; add more via the exclude parameter.
Findings are also visible in your Offensive360 dashboard with full data-flow traces.
Requires Node 18+.

About Offensive360

One platform for SAST, DAST, MAST, SCA, malware & binary analysis, and license compliance — flat pricing, cloud or fully air-gapped on-premise. offensive360.com · Book a demo

Similar modules

Browse Penetration testing