MCP Server

The CodeAnt CLI includes a native Model Context Protocol server. It exposes structured tools for repository scans, organization Hotlist findings, cloud security, pentesting, pull requests, and local code review. The server uses stdio transport and runs with the same authentication as the CLI:

codeant mcp

The native server is read-only by default. Write tools are registered only when you explicitly set CODEANT_READ_ONLY=0.

Prerequisites

Install the CodeAnt CLI.
Authenticate with codeant login, or provide CODEANT_API_TOKEN to the MCP process.
Verify that codeant mcp is available in your installed CLI version.

The MCP server does not automatically open a browser during startup. Authenticate before starting it, or call the codeant_login MCP tool from your client.

Claude Code

Add the server at user scope so it is available in every project:

claude mcp add codeant -s user -e CODEANT_READ_ONLY=1 -- codeant mcp

Run /mcp in Claude Code to confirm that the codeant server is connected. To scope the server to one repository, use -s project instead. Claude Code writes the configuration to the repository’s .mcp.json.

MCP client configuration

For Claude Desktop, Cursor, VS Code, Windsurf, Zed, and other stdio MCP clients, add:

{
  "mcpServers": {
    "codeant": {
      "command": "codeant",
      "args": ["mcp"],
      "env": {
        "CODEANT_READ_ONLY": "1"
      }
    }
  }
}

Restart the client after changing its MCP configuration. If the client cannot find the globally installed codeant executable, use an absolute path to it or invoke the installed CLI entry point with Node:

{
  "mcpServers": {
    "codeant": {
      "command": "node",
      "args": ["/absolute/path/to/codeant-cli/src/index.js", "mcp"],
      "env": {
        "CODEANT_READ_ONLY": "1"
      }
    }
  }
}

Authentication options

The server resolves CodeAnt authentication in this order:

CODEANT_API_TOKEN in the MCP server environment.
The key saved by codeant login in ~/.codeant/config.json.

Set a custom CodeAnt API host with CODEANT_API_URL for self-hosted deployments. Application-backed tools select one exact authenticated organization/provider connection. When a user has multiple connections, agents should call codeant_scans_orgs first and pass org and service to subsequent tools.

Findings tools

All findings tools are available in the default read-only mode.

Tool	Purpose
`codeant_scans_orgs`	List authenticated organization connections.
`codeant_scans_repos`	List repositories in an organization.
`codeant_scans_history`	List scan history for a repository.
`codeant_scans_get`	Get scan metadata and severity/category totals.
`codeant_scans_results`	Fetch repo-level SAST, SCA, Secrets, IaC, and quality findings.
`codeant_scans_dismissed`	List dismissed repository alerts.
`codeant_hotlist_list`	Query prioritized organization-wide Hotlist findings.
`codeant_hotlist_get`	Fetch one complete Hotlist finding by stable ID.
`codeant_findings_antipatterns`	Fetch anti-patterns across selected or all organization repositories.
`codeant_cloud_scan_history`	Discover AWS, Azure, or GCP CSPM, VM, and container scans.
`codeant_cloud_findings_list`	List findings for one cloud scan.
`codeant_cloud_finding_get`	Fetch full detail for one cloud finding UID.
`codeant_pentest_history`	List pentest engagements.
`codeant_pentest_issues`	Fetch all available issues for an engagement.
`codeant_pentest_report`	Fetch the complete prod or test pentest report.

See Findings for CLI equivalents, required provider scope fields, filters, and example workflows.

Tool	Purpose
`codeant_api_get`	Call an authenticated relative GET endpoint.
`codeant_pr_list`	List pull requests or merge requests.
`codeant_pr_get`	Fetch pull request detail.
`codeant_pr_comments`	List pull request comments.
`codeant_comments_search`	Search CodeAnt review comments.
`codeant_review_local`	Review local working-copy changes without modifying files.

Authentication tools

codeant_login opens browser-based authentication when an agent explicitly calls it. codeant_logout revokes and clears the current key. These tools remain available in the default mode because they manage the MCP connection’s own authentication rather than product data.

Enable write tools

Set CODEANT_READ_ONLY=0 only when the MCP client should be allowed to change external state:

{
  "mcpServers": {
    "codeant": {
      "command": "codeant",
      "args": ["mcp"],
      "env": {
        "CODEANT_READ_ONLY": "0"
      }
    }
  }
}

This adds three tools:

Tool	Action
`codeant_scans_start`	Trigger a repository scan.
`codeant_pr_resolve`	Resolve a pull request conversation.
`codeant_api_request`	Call an authenticated POST, PUT, PATCH, or DELETE endpoint.

codeant_api_request can call application write endpoints. Keep read-only mode enabled unless your agent needs these operations and your approval policy is configured appropriately.

Example agent requests

“List my repositories, then show critical SAST findings for the API repository.”
“Show all high-severity AWS CSPM findings from the latest scan.”
“Fetch this Hotlist finding by its stable ID and explain the remediation.”
“List the open issues in the latest pentest engagement.”
“Review my staged changes with CodeAnt.”

Troubleshooting

Problem	Resolution
`codeant: command not found`	Use the absolute executable path in the MCP configuration, then restart the client.
Server starts but tools return authentication errors	Run `codeant login` or set `CODEANT_API_TOKEN` in the MCP environment.
Application tools report multiple organizations	Call `codeant_scans_orgs`, then pass both `org` and `service`.
Access denied after upgrading	Run `codeant logout`, then `codeant login` to refresh older key metadata.
Write tool is missing	Set `CODEANT_READ_ONLY=0` and restart the MCP client.
Self-hosted API is not used	Set `CODEANT_API_URL` in the MCP server environment.

Findings

Query repository, Hotlist, cloud-security, and pentest findings.

SCM and PR tools

Manage pull requests, comments, and review data.

Get Started

AI Code Review

Scan Center

Code Security

Cloud Security

Code Quality

Engineering Metrics

IDE

CLI

CI/CD

Integrations

Rule Reference

How CodeAnt Uses CodeAnt

Resources

Prerequisites

Claude Code

MCP client configuration

Authentication options

Findings tools

Other read-only tools

Authentication tools

Enable write tools

Example agent requests

Troubleshooting

Findings

SCM and PR tools

​Prerequisites

​Claude Code

​MCP client configuration

​Authentication options

​Findings tools

​Other read-only tools

​Authentication tools

​Enable write tools

​Example agent requests

​Troubleshooting

Findings

SCM and PR tools

Prerequisites

Claude Code

MCP client configuration

Authentication options

Findings tools

Other read-only tools

Authentication tools

Enable write tools

Example agent requests

Troubleshooting