MCP Tools for Radar

ByteHide Radar exposes five tools through the MCP server that your AI coding agent can call directly. This page covers every tool, its parameters, and usage examples.

scan_code

Scan source code files for security vulnerabilities (SAST), hardcoded secrets, and code quality issues. Returns findings with severity, CWE references, exact line numbers, and fix recommendations.

Parameters

The context object accepts:

Supported Languages

General Availability: C, C++, C#, Go, Java, JavaScript, JSX, TypeScript, TSX, Kotlin, PHP, Python, Ruby, Rust, Scala, Swift.

Also supported: Apex, Bash, Dart, Dockerfile, Elixir, HTML, JSON, Lua, OCaml, R, Solidity, Terraform, XML, YAML, and more.

How it works

1. The AI agent reads the files you want to scan and sends their content to the tool
2. ByteHide Radar analyzes the code for OWASP Top 10 vulnerabilities, CWE patterns, and hardcoded credentials
3. If no project exists yet for this repository, one is created automatically in your ByteHide dashboard
4. Results are returned inline with severity levels, affected lines, and actionable fix suggestions

Example usage

Ask your AI agent:

• "Scan this file for security vulnerabilities"
• "Check src/auth/login.ts for hardcoded secrets"
• "Run a security audit on all files in the src/ directory"

Here's an example of scan_code in action on Claude.ai. The user shares C# code with a potential SQL injection and asks if it's safe:

Click to expand

The tool returns the finding with severity, CWE reference, affected file, and a description of the issue:

Click to expand

Claude then uses the scan results to explain the vulnerability in context — highlighting the dangerous line and demonstrating how an attacker could exploit it:

Click to expand

All findings from MCP scans sync to your Radar dashboard, where you can track them alongside your regular scans, filter by severity or CWE, and generate autofixes:

Click to expand

Click on any finding to see the full detail: affected code lines, CWE and OWASP references, AI-powered explanation, and a one-click option to create a fix PR:

Click to expand

check_dependency

Check whether a specific package is safe to install. Returns known CVEs, severity, license information, and an upgrade recommendation if a safer version exists.

Parameters

Supported Ecosystems

Example usage

Ask your AI agent:

• "Is lodash@4.17.20 safe to install?"
• "Check if the latest version of flask has any CVEs"
• "Before I install jsonwebtoken, check if it's secure"

Here's an example on Claude.ai. The user asks about chalk 5.6.1 — Claude calls check_dependency and gets a clear answer:

Click to expand

Click to expand

scan_dependencies

Scan all dependencies in a manifest file at once for known vulnerabilities. Reads the entire file and returns a summary grouped by severity, with upgrade recommendations for each vulnerable package.

Parameters

Supported Manifest Files

What it returns

• Total dependencies scanned
• Number of vulnerable vs safe packages
• For each vulnerable package: CVE identifiers, severity, affected versions, and recommended upgrade version
• Summary grouped by severity (Critical, High, Medium, Low)

Example usage

Ask your AI agent:

• "Audit my package.json for vulnerable dependencies"
• "Scan requirements.txt for known CVEs"
• "Check all dependencies in go.mod including dev dependencies"

Here's an example in Claude Code (CLI). The agent scans a package.json and returns a full vulnerability report grouped by severity, with CVE details and prioritized upgrade recommendations:

Click to expand

list_projects

List all ByteHide projects in your organization. Useful for verifying your setup, finding project details, or exploring what's already being scanned.

Parameters

What it returns

For each project: project name and ID, programming language, connected ByteHide modules (Radar, Shield, Secrets, Monitor), assigned teams, and description (if set).

Example usage

Ask your AI agent:

• "List my ByteHide projects"
• "Show me all projects with 'api' in the name"
• "What projects do I have in ByteHide?"

audit_ai_environment

Scan your AI development environment configuration files for security risks. Detects prompt injection vectors, risky MCP server configurations, credential exposure, overpermissioning, and cross-file attack chains.

Parameters

Files to scan

What it detects

Prompt Injection — Dangerous instructions in AI prompts that could lead to data exfiltration, unauthorized commands, or security bypass.

MCP Server Risks — Unencrypted connections, unauthenticated remote servers, auto-install without version pinning, dangerous tool categories, and overly broad permissions.

Credential Exposure — Hardcoded API keys, tokens, and passwords for services like AWS, GitHub, OpenAI, Stripe, database connections, and more.

Overpermissioning — dangerouslySkipPermissions, broad filesystem access, wildcard tool allowlists, privileged Docker containers, and --no-sandbox flags.

Git Protection — Checks whether sensitive files (.env, *.pem, *.key, credentials.json, .mcp.json) are properly listed in .gitignore.

What it returns

• Security Score (0–100): overall health of your AI environment
• Attack Chains: multi-step vulnerability paths (e.g., prompt injection leading to credential exfiltration)
• Individual Findings: categorized by type and severity
• Git Protection Status: which sensitive files are covered by .gitignore

Example usage

Ask your AI agent:

• "Audit my AI development environment for security risks"
• "Check if my .env file is exposed in the git repo"
• "Are there any prompt injection risks in my Claude configuration?"

Automatic Project Creation

The tools scan_code, check_dependency, and scan_dependencies automatically create a project in your ByteHide dashboard when scanning a repository for the first time. The project name is derived from your git remote URL (e.g., github.com/your-org/your-repo becomes your-org/your-repo). If no git remote is available, the workspace folder name is used.

Next Steps