StackHawk

Q: Does StackHawk need an API key?

Yes. It reads STACKHAWK_API_KEY from its environment, and STACKHAWK_API_KEY is a secret. Put the value in your client's config on your own machine, never in a shared file.

listing.by

Set up StackHawk, run security scans and triage findings from your IDE or chat.

state.local.longlisting.badge.runs_withstate.key.long

listing.install

listing.local.explain

uvx stackhawk-mcp

listing.local.needs listing.local.note

STACKHAWK_API_KEY listing.env.secret StackHawk API key

act.add_to

listing.about

Connects an AI assistant to the StackHawk security scanning platform. It can detect your project, create a StackHawk application, generate a stackhawk.yml, run scans with the StackHawk CLI, and return findings at or above your failure threshold for remediation. It also validates YAML configs against the official schema.

Runs locally over stdio as the PyPI package stackhawk-mcp (for example with uvx), and requires Python 3.10 or higher. A StackHawk API key is required and is passed in the STACKHAWK_API_KEY environment variable. An optional FastAPI HTTP server is also included.

listing.can

Detect a project and create a StackHawk application
Generate a ready-to-scan stackhawk.yml
Run StackHawk scans from the IDE or chat
Triage findings at or above the failure threshold
Validate YAML configs against the official schema
Validate field paths to avoid invented config keys

listing.tools

listing.notools.key

listing.prompts

Set up StackHawk for this project and create a stackhawk.yml.
Validate this StackHawk YAML config for errors.
Run a StackHawk scan on my app and summarize the findings.
Show the findings above my failure threshold and suggest fixes.

listing.setup.h

listing.setup.local

Claude Code

Run this in a terminal, in your project folder:

claude mcp add --transport stdio stackhawk --env "STACKHAWK_API_KEY=<YOUR_STACKHAWK_API_KEY>" -- uvx stackhawk-mcp

Start Claude Code and type /mcp. stackhawk should show as connected.

Add --scope user to make it available in every project. Replace the placeholders with your own values.

Claude Desktop

Open Settings → Developer → Edit Config. It opens claude_desktop_config.json. Add:

claude_desktop_config.json

{
  "mcpServers": {
    "stackhawk": {
      "command": "uvx",
      "args": [
        "stackhawk-mcp"
      ],
      "env": {
        "STACKHAWK_API_KEY": "<YOUR_STACKHAWK_API_KEY>"
      }
    }
  }
}

Save the file and restart Claude Desktop. Replace the placeholders with your own values.

Needs uv (Python) on your computer. The file lives in ~/Library/Application Support/Claude/ on macOS and %APPDATA%\Claude\ on Windows.

Cursor

Add to Cursor a11y.new_tab

Or add it by hand to ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (this project):

mcp.json

{
  "mcpServers": {
    "stackhawk": {
      "command": "uvx",
      "args": [
        "stackhawk-mcp"
      ],
      "env": {
        "STACKHAWK_API_KEY": "<YOUR_STACKHAWK_API_KEY>"
      }
    }
  }
}

Needs uv (Python) on your computer. Replace the placeholders with your own values.

VS Code

Add it to .vscode/mcp.json. VS Code asks for the secret the first time and stores it securely:

.vscode/mcp.json

{
  "servers": {
    "stackhawk": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "stackhawk-mcp"
      ],
      "env": {
        "STACKHAWK_API_KEY": "${input:stackhawk-api-key}"
      }
    }
  },
  "inputs": [
    {
      "type": "promptString",
      "id": "stackhawk-api-key",
      "description": "STACKHAWK_API_KEY",
      "password": true
    }
  ]
}

Needs uv (Python) on your computer.

Devin Desktop

Add it to ~/.config/devin/mcp_config.json (macOS and Linux) or %APPDATA%\devin\mcp_config.json (Windows):

mcp_config.json

{
  "mcpServers": {
    "stackhawk": {
      "command": "uvx",
      "args": [
        "stackhawk-mcp"
      ],
      "env": {
        "STACKHAWK_API_KEY": "<YOUR_STACKHAWK_API_KEY>"
      }
    }
  }
}

Refresh the MCP server list in Cascade. Replace the placeholders with your own values.

Devin Desktop is the new name for Windsurf.

Codex

codex mcp add stackhawk --env "STACKHAWK_API_KEY=<YOUR_STACKHAWK_API_KEY>" -- uvx stackhawk-mcp

Or edit ~/.codex/config.toml directly:

config.toml

[mcp_servers.stackhawk]
command = "uvx"
args = ["stackhawk-mcp"]
env = { STACKHAWK_API_KEY = "<YOUR_STACKHAWK_API_KEY>" }

Needs uv (Python) on your computer. Replace the placeholders with your own values.

Gemini CLI

gemini mcp add -e "STACKHAWK_API_KEY=<YOUR_STACKHAWK_API_KEY>" stackhawk uvx stackhawk-mcp

This adds it to the current project. Add -s user to use it everywhere.

Any client

Most clients that start local servers accept this shape:

{
  "mcpServers": {
    "stackhawk": {
      "command": "uvx",
      "args": [
        "stackhawk-mcp"
      ],
      "env": {
        "STACKHAWK_API_KEY": "<YOUR_STACKHAWK_API_KEY>"
      }
    }
  }
}

Zed puts servers under context_servers in its settings, with the same command, args and env fields.

Needs uv (Python) on your computer. Replace the placeholders with your own values.

listing.faq

Can I paste mcp.tc/i/stackhawk into my MCP client?

No. StackHawk runs on your own computer, started by your client, so it has no web address to connect to. The quick link is the page to share; the install command is uvx stackhawk-mcp.

Does StackHawk need an API key?

Yes. It reads STACKHAWK_API_KEY from its environment, and STACKHAWK_API_KEY is a secret. Put the value in your client's config on your own machine, never in a shared file.

Is StackHawk a remote or a local server?

Local. Your client starts it as a process on your computer with uvx stackhawk-mcp, which needs uv (Python).

What can StackHawk do?

You can detect a project and create a StackHawk application, generate a ready-to-scan stackhawk.yml and run StackHawk scans from the IDE or chat.

Which clients can use it?

Any client that starts local servers: Claude Code, Claude Desktop, Cursor, VS Code, Devin Desktop, Codex, Gemini CLI, Zed and others. claude.ai and ChatGPT only connect to remote servers.

Who wrote this page?

mcp.tc's robot read StackHawk's public metadata (its package and repository pages), and an AI model drafted the text from it. A person reviews anything the checks can't confirm. The text can still be wrong, so if you spot a mistake, use Report this listing on this page.

listing.em.h

listing.em.lead_local listing.em.how

listing.em.badge

Markdown

[![StackHawk on mcp.tc](https://mcp.tc/i/stackhawk/badge.svg)](https://mcp.tc/i/stackhawk)

HTML

<a href="https://mcp.tc/i/stackhawk"><img src="https://mcp.tc/i/stackhawk/badge.svg" alt="StackHawk on mcp.tc" height="20"></a>

listing.em.badge_note

listing.em.widget

HTML

<script src="https://mcp.tc/w/stackhawk.js" async></script>

listing.em.widget_note

iframe

HTML

<iframe src="https://mcp.tc/embed/stackhawk" title="StackHawk on mcp.tc" width="420" height="200" loading="lazy" allow="clipboard-write" style="border:0;border-radius:8px;max-width:100%"></iframe>

listing.em.iframe_note

JSON

listing.em.json_local

https://mcp.tc/i/stackhawk.json

listing.em.fields

listing.disclaimer_checked

listing.install

listing.share.h

listing.about

listing.can

listing.tools

listing.prompts

listing.setup.h

Claude Code

Claude Desktop

Cursor

VS Code

Devin Desktop

Codex

Gemini CLI

Any client

listing.faq

listing.em.h

listing.em.badge

listing.em.widget

iframe

JSON

listing.related

Snyk API & Web

Zscaler Zero Trust Exchange

SonarQubevf.sr

Oktavf.sr

CrowdStrike Falconvf.sr

Burp Suite