ZeroPath MCP Server

What is ZeroPath MCP Server?

It lets MCP-compatible clients (e.g. Claude Desktop, Cursor) interact with ZeroPath security scan findings by calling ZeroPath's tRPC V2 procedures directly and returning structured JSON responses.

How to use ZeroPath MCP Server?

Install via pip install git+https://github.com/ZeroPathAI/zeropath-mcp-server or use uvx to run without installing. Set environment variables ZEROPATH_TOKEN_ID, ZEROPATH_TOKEN_SECRET, ZEROPATH_ORG_ID and optionally ZEROPATH_BASE_URL. Add the server configuration to your MCP client’s config file using command uvx (GitHub source) or zeropath-mcp-server (PyPI install) with the required env vars.

Key features of ZeroPath MCP Server

• Direct tRPC V2 calls (no REST wrapper)
• Dynamic tool surface loaded from MCP manifest
• Client‑side input validation (best‑effort)
• Structured JSON responses (wrapper removed)
• Supports both queries and mutations

Use cases of ZeroPath MCP Server

• List pending‑review issues filtered by status and score
• Archive multiple issues with a reason
• Create custom detection rules for repositories
• Fetch organization‑wide stats summary

FAQ from ZeroPath MCP Server

What runtime dependencies does ZeroPath MCP Server require?

Python and either pip or uvx (for the no‑install path). The package installs from GitHub or optionally from PyPI.

How do I authenticate with ZeroPath via this server?

Set the environment variables ZEROPATH_TOKEN_ID and ZEROPATH_TOKEN_SECRET (an API key generated from ZeroPath Settings). The server uses these directly for tRPC authentication.

Can I point the server to a different ZeroPath environment?

Yes. Override the ZEROPATH_BASE_URL environment variable to target staging or another environment (defaults to https://zeropath.com).

What transport does the server use?

All tool calls use tRPC V2 over HTTP: queries via GET /trpc/<procedure>, mutations via POST /trpc/<procedure>. The server communicates directly with ZeroPath’s tRPC endpoints.

Does the server validate input before sending to ZeroPath?

It performs best‑effort client‑side validation using each tool’s inputSchema from the manifest. If the schema uses unsupported JSON Schema features, client‑side validation is skipped and server‑side validation remains authoritative.