Endor Labs helps developers fix code at its origin phase and during the early stages of development. You can successfully perform early security reviews and mitigate the need for expensive fixes during later stages of development. It accelerates the process of creating, delivering, and shipping secure applications.
Endor Labs Visual Studio Code extension: Endor Labs provides a plug-in for Visual Studio Code that developers can install from Visual Studio’s marketplace and get started with early vulnerability and dependency scanning.
Endor Labs MCP server: Endor Labs MCP (Model Context Protocol) server enables secure deployment of Endor Labs capabilities within your IDE. You can run the Endor Labs MCP server in your IDE during the development process to ensure that your code is free from vulnerabilities.
Endor Labs Visual Studio Code extension
The Endor Labs extension for Visual Studio Code scans your repositories and highlights issues that may exist in the open-source dependencies. You can use the extension with Endor Labs API credentials.
Prerequisites
The following prerequisites must be fulfilled to use the Endor Labs VS Code extension:
The minimum supported version of Visual Studio Code is 1.71 and higher.
See the following table for supported languages, package managers, and file extensions. The extension reads the manifest files to fetch the list of dependencies and displays the results in both manifest and source code files.
Supported Language
Manifest file
Source code file
JavaScript
package.json
.js, .ts, .jsx, .tsx, .mjs, .cjs extensions
Python
requirements.txt
.py extension
Go
go.mod
.go extension
Generate Endor Labs API keys and have them handy. You must enter these details in the VS Code extension. See Managing API Keys for details.
Install the Endor Labs extension
Developers can install the extension from the Visual Studio marketplace and configure it with Endor Labs API keys.
Select the Endor Labs extension, click Settings, and choose Extension Settings.
Enter the API Key and API Secret of the Endor Labs application.
View scan results
The Endor Labs Visual Studio extension reads all the manifest files in your project and fetches the list of dependencies.
Hover over a dependency to view the package version, released date, findings, and Endor Labs scores in a pop-up.
For effective prioritization, issues with dependencies are classified into four severity levels: Critical, High, Medium, and Low.
Click a specific version to view the same results in the Endor Labs user interface.
The dependencies are color-coded in the following ways:
Red underline - Has critical findings and is also on an outdated version
Orange underline - Has critical findings and is on the latest version
Yellow underline - Has no critical findings but is an outdated version
No Underline - Has no critical findings and is on the latest version
Use Update to latest version to update the package to its latest version.
Note
The manifest file is updated with the latest version; however, the package is not automatically upgraded.
Endor Labs MCP server
Beta
MCP (Model Context Protocol) is an open standard that defines a consistent way for applications to share relevant context and information with Large Language Models (LLMs). MCP servers expose specific capabilities through the standardized Model Context Protocol. For more information on MCP, refer to the MCP documentation.
The Endor Labs MCP server integrates seamlessly into your development workflow, scanning your code as you write. You can catch issues long before they’re a problem in production. It plugs directly into your IDE, tightening the feedback loop for both human and AI-generated code. Thus, you can quickly secure your code from the start. With Endor Labs, you’re bringing security all the way left, getting real-time, proactive insights and automated fixes in your editor, while you build, minimizing last-minute security scrambles.
Note
Endor Labs MCP server is available on macOS. Endor Labs MCP server is not currently tested or fully supported on Windows workstations.
Tools in the Endor Labs MCP server
The Endor Labs MCP server provides the following tools:
check_dependency_for_vulnerabilities: Check if the dependencies in your project are vulnerable.
get_endor_vulnerability: Get the details of a specific vulnerability from the Endor Labs vulnerability database.
get_resource: Add additional context from commonly used Endor Labs resources about your software such as findings, vulnerabilities, and projects.
scan: Run an Endor Labs security scan to detect risks in your open source dependencies, find common security issues, and spot any credentials accidentally exposed in your Git repository.
After you set up the MCP server, you can choose to disable the tools that you do not want to use.
Prerequisites to run the Endor Labs MCP server
Before running the Endor Labs MCP server, ensure that you install the latest version of endorctl and authenticate to Endor Labs. The authenticated user must have at least Code Scanner and Read-Only permissions.
If you wish to run SAST scans, ensure that you install Semgrep in your local system. See Download and install Semgrep to learn how you can download and install the specific version of Semgrep that is compatible with Endor Labs.
Configure the MCP server in Cursor
We recommend that you add the MCP server to the local Cursor settings rather than the user settings to keep the configuration project-specific.
You can configure the MCP server either through the interactive configuration tool or manually.
Interactive MCP server configuration
Use our interactive configuration tool to generate a one-click installation link for Cursor. You can configure all the necessary parameters and generate a Cursor link that you can click to automatically install the MCP server.
Endor Labs MCP Server Installation
Configure your MCP server parameters and generate a one-click install link for Cursor.
One-click MCP server installation
Click the following button to install the Endor Labs MCP server in Cursor
After you click Add Endor Labs MCP server, MCP Settings opens in Cursor.
You can verify the configuration and click Install to complete the installation.
Manual MCP server configuration
Navigate to the root of your repository.
Create a .cursor directory if it doesn’t exist and create an mcp.json file in the .cursor directory.
mkdir -p .cursor && touch .cursor/mcp.json
Add the following configuration to the .cursor/mcp.json file.
{"mcpServers":{"endor-cli-tools":{"type":"stdio","command":"endorctl","args":["ai-tools","mcp-server"],"env":{"MCP_ENDOR_SCAN_LANGUAGES":"<languages to scan>"}}}}
The following parameters are commonly used to optimize MCP server performance.
command: The full path to the endorctl executable. Run which endorctl to fetch the path of the endorctl executable.
MCP_ENDOR_SCAN_LANGUAGES: The programming languages to scan. You can use the following languages: c#, go, java, javascript, kotlin, objective-c, php, python, ruby, rust, scala, swift, typescript. Enter multiple languages separated by commas. For example, "go,java,python".
Note
You can use any Endor Labs environment variable for the endorctl scan command in the MCP server configuration. However, you must prefix all Endor Labs environment variables with MCP_. See Endor Labs environment variables for more information.
Manage Endor Labs MCP server tools in Cursor
Navigate to the Settings > Cursor Settings > MCP.
Click the tool that you want to disable under endor-mcp-tools.
Click on a disabled tool to enable it.
Configure Cursor rules
To enhance the MCP server integration you can add custom rules for your project. These rules are custom prompts specific to your project.
Navigate to the root of your repository.
In the .cursor/rules directory, create an .mdc file to add specific instructions.
Add appropriate rules for your project in the .cursor/endorlabs.mdc file. For example, you can add a rule to check if the code is free from vulnerabilities.
Example Cursor rules
You can use the following Cursor rules as a quick start for the Endor Labs MCP server. Modify the rules to meet your specific organization’s needs. We recommended that you store each cursor rule in a separate file. For more information, refer to the Cursor documentation.
---description:Ensure newly added dependencies are checked for vulnerabilities and project stays cleanglobs:'**/package.json, **/package-lock.json, **/yarn.lock, **/pnpm-lock.yaml, **/requirements.txt, **/Pipfile, **/Pipfile.lock, **/pyproject.toml, **/poetry.lock, **/go.mod, **/go.sum, **/Cargo.toml, **/Cargo.lock, **/pom.xml, **/build.gradle, **/build.gradle.kts, **/gradle.lockfile, **/composer.json, **/composer.lock'alwaysApply:true---# Software Composition Analysis (SCA) Rule (Endor Labs via MCP)This project uses Endor Labs for automated dependency (SCA) scanning, integrated through the MCP server as configured in `.cursor/mcp.json`.## WorkflowEvery time a manifest or lockfile listed above is created or modified in any way immediantly do the following prior to performing your next task.**Important**:Do not procceed after creating or modifying a manifest file without running this first. Do not write any other code or continue with your existing prompt. This is top priority whenever a manifest file is created or updated.- Run `endor-cli-tools` using the `check_dependency_for_vulnerabilities` tool via the MCP server.- Provide the **language**, **dependency name**, and **version** always when making this tool call. Do not forget to provide a version.- If a vulnerability or error is identified:- Upgrade to the suggested safe version, or- Replace the dependency with a non-vulnerable alternative.- The AI agent must attempt to automatically correct all detected errors and vulnerabilities before session completion.- Re-run the check using `endor-cli-tools` to confirm the issue is resolved.- If an error occurs in any MCP server tool call (such as missing required parameters like version, invalid arguments, or tool invocation failures):- The AI agent must review the error, determine the cause, and automatically correct the tool call or input parameters.- Re-attempt the tool call with the corrected parameters.- Continue this process until the tool call succeeds or it is determined that remediation is not possible, in which case the issue and reason must be reported.## Notes- All scans must be performed using the MCP server integration (`endor-cli-tools`) as configured in `.cursor/mcp.json`. Do not invoke `endorctl` directly.- For troubleshooting, ensure the MCP server is running and `endorctl` is installed and accessible in your environment.This rule ensures that all dependency changes are evaluated for risk at the time of introduction, and that the project remains clean and secure after each coding session. The scan may be performed at the end of an agent session, provided all modifications are checked and remediated before session completion.
---description:Scan for leaked secrets on file modificationglobs:'**/*'alwaysApply:true---# Leaked Secrets Detection Rule (Endor Labs via MCP)This project uses @Endor Labs for automated security scanning, integrated through the MCP server as configured in `.cursor/mcp.json`.## WorkflowWhenever a file is modified in the repository, and before the end of an agent session:- Run `endor-cli-tools` using the `scan` tool via the MCP server to check for leaked secrets.- Ensure the scan includes all file types and respects `.gitignore` unless otherwise configured.- If any secrets or errors are detected:- Remove the exposed secret or correct the error immediately.- The AI agent must attempt to automatically correct all detected secrets and errors before session completion.- Re-run the scan to verify the secret or error has been properly removed or resolved.- If an error occurs in any MCP server tool call (such as missing required parameters like version, invalid arguments, or tool invocation failures):- The AI agent must review the error, determine the cause, and automatically correct the tool call or input parameters.- Re-attempt the tool call with the corrected parameters.- Continue this process until the tool call succeeds or it is determined that remediation is not possible, in which case the issue and reason must be reported.- Save scan results and remediation steps in a security log or as comments for audit purposes.## Notes- All scans must be performed using the MCP server integration (`endor-cli-tools`) as configured in `.cursor/mcp.json`. Do not invoke `endorctl` directly.- For troubleshooting, ensure the MCP server is running and `endorctl` is installed and accessible in your environment.- **Important**:This scan must use the path of the directory from which the changed files are in. Do not attempt to set the path directly to a file as it must be a directory. Use absolute paths like /Users/username/mcp-server-demo/backend rather than relative paths like 'backend'This rule ensures no accidental credentials, tokens, API keys, or secrets are committed or remain in the project history. The scan may be performed at the end of an agent session, provided all modifications are checked and remediated before session completion.
---description:Run SAST scan using endor-cli-tools on source code changesglobs:'**/*.c, **/*.cpp, **/*.cc, **/*.cs, **/*.go, **/*.java, **/*.js, **/*.jsx, **/*.ts, **/*.tsx, **/*.py, **/*.php, **/*.rb, **/*.rs, **/*.kt, **/*.kts, **/*.scala, **/*.swift, **/*.dart, **/*.html, **/*.yaml, **/*.yml, **/*.json, **/*.xml, **/*.sh, **/*.bash, **/*.clj, **/*.cljs, **/*.ex, **/*.exs, **/*.lua'alwaysApply:true---# Static Application Security Testing (SAST) Rule (Endor Labs via MCP)This project uses Endor Labs for automated SAST, integrated through the MCP server as configured in `.cursor/mcp.json`.## WorkflowWhenever a file is modified in the repository, and before the end of an agent session perform the following workflow:- Ensure Semgrep is installed and available at version 1.99.0.- If Semgrep is not installed or the version is incorrect, prompt the user to install it.- Do not proceed with the scan unless Semgrep is available and valid.- To install Semgrep, the user must have a working Python environment with pip. Recommend installing version 1.99.0.- Run `endor-cli-tools` using the `scan` tool via the MCP server to perform SAST scans as described above.- If any vulnerabilities or errors are found:- Present the issues to the user.- The AI agent must attempt to automatically correct all errors and vulnerabilities, including code errors, security issues, and best practice violations, before session completion.- Recommend and apply appropriate fixes (e.g., input sanitization, validation, escaping, secure APIs).- Continue scanning and correcting until all critical issues have been resolved or no further automated remediation is possible.- If an error occurs in any MCP server tool call (such as missing required parameters like version, invalid arguments, or tool invocation failures):- The AI agent must review the error, determine the cause, and automatically correct the tool call or input parameters.- Re-attempt the tool call with the corrected parameters.- Continue this process until the tool call succeeds or it is determined that remediation is not possible, in which case the issue and reason must be reported.- Save scan results and remediation steps in a security log or as comments for audit purposes.## Notes- All scans must be performed using the MCP server integration (`endor-cli-tools`) as configured in `.cursor/mcp.json`. Do not invoke `endorctl` directly.- For troubleshooting, ensure the MCP server is running and `endorctl` is installed and accessible in your environment.- Do not invoke semgrep directly.- **Important**:This scan must use the path of the directory from which the changed files are in. Do not attempt to set the path directly to a file as it must be a directory. Use absolute paths like /Users/username/mcp-server-demo/backend rather than relative paths like 'backend'This rule ensures all code changes are automatically reviewed and remediated for common security vulnerabilities and errors using `endor-cli-tools` and the MCP server, with Semgrep as the underlying engine.
Configure the MCP server in Visual Studio Code
We recommend that you add the MCP server to the local Visual Studio Code settings rather than the user settings to keep the configuration project-specific.
Prerequisites for Visual Studio Code
Before running the Endor Labs MCP server, ensure that you have Visual Studio Code version 1.99 or later and enable MCP support by setting chat.mcp.enabled to true in your Visual Studio Code settings.
Add the Endor Labs MCP server to local Visual Studio Code settings.
Navigate to the root of your repository.
Create a .vscode directory if it doesn’t exist and create an mcp.json file in the .vscode directory.
You can use the interactive configuration tool to generate the MCP server configuration for Visual Studio Code.
Endor Labs MCP Server Installation
Configure your MCP server parameters and generate a json configuration for Visual Studio Code.
MCP server configuration for .vscode/mcp.json
Copy this configuration to your .vscode/mcp.json file:
You can also manually add the following configuration to the .vscode/mcp.json file.
{"servers":{"endor-cli-tools":{"type":"stdio","command":"endorctl","args":["ai-tools","mcp-server"],"env":{"MCP_ENDOR_SCAN_LANGUAGES":"<languages to scan>"}}}}
The following parameters are commonly used to optimize MCP server performance.
command: The full path to the endorctl executable. Run which endorctl to fetch the path of the endorctl executable.
MCP_ENDOR_SCAN_LANGUAGES: The programming languages to scan. You can use the following languages: c#, go, java, javascript, kotlin, objective-c, php, python, ruby, rust, scala, swift, typescript. Enter multiple languages separated by commas. For example, "go,java,python".
Note
You can use any Endor Labs environment variable for the endorctl scan command in the MCP server configuration. However, you must prefix all Endor Labs environment variables with MCP_. See Endor Labs environment variables for more information.
Copy the configuration to your .vscode/mcp.json file and restart Visual Studio Code to complete the installation.
Manage Endor Labs MCP server tools in Visual Studio Code
Open the Chat view by pressing Cmd+Option+I.
Switch to the Agent mode.
Click the Settings icon.
Select the tools that you want to enable or disable under MCP Server: endor-cli-tools.
Use the MCP server with GitHub Copilot
To use the Endor Labs MCP server with GitHub Copilot in Visual Studio Code:
Open the Chat view by pressing Cmd+Option+I.
Switch to the Agent mode.
Click the Settings icon.
Select MCP Server: endor-cli-tools from the dropdown menu.
You can now use Endor Labs tools in your chat prompts to scan for vulnerabilities.
Set up Copilot rules
Set up Copilot rules in, .github/instructions/*.md, to use the Endor Labs MCP server throughout the development process.
Example Copilot rules
Copilot instructions will add instructions for copilot to follow throughout the development process. The following examples show how to use the Endor Labs MCP server in Copilot rules.
---description:"Dependency vulnerability scanning using Endor Labs via MCP server integration"applyTo:'**/package.json, **/package-lock.json, **/yarn.lock, **/pnpm-lock.yaml, **/requirements.txt, **/Pipfile, **/Pipfile.lock, **/pyproject.toml, **/poetry.lock, **/go.mod, **/go.sum, **/Cargo.toml, **/Cargo.lock, **/pom.xml, **/build.gradle, **/build.gradle.kts, **/gradle.lockfile, **/composer.json, **/composer.lock'---# Software Composition Analysis (SCA) Rule (Endor Labs via MCP)This project uses Endor Labs for automated dependency (SCA) scanning, integrated through the MCP server as configured in `.vscode/mcp.json`.## WorkflowEvery time a manifest or lockfile listed above is created or modified in any way immediantly do the following prior to performing your next task.**Important**:Do not procceed after creating or modifying a manifest file without running this first. Do not write any other code or continue with your existing prompt. This is top priority whenever a manifest file is created or updated.- Run `endor-cli-tools` using the `check_dependency_for_vulnerabilities` tool via the MCP server.- Provide the **language**, **dependency name**, and **version** always when making this tool call. Do not forget to provide a version.- If a vulnerability or error is identified:- Upgrade to the suggested safe version, or- Replace the dependency with a non-vulnerable alternative.- The AI agent must attempt to automatically correct all detected errors and vulnerabilities before session completion.- Re-run the check using `endor-cli-tools` to confirm the issue is resolved.- If an error occurs in any MCP server tool call (such as missing required parameters like version, invalid arguments, or tool invocation failures):- The AI agent must review the error, determine the cause, and automatically correct the tool call or input parameters.- Re-attempt the tool call with the corrected parameters.- Continue this process until the tool call succeeds or it is determined that remediation is not possible, in which case the issue and reason must be reported.## Notes- All scans must be performed using the MCP server integration (`endor-cli-tools`) as configured in `.vscode/mcp.json`. Do not invoke `endorctl` directly.- For troubleshooting, ensure the MCP server is running and `endorctl` is installed and accessible in your environment.This rule ensures that all dependency changes are evaluated for risk at the time of introduction, and that the project remains clean and secure after each coding session. The scan may be performed at the end of an agent session, provided all modifications are checked and remediated before session completion.
---description:"Scan for leaked secrets on file modification using Endor Labs via MCP server integration"applyTo:'**/*'---# Leaked Secrets Detection Rule (Endor Labs via MCP)This project uses [Endor Labs](https://docs.endorlabs.com/) for automated security scanning, integrated through the MCP server as configured in `.vscode/mcp.json`.## WorkflowWhenever a file is modified in the repository, and before the end of an agent session:- Run `endor-cli-tools` using the `scan` tool via the MCP server to check for leaked secrets.- Ensure the scan includes all file types and respects `.gitignore` unless otherwise configured.- If any secrets or errors are detected:- Remove the exposed secret or correct the error immediately.- The AI agent must attempt to automatically correct all detected secrets and errors before session completion.- Re-run the scan to verify the secret or error has been properly removed or resolved.- If an error occurs in any MCP server tool call (such as missing required parameters like version, invalid arguments, or tool invocation failures):- The AI agent must review the error, determine the cause, and automatically correct the tool call or input parameters.- Re-attempt the tool call with the corrected parameters.- Continue this process until the tool call succeeds or it is determined that remediation is not possible, in which case the issue and reason must be reported.- Save scan results and remediation steps in a security log or as comments for audit purposes.## Notes- All scans must be performed using the MCP server integration (`endor-cli-tools`) as configured in `.vscode/mcp.json`. Do not invoke `endorctl` directly.- For troubleshooting, ensure the MCP server is running and `endorctl` is installed and accessible in your environment.- **Important**:This scan must use the path of the directory from which the changed files are in. Do not attempt to set the path directly to a file as it must be a directory. Use absolute paths like /Users/username/mcp-server-demo/backend rather than relative paths like 'backend'This rule ensures no accidental credentials, tokens, API keys, or secrets are committed or remain in the project history. The scan may be performed at the end of an agent session, provided all modifications are checked and remediated before session completion.
---description:"Static Application Security Testing (SAST) using Endor Labs via MCP server integration"applyTo:'**/*.c, **/*.cpp, **/*.cc, **/*.cs, **/*.go, **/*.java, **/*.js, **/*.jsx, **/*.ts, **/*.tsx, **/*.py, **/*.php, **/*.rb, **/*.rs, **/*.kt, **/*.kts, **/*.scala, **/*.swift, **/*.dart, **/*.html, **/*.yaml, **/*.yml, **/*.json, **/*.xml, **/*.sh, **/*.bash, **/*.clj, **/*.cljs, **/*.ex, **/*.exs, **/*.lua'---# Static Application Security Testing (SAST) Rule (Endor Labs via MCP)This project uses [Endor Labs](https://docs.endorlabs.com/) for automated SAST, integrated through the MCP server as configured in `.vscode/mcp.json`.## WorkflowWhenever a file is modified in the repository, and before the end of an agent session perform the following workflow:- Ensure Semgrep is installed and available at version 1.99.0.- If Semgrep is not installed or the version is incorrect, prompt the user to install it.- Do not proceed with the scan unless Semgrep is available and valid.- To install Semgrep, the user must have a working Python environment with pip. Recommend installing version 1.99.0.- Do not attempt to scan with semgrep directly.- Run `endor-cli-tools` using the `scan` tool via the MCP server to perform SAST scans as described above.- If any vulnerabilities or errors are found:- Present the issues to the user.- The AI agent must attempt to automatically correct all errors and vulnerabilities, including code errors, security issues, and best practice violations, before session completion.- Recommend and apply appropriate fixes (e.g., input sanitization, validation, escaping, secure APIs).- Continue scanning and correcting until all critical issues have been resolved or no further automated remediation is possible.- If an error occurs in any MCP server tool call (such as missing required parameters like version, invalid arguments, or tool invocation failures):- The AI agent must review the error, determine the cause, and automatically correct the tool call or input parameters.- Re-attempt the tool call with the corrected parameters.- Continue this process until the tool call succeeds or it is determined that remediation is not possible, in which case the issue and reason must be reported.- Save scan results and remediation steps in a security log or as comments for audit purposes.## Notes- All scans must be performed using the MCP server integration (`endor-cli-tools`) as configured in `.vscode/mcp.json`. Do not invoke `endorctl` directly.- For troubleshooting, ensure the MCP server is running and `endorctl` is installed and accessible in your environment.- Do not invoke semgrep directly.- **Important**:This scan must use the path of the directory from which the changed files are in. Do not attempt to set the path directly to a file as it must be a directory. Use absolute paths like /Users/username/mcp-server-demo/backend rather than relative paths like 'backend'This rule ensures all code changes are automatically reviewed and remediated for common security vulnerabilities and errors using `endor-cli-tools` and the MCP server, with Semgrep as the underlying engine.