Fortify ScanCentral SAST Skill

Fortify ScanCentral SAST (SC-SAST) integration via Model Context Protocol (MCP). Enables distributed SAST scanning using ScanCentral sensors with results published to SSC.

Available MCP Tools

Only key MCP tools for ScanCentral SAST are listed here.

Parameter Formats

Authentication

ScanCentral SAST uses SSC authentication with an additional client auth token for sensor communication.

Check session:

Tool: fcli_ssc_session_list

Parameters:

{
  "refresh-cache": true
}

If session expired or missing: Ask user to run locally:

fcli ssc session login --url <SSC-URL> -u <username> -p <password> --sc-sast-url <SC-SAST-URL> --client-auth-token <TOKEN>

Note: The --client-auth-token is a ScanCentral-specific token obtained from SSC Administration → Settings → ScanCentral Client. This token is required for sensor communication.

Filtering

Use client-side filtering with query JSON parameter:

Filter by status:

{
  "query": {"status": "RUNNING"}
}

Filter by application version:

{
  "query": {"publishToApplicationVersion": "MyApp:1.0"}
}

Pagination

Handle large result sets using pagination-offset parameter:

First page:

{
  "pagination-offset": 0
}

Next page:

{
  "pagination-offset": 50
}

Continue with incremented offset until no more results.

Error Recovery

Decision Tree: Choosing the Right Approach

Best Practices

DO:

• ✅ Use "latest" for sc-client-version: Preferred approach - automatically installs the most recent client version (e.g., 25.4.0) that matches current sensors
• ✅ Omit sensor-version parameter: When using modern clients (24.2+), ScanCentral auto-selects the matching sensor version
• ✅ Optional explicit control: Only use sensor_list to check versions if you need to manually specify both sc-client-version and sensor-version
• ✅ Validate SSC application version exists before starting scan
• ✅ Use embed: "scSastScan" in scan_list for detailed scan information
• ✅ Use query parameter for client-side filtering (e.g., {"status": "RUNNING"})
• ✅ Set appropriate timeouts on scan_wait_for (scans typically take 15-60 minutes)
• ✅ Capture scanJobToken from scan_start response for monitoring
• ✅ Use --publish-to parameter to automatically publish results to SSC
• ✅ Check sensor pool availability before starting scans

Do NOT:

• ❌ Assume scans complete quickly - SAST scans can take significant time
• ❌ Mix scanJobToken and scan-id terminology (use scanJobToken consistently)
• ❌ Forget --publish-to parameter - results won't appear in SSC without it
• ❌ Try to retrieve scan results before scan reaches COMPLETED state
• ❌ Use sc-client-version: "auto" - it uses older hardcoded defaults (e.g., 24.4.0) that may not match current sensors, causing scan failures. Always use "latest" instead.
• ❌ Specify sensor-version unnecessarily - omit it for auto-matching (recommended for modern clients 24.2+)
• ❌ Skip authentication verification - sensor operations require valid SSC session

References

Example Workflows

External Resources

• FCLI Documentation
• SCSAST User Guide