Mcp Bitisght — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp Bitisght (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A focused Model Context Protocol (MCP) server that exposes BitSight Security Ratings as tools for AI assistants.
Note: This repo will be renamed frommcp-gatewaytomcp-bitsightto reflect its single purpose.
This is one component in a larger MCP architecture:
┌─────────────┐ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐
│ User │────▶│ LLM Layer │────▶│ MCP Gateway │────▶│ mcp-bitsight │ ← This repo
│ (Cursor) │ │ (AI Foundry) │ │ (Router) │ │ │
└─────────────┘ └──────────────┘ └──────┬───────┘ └──────────────┘
│
├────▶ mcp-servicenow (future)
└────▶ mcp-* (future)| Component | Purpose | Repo |
|---|---|---|
| mcp-bitsight | BitSight API tools | This repo |
| mcp-gateway | Routes to MCP servers | Separate repo (TBD) |
| ai-orchestrator | LLM reasoning layer | Separate repo (TBD) |
| Tool | Description |
|---|---|
get_bitsight_score | Get security rating for any company by name |
search_companies | Search for companies in BitSight |
get_company_details | Get full company details by GUID |
get_security_findings | Get vulnerabilities and security findings |
get_portfolio | View your monitored companies |
get_risk_vectors | List all risk categories |
get_alerts | Get portfolio alerts |
git clone https://github.com/your-org/mcp-bitsight.git
cd mcp-bitsight
# Create virtual environment
python3 -m venv venv
source venv/bin/activate # On Windows: venv\Scripts\activate
# Install dependencies
pip install -e .Create a .env file:
BITSIGHT_API_TOKEN=your-api-key-here
LOG_LEVEL=WARNINGAdd to ~/.cursor/mcp.json (macOS/Linux) or %USERPROFILE%\.cursor\mcp.json (Windows):
{
"mcpServers": {
"bitsight": {
"command": "/full/path/to/mcp-bitsight/venv/bin/python",
"args": ["/full/path/to/mcp-bitsight/main.py"],
"cwd": "/full/path/to/mcp-bitsight"
}
}
}After updating mcp.json, restart Cursor completely (Cmd+Q / Alt+F4, then reopen).
If behind a corporate firewall that intercepts HTTPS, place CA certificates in certs/:
certs/
├── combined_ca_bundle.pem
└── ca_bundle.pemOr set via environment:
MCP_CA_BUNDLE=/path/to/your/ca_bundle.pemPush to dev branch triggers automatic build and deploy via GitHub Actions.
Required GitHub Secrets:
| Secret | Description |
|---|---|
ACR_LOGIN_SERVER | ACR login server |
ACR_USERNAME | Azure Container Registry username |
ACR_PASSWORD | Azure Container Registry password |
AZURE_CLIENT_ID | Service principal client ID |
AZURE_TENANT_ID | Azure AD tenant ID |
AZURE_SUBSCRIPTION_ID | Azure subscription ID |
{
"mcpServers": {
"bitsight": {
"url": "https://your-app.azurecontainerapps.io/sse"
}
}
}mcp-bitsight/
├── app/
│ ├── __init__.py
│ ├── bitsight.py # BitSight API client
│ └── server.py # MCP tools
├── certs/ # SSL certificates
├── Documentation/
├── .github/workflows/ # CI/CD
├── main.py # Entry point
├── pyproject.toml # Dependencies
└── Dockerfile| Variable | Description | Default |
|---|---|---|
BITSIGHT_API_TOKEN | BitSight API key | Required |
MCP_TRANSPORT | stdio or http | stdio |
PORT | HTTP port | 8000 |
LOG_LEVEL | DEBUG, INFO, WARNING, ERROR | WARNING |
MCP_CA_BUNDLE | Custom CA certificate path | Auto-detected |
pip install -e ".[dev]"
pytest
ruff check .
ruff format .MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.