Fortify ScanCentral SAST Skill

Fortify ScanCentral SAST (SC-SAST) integration via Model Context Protocol (MCP). Enables distributed SAST scanning using ScanCentral sensors with results published to SSC.

Available MCP Tools

Only key MCP tools for ScanCentral SAST are listed here.

Tool	Description	When to Use
fcli_ssc_action_package	Package source code for scanning	Before starting a scan - creates scan package
fcli_sc_sast_scan_start	Start SAST scan on ScanCentral	After packaging - submits scan to sensor pool
fcli_sc_sast_scan_status	Check scan status	Monitor specific scan progress
fcli_sc_sast_scan_wait_for	Wait for scan completion	Block until scan reaches desired state
fcli_sc_sast_scan_list	List scans	View scan history, find scans by status
fcli_sc_sast_scan_download	Download scan artifacts	Retrieve FPR or logs after completion
fcli_sc_sast_sensor_list	List available sensors	Check sensor availability
fcli_sc_sast_sensor_pool_list	List sensor pools	Verify pool availability for scans

Parameter Formats

Parameter	Format	Example
scanJobToken	UUID string (for scan_status)	"550e8400-e29b-41d4-a716-446655440000"
scanJobTokens	UUID string (for scan_wait_for)	"550e8400-e29b-41d4-a716-446655440000"
appVersionNameOrId	Application:Version (for appversion_get)	"MyApp:1.0"
--appversion	Application:Version (for issue_list)	"MyApp:1.0"
--sc-client-version	Version string or latest	"latest" (recommended - auto-matches sensors), "25.4", "26.1" (explicit control)
--sensor-version	Version string (optional)	Omit for auto-match. Only use for explicit control: "25.4", "26.1"
--publish-to	Application:Version	"MyApp:1.0", "WebApp:main"
--file	File path (package file)	"package.zip", "./scans/app.zip"
--sensor-pool	UUID string	"550e8400-e29b-41d4-a716-446655440000"
--source-dir	Directory path	".", "./src"
--output	File path	"package.zip"

Authentication

ScanCentral SAST uses SSC authentication with an additional client auth token for sensor communication.

Check session:

Tool: fcli_ssc_session_list

Parameters:

{
  "refresh-cache": true
}

If session expired or missing: Ask user to run locally:

fcli ssc session login --url <SSC-URL> -u <username> -p <password> --sc-sast-url <SC-SAST-URL> --client-auth-token <TOKEN>

Note: The --client-auth-token is a ScanCentral-specific token obtained from SSC Administration → Settings → ScanCentral Client. This token is required for sensor communication.

Filtering

Use client-side filtering with query JSON parameter:

Filter by status:

{
  "query": {"status": "RUNNING"}
}

Filter by application version:

{
  "query": {"publishToApplicationVersion": "MyApp:1.0"}
}

Pagination

Handle large result sets using pagination-offset parameter:

First page:

{
  "pagination-offset": 0
}

Next page:

{
  "pagination-offset": 50
}

Continue with incremented offset until no more results.

Error Recovery

Error	Recovery
"Session expired"	Ask user to run fcli ssc session login locally with --sc-sast-url and --client-auth-token
"No sensors available"	Use sensor_pool_list to check pool availability, verify pool UUID
"Version mismatch" / scan won't start	Repackage with --sc-client-version "latest" and restart scan (omit --sensor-version). For explicit control, use sensor_list to find sensor versions and specify matching --sc-client-version and --sensor-version.
"Application version not found"	Use fcli_ssc_appversion_get to verify SSC target exists
"Package file not found"	Verify packaging step completed successfully, check file path
"Scan timeout"	Increase --timeout value in scan_wait_for, scans can take 30-60 minutes

Decision Tree: Choosing the Right Approach

User Intent	Action
"run SAST scan"	1. Package (action_package) → 2. Start scan (scan_start) → 3. Wait (scan_wait_for) → 4. View issues (fcli_ssc_issue_list)
"package source code"	Use action_package with --sc-client-version: "latest", --source-dir, --output
"check scan status"	Use scan_status with scanJobToken parameter
"list scans"	Use scan_list with optional query parameter
"list running scans"	Use scan_list with query: {"status": "RUNNING"}
"monitor scan"	Use scan_wait_for with scanJobTokens and --until parameters
"download scan results"	Use scan_download for FPR or view issues via fcli_ssc_issue_list
"check sensors"	Use sensor_list or sensor_pool_list
"view vulnerabilities"	After scan publishes: Use fcli_ssc_issue_list with --appversion parameter

Best Practices

DO:

• ✅ Use "latest" for sc-client-version: Preferred approach - automatically installs the most recent client version (e.g., 25.4.0) that matches current sensors
• ✅ Omit sensor-version parameter: When using modern clients (24.2+), ScanCentral auto-selects the matching sensor version
• ✅ Optional explicit control: Only use sensor_list to check versions if you need to manually specify both sc-client-version and sensor-version
• ✅ Validate SSC application version exists before starting scan
• ✅ Use embed: "scSastScan" in scan_list for detailed scan information
• ✅ Use query parameter for client-side filtering (e.g., {"status": "RUNNING"})
• ✅ Set appropriate timeouts on scan_wait_for (scans typically take 15-60 minutes)
• ✅ Capture scanJobToken from scan_start response for monitoring
• ✅ Use --publish-to parameter to automatically publish results to SSC
• ✅ Check sensor pool availability before starting scans

Do NOT:

• ❌ Assume scans complete quickly - SAST scans can take significant time
• ❌ Mix scanJobToken and scan-id terminology (use scanJobToken consistently)
• ❌ Forget --publish-to parameter - results won't appear in SSC without it
• ❌ Try to retrieve scan results before scan reaches COMPLETED state
• ❌ Use sc-client-version: "auto" - it uses older hardcoded defaults (e.g., 24.4.0) that may not match current sensors, causing scan failures. Always use "latest" instead.
• ❌ Specify sensor-version unnecessarily - omit it for auto-matching (recommended for modern clients 24.2+)
• ❌ Skip authentication verification - sensor operations require valid SSC session

References

Example Workflows

Workflow	Use When User Says...
Run SAST Scan	"run SAST scan", "scan my code", "package and scan", "start scan", "upload for scanning", "SAST analysis"
List and Monitor Scans	"list scans", "scan history", "check scan status", "monitor scan", "scan progress", "running scans"

External Resources

• FCLI Documentation
• SCSAST User Guide