How to Use the Veracode MCP in Mastra AI

Q: Can I automate app creation using Mastra AI?

Yes. Your workflow can call createapplication by passing the necessary JSON schema and profile name. The agent then confirms the container is ready for subsequent scans or management actions.

Q: Does Veracode support listing apps in Mastra AI?

Definitely. Use listapplications to retrieve all structural entities globally using their unique GUIDs. This list is critical for initializing any multi-step security assessment workflow within the agent.

Q: What kind of data privacy considerations exist with Veracode and Mastra AI?

The server primarily touches metadata related to application profile status, such as risk scores, deployment state, and the list of security findings. The process is designed for structured, controlled workflow execution.

Automate complex Veracode security checks with reliable multi-step workflows in Mastra AI.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Veracode MCP to Mastra AI

Create your Vinkius account to connect Veracode to Mastra AI and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Veracode with Mastra AI

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Orchestrate App Lifecycle Management

Need to manage an app's entire lifecycle? You can run a workflow that first uses `list_applications` to find the GUID, then calls `get_application_details` for the compliance status. Mastra AI handles these multiple steps sequentially and manages retries if one step fails. When finished, you can safely execute `delete_application`. This irreversible action is contained within a workflow that requires explicit human approval, ensuring no accidental deletions.

Deep Dive Into Vulnerability Details

The `get_finding_details` tool provides granular information: the vulnerability type (CWE), the specific source file, and the code path. Mastra AI excels here; if a finding fails to load, it automatically retries the request using exponential backoff. You can also gather all findings for an app using `list_security_findings` and run them through conditional branching logic—for instance, only escalating flaws rated 'High' risk.

Manage Veracode Scanning & Users

A full security audit often requires checking scans and users. You can list all configured Dynamic Analysis (DAST) scans using `list_dynamic_analyses`, then check the available testing sandboxes with `list_sandboxes`. The workflow engine makes this multi-tool call reliable. For identity management, use `list_veracode_users` to pull a roster of authorized users before running an audit that checks for outdated roles.

Setup guide

Set up Veracode MCP in Mastra AI

Prerequisites

Node.js 18+ and a TypeScript project
@mastra/mcp + @mastra/core packages
Active Vinkius subscription with a valid endpoint token

1

Install dependencies
Run npm install @mastra/mcp @mastra/core plus your preferred model provider (e.g. @ai-sdk/openai).
2

Configure the MCPClient
Create an MCPClient with your Vinkius endpoint as a URL object. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com.
3

Discover and inject tools
Call mcpClient.listTools() and spread the result into your agent's tools object. All Veracode tools become native Mastra tools.
4

Run with any model
Swap openai("gpt-4o") for any AI SDK-compatible provider. Call agent.generate() and the agent routes tool calls through MCP automatically.

agent.ts

import { MCPClient } from "@mastra/mcp";
import { Agent } from "@mastra/core/agent";
import { openai } from "@ai-sdk/openai";

const mcpClient = new MCPClient({
  id: "veracode-mcp-client",
  servers: {
    "veracode-mcp": {
      url: new URL(
        "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
      ),
    },
  },
});

const agent = new Agent({
  name: "Veracode Agent",
  model: openai("gpt-4o"),
  instructions: "You have access to Veracode tools.",
  tools: {
    ...(await mcpClient.listTools()),
  },
});

const result = await agent.generate(
  "List recent Veracode transactions"
);
console.log(result.text);

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Veracode. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Veracode now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Veracode MCP in Mastra AI

Mastra AI uses the MCP Server tools within its workflow engine. You define a series of steps—like listing applications, getting details, and then checking findings—and it executes them robustly, handling failures automatically.

Yes. Your workflow can call `create_application` by passing the necessary JSON schema and profile name. The agent then confirms the container is ready for subsequent scans or management actions.

The server manages application profiles, security findings, and user roles (RBAC). Specific data points include compliance policy status, risk scores, and the vulnerability CWE type.

Definitely. Use `list_applications` to retrieve all structural entities globally using their unique GUIDs. This list is critical for initializing any multi-step security assessment workflow within the agent.

The server primarily touches metadata related to `application profile status`, such as risk scores, deployment state, and the list of security findings. The process is designed for structured, controlled workflow execution.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript