Fortify ScanCentral SAST Skill

Fortify ScanCentral SAST (SC-SAST) integration via Model Context Protocol (MCP). Enables distributed SAST scanning using ScanCentral sensors with results published to SSC.

Available MCP Tools

Only key MCP tools for ScanCentral SAST are listed here.

Tool	Description	When to Use
`fcli_ssc_action_package`	Package source code for scanning	Before starting a scan - creates scan package
`fcli_sc_sast_scan_start`	Start SAST scan on ScanCentral	After packaging - submits scan to sensor pool
`fcli_sc_sast_scan_status`	Check scan status	Monitor specific scan progress
`fcli_sc_sast_scan_wait_for`	Wait for scan completion	Block until scan reaches desired state
`fcli_sc_sast_scan_list`	List scans	View scan history, find scans by status
`fcli_sc_sast_scan_download`	Download scan artifacts	Retrieve FPR or logs after completion
`fcli_sc_sast_sensor_list`	List available sensors	Check sensor availability
`fcli_sc_sast_sensor_pool_list`	List sensor pools	Verify pool availability for scans

Parameter Formats

Parameter	Format	Example
`scanJobToken`	UUID string (for scan_status)	`"550e8400-e29b-41d4-a716-446655440000"`
`scanJobTokens`	UUID string (for scan_wait_for)	`"550e8400-e29b-41d4-a716-446655440000"`
`appVersionNameOrId`	Application:Version (for appversion_get)	`"MyApp:1.0"`
`--appversion`	Application:Version (for issue_list)	`"MyApp:1.0"`
`--sc-client-version`	Version string or latest	`"latest"` (recommended - auto-matches sensors), `"25.4"`, `"26.1"` (explicit control)
`--sensor-version`	Version string (optional)	Omit for auto-match. Only use for explicit control: `"25.4"`, `"26.1"`
`--publish-to`	Application:Version	`"MyApp:1.0"`, `"WebApp:main"`
`--file`	File path (package file)	`"package.zip"`, `"./scans/app.zip"`
`--sensor-pool`	UUID string	`"550e8400-e29b-41d4-a716-446655440000"`
`--source-dir`	Directory path	`"."`, `"./src"`
`--output`	File path	`"package.zip"`

Authentication

ScanCentral SAST uses SSC authentication with an additional client auth token for sensor communication.

Check session:

Tool: fcli_ssc_session_list

Parameters:

{
  "refresh-cache": true
}

If session expired or missing: Ask user to run locally:

fcli ssc session login --url <SSC-URL> -u <username> -p <password> --sc-sast-url <SC-SAST-URL> --client-auth-token <TOKEN>

Note: The --client-auth-token is a ScanCentral-specific token obtained from SSC Administration → Settings → ScanCentral Client. This token is required for sensor communication.

Filtering

Use client-side filtering with query JSON parameter:

Filter by status:

{
  "query": {"status": "RUNNING"}
}

Filter by application version:

{
  "query": {"publishToApplicationVersion": "MyApp:1.0"}
}

Pagination

Handle large result sets using pagination-offset parameter:

First page:

{
  "pagination-offset": 0
}

Next page:

{
  "pagination-offset": 50
}

Continue with incremented offset until no more results.

Error Recovery

Error	Recovery
"Session expired"	Ask user to run `fcli ssc session login` locally with `--sc-sast-url` and `--client-auth-token`
"No sensors available"	Use `sensor_pool_list` to check pool availability, verify pool UUID
"Version mismatch" / scan won't start	Repackage with `--sc-client-version "latest"` and restart scan (omit `--sensor-version`). For explicit control, use `sensor_list` to find sensor versions and specify matching `--sc-client-version` and `--sensor-version`.
"Application version not found"	Use `fcli_ssc_appversion_get` to verify SSC target exists
"Package file not found"	Verify packaging step completed successfully, check file path
"Scan timeout"	Increase `--timeout` value in `scan_wait_for`, scans can take 30-60 minutes

Decision Tree: Choosing the Right Approach

User Intent	Action
"run SAST scan"	1. Package (`action_package`) → 2. Start scan (`scan_start`) → 3. Wait (`scan_wait_for`) → 4. View issues (`fcli_ssc_issue_list`)
"package source code"	Use `action_package` with `--sc-client-version: "latest"`, `--source-dir`, `--output`
"check scan status"	Use `scan_status` with `scanJobToken` parameter
"list scans"	Use `scan_list` with optional `query` parameter
"list running scans"	Use `scan_list` with `query: {"status": "RUNNING"}`
"monitor scan"	Use `scan_wait_for` with `scanJobTokens` and `--until` parameters
"download scan results"	Use `scan_download` for FPR or view issues via `fcli_ssc_issue_list`
"check sensors"	Use `sensor_list` or `sensor_pool_list`
"view vulnerabilities"	After scan publishes: Use `fcli_ssc_issue_list` with `--appversion` parameter

Best Practices

DO:

✅ Use "latest" for sc-client-version: Preferred approach - automatically installs the most recent client version (e.g., 25.4.0) that matches current sensors
✅ Omit sensor-version parameter: When using modern clients (24.2+), ScanCentral auto-selects the matching sensor version
✅ Optional explicit control: Only use sensor_list to check versions if you need to manually specify both sc-client-version and sensor-version
✅ Validate SSC application version exists before starting scan
✅ Use embed: "scSastScan" in scan_list for detailed scan information
✅ Use query parameter for client-side filtering (e.g., {"status": "RUNNING"})
✅ Set appropriate timeouts on scan_wait_for (scans typically take 15-60 minutes)
✅ Capture scanJobToken from scan_start response for monitoring
✅ Use --publish-to parameter to automatically publish results to SSC
✅ Check sensor pool availability before starting scans

Do NOT:

❌ Assume scans complete quickly - SAST scans can take significant time
❌ Mix scanJobToken and scan-id terminology (use scanJobToken consistently)
❌ Forget --publish-to parameter - results won't appear in SSC without it
❌ Try to retrieve scan results before scan reaches COMPLETED state
❌ Use sc-client-version: "auto" - it uses older hardcoded defaults (e.g., 24.4.0) that may not match current sensors, causing scan failures. Always use "latest" instead.
❌ Specify sensor-version unnecessarily - omit it for auto-matching (recommended for modern clients 24.2+)
❌ Skip authentication verification - sensor operations require valid SSC session

References

Example Workflows

Workflow	Use When User Says...
Run SAST Scan	"run SAST scan", "scan my code", "package and scan", "start scan", "upload for scanning", "SAST analysis"
List and Monitor Scans	"list scans", "scan history", "check scan status", "monitor scan", "scan progress", "running scans"

fortify-scsast