ZeroPath MCP Server
About
Open-source MCP server for querying ZeroPath security issues, patches, and scans using Claude, Cursor, Windsurf, or any AI assistant.
Details
- License
- MIT
Explore
- Direct tRPC V2 calls (no REST wrapper)
- Dynamic tool surface loaded from MCP manifest
- Client‑side input validation (best‑effort)
- Structured JSON responses (wrapper removed)
- Supports both queries and mutations
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
ZeroPath MCP ServerCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Add the following to your MCP config file (Claude Desktop, Cursor, etc.):
Install directly from GitHub:
uvx --from git+https://github.com/ZeroPathAI/zeropath-mcp-server zeropath-mcp-server
You can also pin to a specific version:
Use ZEROPATH_BASE_URL to target staging or another environment, for example:
export ZEROPATH_BASE_URL="https://staging.branch.zeropath.com"
---
{
"mcpServers": {
"zeropath": {
"command": "uv",
"args": [
"run",
"--project",
"/path/to/zeropath-mcp-server",
"python",
"-m",
"zeropath_mcp_server"
],
"env": {
"ZEROPATH_BASE_URL": "https://zeropath.com",
"ZEROPATH_TOKEN_ID": "your_token_id",
"ZEROPATH_TOKEN_SECRET": "your_token_secret",
"ZEROPATH_ORG_ID": "your_org_id"
}
}
}
}
{
"mcpServers": {
"zeropath": {
"command": "zeropath-mcp-server",
"env": {
"ZEROPATH_BASE_URL": "https://zeropath.com",
"ZEROPATH_TOKEN_ID": "your_token_id",
"ZEROPATH_TOKEN_SECRET": "your_token_secret",
"ZEROPATH_ORG_ID": "your_org_id"
}
}
}
}
---
uv run pytest tests/ -v
```
Tools are loaded dynamically from the ZeroPath frontend's MCP manifest at startup.
All tool calls use tRPC V2 procedures directly using tRPC v10 HTTP conventions:
- Queries: GET /trpc/<procedure>?input=<url-encoded-json>
- Mutations: POST /trpc/<procedure> with the raw JSON input object as the body (not wrapped).
Successful responses are returned as structured JSON with the { "result": { "data": ... } } wrapper removed. Errors return the tRPC error object directly.
The server also performs best-effort client-side input validation using each tool's inputSchema from the manifest and returns a BAD_REQUEST error before calling tRPC when inputs are invalid. If a schema uses unsupported JSON Schema features, client-side validation is skipped for that call (server-side validation remains authoritative).
---
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"zeropath mcp server": {
"zeropath-mcp-server": {
"command": "uv",
"args": [
"sync"
]
}
}
}
}McpServers
{
"zeropath-mcp-server": {
"command": "uv",
"args": [
"sync"
]
}
}
Interact with ZeroPath security findings via MCP-compatible tools.
This MCP server calls ZeroPath tRPC V2 procedures directly (no REST wrappers) and returns structured JSON responses suitable for agent consumption.
---
Blog Post
Learn more about why we built this and how it fits into the evolving AI development ecosystem:
Chat With Your AppSec Scans: Introducing the ZeroPath MCP Server
Installation
Quick Install (Recommended)
Install directly from GitHub:
```bash
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
