O360 MCP runs on your own machine — the client starts it, so there is no endpoint to ping. 47 installs a week from npm. Last commit 2 Aug 2026.
Run Offensive360 SAST scans (60+ languages) on local code; findings with file/line and fixes
Nothing serious here today
Today is the operative word: we check O360 MCP every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.
Connect this server
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add o360-mcp -e 'O360_TOKEN=<O360_TOKEN>' -- npx -y o360-mcp{
"mcpServers": {
"o360-mcp": {
"command": "npx",
"args": [
"-y",
"o360-mcp"
],
"env": {
"O360_TOKEN": "<O360_TOKEN>"
}
}
}
}[mcp_servers.o360-mcp]
command = "npx"
args = ["-y", "o360-mcp"]
env = { O360_TOKEN = "<O360_TOKEN>" }{
"mcpServers": {
"o360-mcp": {
"command": "npx",
"args": [
"-y",
"o360-mcp"
],
"env": {
"O360_TOKEN": "<O360_TOKEN>"
}
}
}
}{
"servers": {
"o360-mcp": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"o360-mcp"
],
"env": {
"O360_TOKEN": "<O360_TOKEN>"
}
}
}
}Put your own value in place of
<O360_TOKEN> (External scan token (free for public repos: https://offensive360.com/free-for-open-source/)).
The author’s registry entry marks it as required.
Optional settings from the registry entry, left out of the block above:
O360_URL (Offensive360 instance base URL).
Alternatives to O360 MCP
same job, measured the same wayLocal code-quality rules, findings, preview-first safe fixes and gate results for coding agents.
Build Apps and run code in 30 languages — sandboxed, with persistent sessions for agent loops.
Local, token-budgeted code context with file:line provenance and selection receipts.
Write, type-check and run Mort code, with language spec and stdlib lookup.
One record of code, files and pages that people and agents read and write, with lanes and git.
Scans code changes for leaked secrets and insecure config, with actionable fixes for AI agents.
Bring Visual Studio-style C# fixes and refactorings to your AI agent with local Roslyn Code Actions.
Profile Shopify Liquid performance, find slow theme code, and explain fixes in plain language.
O360 MCP — questions
Answers built from our own checks of this server.