CAST Gatekeeper MCP Server

Overview

The CAST Gatekeeper MCP Server exposes CAST Dashboard's compliance and quality data to AI agents through the Model Context Protocol (MCP). It lets you ask, in natural language, about an application's ISO-5055 / CISQ / OWASP compliance status, technical debt, and code-level violations — and act on them by creating action plans or exclusion requests — without leaving your AI assistant.

Use Cases

• Compliance assessment: Check ISO-5055, CISQ, or OWASP standard compliance for an application, broken down by business criterion.
• Technical debt tracking: Get remediation effort in minutes and 8-hour work days, by criterion, technology, or module.
• Violation triage: Pull code-level violations with file paths, line numbers, and execution paths, filtered by rule, criticality, or status.
• Action plans & exclusions: Create, review, and manage remediation action plans and exclusion requests directly from chat.
• Quality trend analysis: Compare snapshots to see what's improving or regressing over time.

---

Table of Contents

• How to Install
• Verification & Test Queries
• Tools
• Troubleshooting
• Security Notes
• Related CAST MCP Servers
• Support

---

How to Install

This server ships as a Docker image (packages in server.json) — the registry's Install button runs the container on the same machine as your MCP client, so it works two different ways depending on your situation. Pick the one that matches you.

A. You already have a shared instance (most people)

Your admin/ops team most likely already runs this container centrally and registered it with your CAST Dashboard Control Panel. If so, don't use the registry's Install button — it would spin up a second, redundant local container. Instead, connect straight to the existing instance by hand:

What you need: the hostname/port your admin exposed it on, and a CAST Dashboard API key (from your Dashboard user profile).

Create .vscode/mcp.json in your project:

{
  "inputs": [
    {
      "id": "dashboard-key",
      "type": "promptString",
      "description": "CAST Dashboard API Key",
      "password": true
    }
  ],
  "servers": {
    "gatekeeper": {
      "type": "http",
      "url": "http://<your-mcp-server-host>:<port>/mcp/gatekeeper",
      "headers": {
        "x-api-key": "${input:dashboard-key}"
      }
    }
  }
}

Replace <your-mcp-server-host> and <port> with the address your admin gave you (commonly the Dashboard host on port 8090). For HTTPS, use https:// instead.

B. You're running your own instance (self-hosted / evaluation)

If nobody has deployed this yet, or you want a private instance of your own, use the registry's Install button — it runs the Docker container locally for you.

What you need first:

• Docker installed and running on this machine (the Install flow executes docker run here)
• GitHub Copilot in VS Code (or another MCP-aware client, e.g. Claude Desktop)
• The hostname/IP and port of your CAST Dashboard Control Panel, and a Dashboard API key

1. Install the connector from the GitHub MCP Registry.

• Go to github.com/mcp and search for CAST Gatekeeper MCP Server.
• Click Install in VS Code. VS Code pulls the image and runs it locally.

2. Enter your connection details. VS Code will ask for these — they configure the container so it can reach your Dashboard backend, they are not the container's own address:

It asks for	You enter
Host Control Panel	The hostname/IP of your CAST Dashboard Control Panel
Port Control Panel	The Control Panel port (commonly 8098)
MCP Server Port	The local port to expose the container on (default 8283)
API key	Your CAST Dashboard API key

Once running, your client connects at http://localhost:<MCP Server Port>/mcp — the container it just started, not the Control Panel address above.

3. Try it. Open Copilot Chat and ask: "List all applications". If you get a real answer back, you're connected.

---

Verification & Test Queries

Connectivity checks

# Dashboard REST API health (run from wherever the MCP server itself is hosted)
curl -H "x-api-key: <your-key>" http://{CONTROL_PANEL_HOST}:8090/rest

Try in Copilot/Claude

List all applications
Get compliance status for <YourApp>
Get technical debt for <YourApp> broken down by criterion
Get critical violations for <YourApp>

---

Tools

Tool	Description
list_applications	List every application the authenticated user can access.
get_compliance_status	Compliance status by business criterion, with quality-indicator and standard filtering (ISO-5055, CISQ, OWASP). Supports multi-snapshot comparison.
get_technical_debt	Remediation effort (minutes / 8-hour days), broken down by criterion, technology, or module.
get_violations	Paginated, code-level violations — file paths, line numbers, execution paths — filterable by rule pattern, criticality, status, or technology.
get_objects	Objects in an application snapshot, filterable by business criterion, standard, name, path, or type.
manage_action_plan	Get, add, edit, or delete action-plan issues (requires QUALITY_MANAGER role for writes).
manage_exclusion	Get, add, edit, or delete exclusion requests (requires EXCLUSION_MANAGER role for writes).
get_mcp_info	Report this server's version and its compatibility with the connected CAST Imaging API.

---

Troubleshooting

Symptom	Likely Cause	What to do
ECONNREFUSED from client	The instance isn't running, or the host/port is wrong	Double-check the address with whoever manages your CAST Dashboard deployment
Auth errors	Wrong/expired Dashboard API key	Regenerate the key from your Dashboard profile
Empty application list	API key's user has no application permissions	Confirm access in Dashboard
Client stuck waiting / never connects	Wrong client config type	Make sure your MCP client entry uses type: "http" with a url, not a command/stdio launcher
VS Code not prompting for key	Missing inputs in mcp.json	Add the inputs block (see How to Install → option A)

Checks

# Dashboard REST API health (run from wherever the MCP server itself is hosted)
curl -H "x-api-key: <your-key>" http://{CONTROL_PANEL_HOST}:8090/rest

---

Security Notes

• Principle of least privilege: limit who can obtain/enter Dashboard API keys in MCP hosts.
• SSL_CA_BUNDLE for private CAs: prefer a CA bundle over disabling TLS verification.
• Write operations are role-gated: manage_action_plan and manage_exclusion require QUALITY_MANAGER/EXCLUSION_MANAGER roles in Dashboard — a read-only API key simply can't perform them.

---

Related CAST MCP Servers

For architectural analysis — dependency graphs, transactions, impact analysis, and code exploration — pair this server with the CAST Imaging MCP Server. Install it the same way: search github.com/mcp for CAST Imaging MCP Server, or install its companion VS Code extension, which manages the Imaging MCP server's Docker container and generates the matching .vscode/mcp.json for you.

The two servers are compatibility-checked against each other: this server's get_mcp_info tool reports the minimum CAST Imaging API version it expects, so an agent can confirm both are in sync before combining compliance data with architectural context.

---

Support

• Check your mcp.json values and the Dashboard REST API health endpoint.
• If the instance itself seems down, contact whoever manages your CAST Dashboard deployment — container-level logs and configuration are on their side, not the connecting client's.
• Ensure network reachability between client ↔ server ↔ Dashboard REST API.

---

License

This repository contains documentation only. The project's source code is proprietary and is not published under an open-source license.

• The source code is licensed separately under a commercial license and is not included in this repository.
• No rights are granted to the source code through this repository.
• You may view and share this documentation freely, but it may not be used to infer or imply rights to the proprietary software.

For commercial licensing inquiries, please contact your local CAST representative (https://www.castsoftware.com/overview).