Skarn integrations.

The MCP server

skarn mcp starts a stdio Model Context Protocol server on the Skarn binary you already installed. Your client spawns it as a child process and talks to it over the pipe. It needs no account and no license, it opens no socket, and every tool it exposes only reads.

Availability: Skarn 0.25.0.

Tools in the default set

You can filter by project, but no tool hands the model a project name, a branch or a model id back. Those labels are written inside the transcript, so treating them as data the model reads would put attacker-authored text into the conversation; the tools return structure and counts instead.

Every tool in the table declares itself read-only, non-destructive, and closed-world, so a client that reads those annotations can tell you what a call will do before it runs. Those annotations are the server's own declaration rather than an enforcement mechanism; what stands behind them is that the default set contains no tool that writes and that the scan makes no network call.

Content search, off by default

skarn mcp --enable-recall adds two more tools, search_sessions and get_session. Both pass every session they return through the same redaction mask skarn export uses. search_sessions requires an explicit project or hours scope, so there is no unbounded call; get_session takes one session id, which is its scope. Their tool descriptions say what that means: content that comes back leaves for your model provider, like everything else in the conversation. That is why the flag is off and the default set carries no content-bearing tool.

A tool result pasted back into a session does not re-trigger a finding. The values Skarn hands the model are already masked, and a masked value is not what the detector matches on the next scan.

Add it to your client

Install the binary first, because every declaration below calls skarn on your PATH: brew install skarn-security/tap/skarn, npm install -g @skarn-security/skarn, or a release binary. Install covers every platform. Then paste the block for your client into the file named above it.

claude mcp add, or .mcp.json at your project root

.mcp.json

The command writes to your own configuration; the file is what you commit for the whole team, and Claude Code asks each person to approve it the first time.

~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows)

Settings, Developer, Edit Config opens this file. Quit Claude Desktop and start it again for the server to load.

~/.cursor/mcp.json

A project-scoped copy at .cursor/mcp.json in a repository works the same way.

codex mcp add, or ~/.codex/config.toml

~/.codex/config.toml

Codex starts the server on demand and gives it ten seconds to come up, which the local binary does not need.

.vscode/mcp.json

Or add it from a terminal

The Copilot CLI reads ~/.copilot/mcp-config.json instead, in the same mcpServers shape the blocks above use.

~/.gemini/settings.json

~/.gemini/config/mcp_config.json

A workspace copy at .agents/mcp_config.json applies to that workspace only.

grok mcp add, or ~/.grok/config.toml

~/.grok/config.toml

~/.codeium/windsurf/mcp_config.json

Settings, Tools, AI Assistant, Model Context Protocol (MCP), then paste

settings.json

Without installing the binary

You can run the server straight from npm instead: npx -y @skarn-security/skarn@0.33.0 mcp. Pin the version, as that line does. Written as a client declaration it looks like this.

npx fetches the package the first time and caches it, so this form makes a network call the installed binary never makes, and it starts more slowly. The scan itself still makes none.

Each declaration above produces zero findings under skarn vet: the launcher is a bare command on your PATH or a version-pinned package, never an unpinned one that resolves to whatever is newest at the moment your agent starts.

Plugins and hooks per host

A plugin carries configuration, never the binary, so install Skarn first and the hooks call skarn guard on your PATH. Installing a newer Skarn then changes the detection engine without touching the plugin.

New to the guard? The install page walks through skarn setup and skarn doctor first.

The hooks ship in audit mode, which reports the verdict they would have reached and never changes what your agent does. Codex asks you to trust the hooks the first time you start it after installing; until you do, they do not run.

Where a row says pending, the Install column is the route to use until the entry goes live; where a row says listed, the Listing link is the directory entry itself. A host with no directory installs from the repository. The MCP Registry publishes no human-readable page, so its row carries no link.

Three things to ask your agent

With --enable-recall there is a fourth: "Search this week's sessions in project X for the migration decision we made." That one reads your own text, masks it on the way out, and sends what it finds to your model provider.

Support and disclosure

hello@getskarn.com for questions about an integration or a marketplace listing. For a vulnerability, write to security@getskarn.com and read the disclosure policy first. The manual is the full command-line reference, and Privacy and Terms cover the rest.

Common questions

Does the MCP server send anything off my machine?

No. skarn mcp runs as a local process your client starts over stdio; it opens no socket and the scan makes no network call. What does leave is whatever the model reads, exactly as with any other tool: that is why every default tool returns redacted findings or metadata rather than your session text.

Does it need a license?

No. skarn mcp and skarn assess need no account and no license. skarn check, the repeatable scan you put in CI, needs a free license issued at getskarn.com/free after a one-time email confirmation and verified offline.

Why is content search off by default?

Because the default tools return findings and metadata, while a content search returns your own text. --enable-recall turns it on and masks every session it returns. search_sessions refuses a call that names no project and no time window; get_session takes one session id, which is the scope it is given.

Why bare skarn rather than npx?

Because an unpinned npx launcher resolves its package when your agent starts it, and Skarn's own skarn vet flags exactly that in a configuration as vet-mcp-unpinned. A bare command on your PATH is the version you installed and checked. The version-pinned npx form is fine and is shown above.