How to Use the Veracode MCP in Windsurf

Q: How do I check if my Veracode connection is working with Windsurf?

Just call getapihealth. It quickly checks the overall health of the Veracode connection, letting you know immediately if there’s an issue before your agent gets stuck.

Q: Can I list all my Veracode applications using Windsurf?

Absolutely. The listapplications tool pulls a list of every Veracode AppSec Application you have access to. These structural entities return a GUID, which is what you'll need for any deeper lookups.

Q: If I need vulnerability details for Veracode using Windsurf, what tool do I use?

Use getfindingdetails. This is super precise—it explains the flaw by giving you the CWE, the affected source file, and a clear code path. It’s much better than just getting a score.

Analyze code flaws and manage security profiles entirely within Windsurf's autonomous agent.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Veracode MCP to Windsurf

Create your Vinkius account to connect Veracode to Windsurf and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Veracode with Windsurf

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Manage App Profiles

Use `list_applications` to pull a global list of all Veracode AppSec Applications. From there, you can use `get_application_details` to check an app's current compliance policy status and its business criticality rating. Setting up new apps is simple; just give the schema and profile name when calling `create_application`. When you’re done with a container, remember that `delete_application` permanently removes it.

Assess Vulnerabilities

Need to know about a specific flaw? Run `get_finding_details`. This gives you the vulnerability type (CWE), where in the source file it was found, and exact code path information. It even provides remediation guidance right away. If you need a full picture of security flaws across an app, call `list_security_findings`. You’ll get the unified list of findings for that application.

Review App Security Components

The server lets you view all configured Dynamic Analysis (DAST) scans by running `list_dynamic_analyses`. It also lists every testing sandbox linked to an app using `list_sandboxes`. Want to manage who can see this data? Use `list_veracode_users` and other management tools to handle the Role-Based Access Control (RBAC) roles for your team.

Setup guide

Set up Veracode MCP in Windsurf

Prerequisites

Windsurf IDE installed (macOS, Windows, or Linux)
Active Vinkius subscription with a valid endpoint token

1

Open MCP configuration

Click the Cascade assistant icon in the sidebar, then click the hammer icon (🔨) at the top of the panel. Select "Configure" to open ~/.codeium/windsurf/mcp_config.json.
2

Add the Veracode MCP

Paste the JSON snippet shown on the right into the mcpServers object. Replace [YOUR_TOKEN_HERE] with your endpoint token from cloud.vinkius.com.
3

Refresh MCPs

Go back to the hammer icon (🔨) in Cascade and click "Refresh". Windsurf will detect the new server. No full restart is needed — the connection is hot-reloaded.
4

Verify in Cascade

Start a new Cascade conversation and ask something like "Show my Veracode payment history." If connected, Cascade will call the Veracode tools directly. You will see a green dot next to the server name in the MCP panel.

mcp_config.json

{
  "mcpServers": {
    "veracode-mcp": {
      "url": "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    }
  }
}

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Veracode. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Veracode now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Veracode MCP in Windsurf

Just call `get_api_health`. It quickly checks the overall health of the Veracode connection, letting you know immediately if there’s an issue before your agent gets stuck.

Absolutely. The `list_applications` tool pulls a list of every Veracode AppSec Application you have access to. These structural entities return a GUID, which is what you'll need for any deeper lookups.

It hands back detailed info including the app’s current compliance policy status, its business criticality rating, deployment state, and various risk scores. It's a deep dive into the app's posture.

Use `get_finding_details`. This is super precise—it explains the flaw by giving you the CWE, the affected source file, and a clear code path. It’s much better than just getting a score.

This server deals with application profiles and security findings. You'll be managing sensitive information like AppSec Application GUIDs, vulnerability types (CWE), and deployment status.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript