How to Use the Contrast Security MCP in VS Code Copilot

Q: How do we configure the Contrast Security MCP Server for our whole team in VS Code Copilot?

Create a .vscode/mcp.json file in your repository root and commit it. When team members open the project in VS Code with Copilot, the editor automatically loads the security tools.

Q: Does VS Code Copilot support all Contrast Security tools?

Yes, Copilot can call all 10 tools, including listcriticalvulnerabilities and searchapplicationsbyname, depending on what you ask it to do in the chat window.

Q: How does VS Code Copilot handle large lists of Contrast Security vulnerabilities?

Copilot uses searchvulnerabilities to filter and paginate the results. It asks you for specific criteria like application name or severity so it doesn't clutter your chat with irrelevant data.

Equip VS Code Copilot with Contrast Security telemetry to find and fix application vulnerabilities across your team.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Contrast Security MCP to VS Code Copilot

Create your Vinkius account to connect Contrast Security to VS Code Copilot and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Contrast Security with VS Code Copilot

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Team-wide security workflows in VS Code Copilot

VS Code Copilot uses `list_applications` to let your team query the status of monitored services from the chat panel. Standardize your team's security workflow by committing `.vscode/mcp.json` directly to your repository. Every developer using VS Code Copilot gets immediate access without manual setup. This ensures everyone on your engineering team looks at the same security data. Your developers can query the status of monitored services and get application details directly from the Copilot Chat panel.

Trace bugs to the source with this MCP Server

The agent uses `list_vulnerability_traces` to pull the actual exploit path recorded by Contrast Security. When Copilot flags a potential security issue, verify it against your live environments immediately. This workflow replaces slow security triage meetings. Developers get the exact line of code, the HTTP request payload that triggered the alert, and the remediation advice right inside VS Code via `get_vulnerability_details`.

Monitor server environments during development

VS Code Copilot uses the MCP server to query `list_monitored_servers` and keep track of where your applications are deployed. It gives developers context on which environments are currently active and monitored. If a developer is working on a legacy service, they can run `search_vulnerabilities` and `get_organization_info` to see if there are outstanding critical issues on that specific server before writing new features.

Setup guide

Set up Contrast Security MCP in VS Code Copilot

Prerequisites

VS Code 1.99 or later with GitHub Copilot extension
Active Vinkius subscription with a valid endpoint token

1

Open MCP configuration

Open the Command Palette (Cmd+Shift+P / Ctrl+Shift+P) and run "MCP: Add Server". Select HTTP (Streamable) as the server type. VS Code will create .vscode/mcp.json in your workspace.
2

Add the Contrast Security MCP

Paste the JSON snippet shown on the right into your .vscode/mcp.json. Replace [YOUR_TOKEN_HERE] with your endpoint token from cloud.vinkius.com.
3

Switch to Agent mode

Open Copilot Chat (Cmd+Shift+I / Ctrl+Shift+I) and switch to Agent mode using the dropdown. MCP tools are only available in Agent mode — they do not appear in Edit or Ask modes.
4

Verify the connection

In the Copilot Chat input, type # to list available tools. You should see the Contrast Security tools listed. Try asking: "List my recent Contrast Security transactions" and Copilot will invoke them automatically.

.vscode/mcp.json

{
  "mcpServers": {
    "contrast-security-mcp": {
      "url": "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    }
  }
}

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Contrast Security. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Contrast Security now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Contrast Security MCP in VS Code Copilot

Create a `.vscode/mcp.json` file in your repository root and commit it. When team members open the project in VS Code with Copilot, the editor automatically loads the security tools.

Yes, Copilot can call all 10 tools, including `list_critical_vulnerabilities` and `search_applications_by_name`, depending on what you ask it to do in the chat window.

It queries the organization tied to your Vinkius endpoint. The agent uses `list_organization_users` and `get_organization_info` to verify which organization context it is currently operating in.

Copilot uses `search_vulnerabilities` to filter and paginate the results. It asks you for specific criteria like application name or severity so it doesn't clutter your chat with irrelevant data.

Your application details and trace logs flow directly through Vinkius's zero-trust sandbox to your local VS Code client. Copilot processes this data locally to suggest fixes, keeping your proprietary vulnerability data private.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript