# Veracode MCP for AI Agents AI Agent Connect

> Veracode MCP connects your AI client to your Veracode security environment. It lets you query security findings, manage application profiles, and get remediation advice for vulnerabilities like XSS or SQL injection without leaving your IDE or chat interface. It turns complex security audits into simple conversations.

## Overview
- **Category:** fort-knox
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_ouSVtPeDCUVttGmj9FxRQS1WO3untKs29VHwWYZI/ai-agent-connect
- **Tags:** appsec, sast, dast, software-composition-analysis, code-security, devsecops

## Description

Veracode MCP connects your AI client to your Veracode security environment. It lets you query security findings, manage application profiles, and get remediation advice for vulnerabilities like XSS or SQL injection without leaving your IDE or chat interface. It turns complex security audits into simple conversations.

Imagine you're in the middle of a sprint and your security team flags a critical flaw. Instead of jumping into a separate dashboard, hunting through logs, and trying to map a CVE to a specific line of code, you just ask your AI agent. This Connector gives your agent the keys to your Veracode ecosystem, letting it pull real-time data on SAST, DAST, and SCA scans. You can check the health of your sandbox environments, create new application profiles before you even push a commit, or get a human-readable summary of your risk matrix. It's about moving security left by making it part of the conversation. By using this Connector through the Vinkius catalog, you take the friction out of security posture management. You stop clicking through menus and start getting answers about your CWE types and remediation steps directly where you work. It's like having a security analyst sitting next to you, ready to explain why a specific piece of code is a risk and how to patch it.

## Tools

### delete_application
Permanently remove a Veracode application from your account. Use this to clean up old projects.

### get_application_details
Pull a full profile of an app including risk scores and compliance. This gives you the big picture on any project.

### get_finding_details
Get specific details on a vulnerability like its CWE type and remediation steps. It's perfect for understanding how to fix a bug.

### list_applications
See every application currently tracked in your Veracode account. This helps you manage your entire security portfolio.

### list_dynamic_analyses
See a list of your configured DAST scans. Use this to track real-time execution bounds.

### list_security_findings
Pull all security flaws for a specific application. This is the go-to for seeing what needs fixing.

### create_application
Create a new Veracode application profile using a JSON schema. This helps you set up new projects quickly.

### list_sandboxes
See all testing sandboxes linked to an application. This helps you verify your testing environments.

### list_veracode_users
List all authorized users for RBAC management. Use this to audit who has access to your security data.

### get_api_health
Check if your connection to Veracode is active. It's the first thing to check if data isn't loading.

## Prompt Examples

**Prompt:** 
```
What are the most critical flaws in our 'Auth-Service' app?
```

**Response:** 
```
I've analyzed the security findings for 'Auth-Service'. Here are the most critical issues:

| Severity | Finding Type | Location |
| :--- | :--- | :--- |
| **Critical** | SQL Injection | `db_connector.py` (Line 42) |
| **High** | XSS | `login_form.html` (Line 12) |

Would you like me to pull the remediation steps for the SQL Injection?
```

**Prompt:** 
```
Explain finding ID 452 and how I can fix it.
```

**Response:** 
```
Finding ID 452 is an **Improper Neutralization of Input (CWE-79)**, commonly known as Cross-Site Scripting (XSS).

*   **Location:** `user_profile.js` at line 144.
*   **Description:** Untrusted input is being reflected into the browser DOM.
*   **Remediation:** Use a library like `DOMPurify` to sanitize the `userInput` variable before it hits `innerHTML`.

I can write a patch for line 144 for you now.
```

**Prompt:** 
```
Show me the risk score and compliance status for the 'Billing-API'.
```

**Response:** 
```
Here is the current security profile for **Billing-API**:

*   **Risk Score:** 84/100
*   **Business Criticality:** Very High
*   **Compliance Status:** **Did Not Pass**
*   **Policy:** Veracode Recommended High

It currently has 12 unmitigated critical severity flaws. Should I list those for you?
```

## Capabilities

### Query security findings
Ask your agent to list all security flaws for a specific application to see what needs fixing.

### Get remediation advice
Retrieve specific guidance on how to patch a vulnerability based on its CWE type.

### Manage app profiles
Create and update application profiles directly through your AI chat interface.

### Check scan statuses
Check the real-time progress and execution bounds of your scheduled DAST scans.

### Audit user roles
List authorized users to manage RBAC and keep your security environment secure.

### View sandbox health
Verify the status of testing sandboxes linked to your production applications.

## Use Cases

### Instant flaw remediation
A developer finds a bug and asks the agent for `get_finding_details` on a specific ID. The agent explains the CWE and provides a code patch immediately.

### Security risk auditing
A security manager asks for a summary of all apps. The agent uses `list_applications` and `get_application_details` to provide a risk matrix.

### Rapid sandbox verification
A DevSecOps engineer needs to prep a scan. They ask the agent to use `list_sandboxes` to confirm the correct testing environment is ready.

### Automated profile creation
A team starts a new project and uses `create_application` to register the app in Veracode before they even push the first commit.

## Benefits

- Fix bugs faster by using `get_finding_details` to see exact remediation steps for CWEs.
- Skip the dashboard by using `list_security_findings` to see all flaws in one place.
- Manage your portfolio with `create_application` to set up new profiles before commits.
- Audit your team's access quickly using `list_veracode_users` for RBAC oversight.
- Track scan progress with `list_dynamic_analyses` to see real-time DAST results.
- Verify environment readiness by using `list_sandboxes` to check testing areas.

## How It Works

The bottom line is you get a conversational interface for your entire Veracode security posture.

1. Provide your Veracode API ID and Secret to the Connector.
2. Open your preferred AI client like Claude or Cursor.
3. Ask your agent to list findings or explain specific security flaws.

## Frequently Asked Questions

**How does Veracode MCP help my dev team?**
It brings security information directly into your workspace. Developers can ask for remediation steps for specific bugs without leaving their IDE, which helps them fix security flaws faster.

**Can I use Veracode MCP to manage my app profiles?**
Yes, you can create and list application profiles through a conversational interface. This makes it much easier to register new projects in your security portfolio.

**Does Veracode MCP support DAST and SAST?**
Yes, the Connector can pull findings from both Static (SAST) and Dynamic (DAST) scans, providing a unified view of your security posture.

**Can I see who has access to my Veracode account?**
You can use the Connector to list authorized users. This is helpful for security managers who need to perform quick RBAC audits.

**How do I get remediation steps for a specific bug?**
Just ask your agent for the specific finding ID. The Connector will pull the CWE details, the affected code path, and the official remediation guidance for you.

**Can I get code remediation details directly in conversational chat?**
Yes! If you ask your AI: `fetch finding details for ID '391' on the 'PaymentGateway' app`, it will query Veracode and describe exactly what caused the vulnerability (e.g. CWE-79) and provide remediation context natively inside your text editor or UI.

**Are both Sandbox and Policy findings merged intelligently?**
The tool endpoints mirror Veracode's structure natively. You can query your `list_sandboxes` specifically, keeping your sandbox data accurately separated from your main application's formal risk profile and finding charts.

**Can I permanently delete unused legacy applications from Veracode via AI chat?**
Yes. The `deleteApplicationTool` is included. By providing the specific GUID of the application, the agent can irrevocably remove the AppSec profile along with all linked analyses, findings, and history, streamlining data hygiene.