HCL AppScan MCP for VS Code
Connect HCL AppScan on Cloud and HCL AppScan 360° to VS Code via the Model Context Protocol. Ask Copilot Chat about your SAST, DAST, SCA, and IAST findings using natural language, and apply remediation directly to your code.
Requirements
- Visual Studio Code 1.101 or later (also compatible with Cursor and Windsurf)
- GitHub Copilot Chat extension
- An HCL AppScan on Cloud or HCL AppScan 360° account with a valid API key
Features
One-click MCP registration: No manual mcp.json editing required. The extension registers AppScan through the official VS Code MCP Provider API and writes an MCP fallback configuration for Cursor and Windsurf automatically.
Secure credentials: Your API Key ID is stored in VS Code settings, and your API Key Secret is stored in VS Code SecretStorage. Credentials are validated at sign-in.
@appscan chat participant (VS Code only) with built-in slash commands:
| Command |
Description |
/doc |
Loads AppScan documentation context and summarizes available capabilities. |
/apps |
Lists your AppScan applications, with optional filtering. |
/scans |
Lists or describes scans for an application. |
/issues |
Queries AppScan findings, defaulting to open High/Critical issues unless you narrow it. |
/remediate |
Fetches issue details and proposes a code fix for matching files in your workspace. |
Status bar: Displays connection state and current tenant at a glance.
Dashboard button: Opens the AppScan dashboard for your connected tenant (visible in the sidebar when signed in).
Built-in walkthrough: Guides you through connection setup and first use.
Region support: HCL AppScan on Cloud (US), HCL AppScan on Cloud (EU), or HCL AppScan 360° and single-tenant instances via custom URL.
Quick start
Install this extension and GitHub Copilot Chat.
Run AppScan: Sign In from the Command Palette and select your region.
Enter your API Key ID and API Key Secret when prompted.
In VS Code, open Copilot Chat and type: @appscan list my applications.
In Cursor or Windsurf, use the synced AppScan MCP server from your IDE's AI chat. The @appscan chat participant is not available outside VS Code, but the MCP tools are fully accessible through Cursor's and Windsurf's native AI interfaces.
Tip: For richer responses in VS Code, type /mcp.appscan-mcp.appscan-doc in Copilot Chat first, or run AppScan: Insert appscan-doc Prompt in Chat from the Command Palette. This loads the AppScan tool descriptions so Copilot can give more accurate answers.
Commands
| Command |
Description |
AppScan: Sign In |
Connect to HCL AppScan using your API key. |
AppScan: Sign Out |
Remove the active AppScan connection. |
AppScan: Reconfigure |
Update the active connection settings. |
AppScan: Open Dashboard |
Open the AppScan dashboard for the connected tenant. |
AppScan: Show Output |
Open the extension output channel. |
AppScan: Insert appscan-doc Prompt in Chat |
Insert the AppScan documentation prompt into Copilot Chat. |
AppScan: Open Getting Started Walkthrough |
Open the guided setup walkthrough. |
AppScan: Open Copilot Chat with @appscan |
Open Copilot Chat with the AppScan participant. |
AppScan: Open Settings |
Open the extension settings. |
Usage examples
After you sign in, try these prompts in Copilot Chat (VS Code) or your IDE's AI chat (Cursor or Windsurf):
@appscan List my applications@appscan Show critical and high issues in MyApp@appscan Summarize the latest SAST scan@appscan Suggest a fix for issue [#1234](https://github.com/hcl/appscan-mcp-vscode/issues/1234)
Connection requirements
The extension connects to AppScan MCP servers over HTTPS with trusted certificates.
- AppScan on Cloud: Select the US or EU region during sign-in. No additional configuration is needed.
- AppScan 360° or single-tenant instances: Select Custom URL during sign-in and enter your server's HTTPS URL (must use a trusted certificate).
Settings
| Setting |
Description |
hclAppscan.region |
cloud (default), eu, or custom. Determines the MCP and REST API base URL. |
hclAppscan.serverUrl |
Override MCP server URL when region is custom. Example: https://cloud.appscan.com/mcp. |
hclAppscan.apiBaseUrl |
Override REST API base URL when region is custom. Example: https://cloud.appscan.com. |
hclAppscan.apiKeyId |
AppScan API Key ID. The API Key Secret is stored securely in SecretStorage. |
Privacy
Your API Key Secret never leaves your machine. It is sent only as the X-API-KEY header to the AppScan MCP endpoint you configure. On VS Code, the secret stays in SecretStorage.
Support
To report an issue or request a feature, select Report an Issue in the extension sidebar or visit the AppScan Resources issue tracker.
License
License information is available in LICENSE.txt.
