ArmorCode MCP

Local MCP server for ArmorCode — finding triage, scans, exceptions, risk scores, and release gate checks.

---

Quick start

{
  "mcpServers": {
    "armorcode": {
      "command": "npx",
      "args": ["-y", "@raviraj87/armorcode-mcp"],
      "env": {
        "ARMORCODE_URL": "https://your-tenant.armorcode.com",
        "ARMORCODE_API_TOKEN": "your-api-token"
      }
    }
  }
}

ARMORCODE_WRITE_ENABLED is optional — omit it for safe defaults (write tools preview only).

---

Environment variables

Variable	Required	Description
ARMORCODE_URL	Yes	Tenant base URL
ARMORCODE_API_TOKEN	Yes	API token from Manage → Integrations → API
ARMORCODE_WRITE_ENABLED	No	Set true to apply writes with dryRun: false

---

Tools (v1.0)

Findings

Tool	Purpose
armorcode_search_findings	Search/filter findings
armorcode_get_finding	Full finding detail
armorcode_get_finding_events	Audit trail
armorcode_get_findings_stats	Counts by severity/status
armorcode_get_severity_stats	Severity breakdown

Status & comments (write, dry-run default)

Tool	Purpose
armorcode_confirm_finding	OPEN → CONFIRMED
armorcode_control_finding	→ CONTROLLED
armorcode_block_finding	Block via accept-risk
armorcode_accept_risk	Accept risk
armorcode_mark_false_positive	False positive
armorcode_reopen_finding	Reopen
armorcode_triage_finding	→ TRIAGE
armorcode_mitigate_finding	→ MITIGATED
armorcode_suppress_finding	Suppress
armorcode_add_comment	Add note
armorcode_add_exploitability_comment	Structured exploitability
armorcode_update_finding_severity	Change severity

Products & risk

Tool	Purpose
armorcode_list_products	List products/groups
armorcode_list_subproducts	List subproducts
armorcode_get_product_risk_score	Product risk
armorcode_get_subproduct_risk_score	Subproduct risk
armorcode_get_all_product_risk_scores	All products

Scans & exceptions

Tool	Purpose
armorcode_list_scans	List scans
armorcode_get_scan	Scan details
armorcode_execute_scan	Trigger scan
armorcode_trigger_scan_pull	PULL tool scheduler (Black Duck, etc.)
armorcode_list_scan_schedulers	List schedulers
armorcode_delete_scan_scheduler	Clean up scheduler
armorcode_list_exceptions	Open exceptions
armorcode_get_exception	Exception detail
armorcode_create_exception	Create risk register entry
armorcode_release_gate_status	Jenkins release gate check

Escape hatch

Tool	Purpose
armorcode_health	Connectivity check
armorcode_api	Any GET/POST/PUT/DELETE path

---

Dev

cd armorcode-mcp
npm install
npm run build
ARMORCODE_URL=... ARMORCODE_API_TOKEN=... npm run test:readonly

License

MIT — Copyright © 2026 Ravi Raj