# Offense MCP server

> Provides security auditing tools for coding agents to discover vulnerabilities, inspect source code, and verify dependency fixes.

- Repository: https://github.com/offense-research/offense
- Page: https://hostedmcp.org/servers/offense-research/offense
- Transport: remote
- Stars: 70
- License: Apache-2.0
- Latest version: 0.7.0

## Install

### Claude Code

```sh
claude mcp add --transport http offense https://offense.sh/mcp
```

### Cursor (`~/.cursor/mcp.json`)

```json
{
  "mcpServers": {
    "offense": {
      "url": "https://offense.sh/mcp"
    }
  }
}
```

### VS Code (`.vscode/mcp.json`)

```json
{
  "servers": {
    "offense": {
      "type": "http",
      "url": "https://offense.sh/mcp"
    }
  }
}
```

### Codex (`~/.codex/config.toml`)

```toml
[mcp_servers.offense]
url = "https://offense.sh/mcp"
```

### Gemini CLI (`~/.gemini/settings.json`)

```json
{
  "mcpServers": {
    "offense": {
      "httpUrl": "https://offense.sh/mcp"
    }
  }
}
```

## Environment variables

| Name | Required | Secret | Description |
|---|---|---|---|
| `OFFENSE_SELF_HOSTED` | no | no |  |
| `SCAN_BILLING_ENABLED` | no | no |  |
| `WHOP_BILLING_ENABLED` | no | no |  |

## FAQ

### What can Offense do for my coding agent?

It allows agents to audit dependencies, inspect source code and workflows, and test proposed security fixes using structured evidence.

### How does Offense handle GitHub repository integration?

You can add Offense to your repository via a pull request that adds free npm/pnpm dependency audits using pinned, read-only GitHub Actions.

### Can Offense run in an isolated environment?

Yes, the self-hosted platform can run source scanners like Opengrep and Zizmor through an MCP profile in isolated Docker containers.