Integration

Connect Truvant to your CI/CD pipelines, SIEM platforms, and identity providers.

CI/CD Integration

Truvant integrates with CI/CD pipelines to catch supply-chain risks before they reach developer machines. Scan results can be emitted in SARIF format for native integration with GitHub Code Scanning, GitLab SAST, and any other SARIF-compatible viewer.

GitHub Actions

Add the following workflow to your repository to scan MCP server packages on every push and pull request. Results are uploaded to GitHub Code Scanning and appear inline in the pull request diff.

# .github/workflows/mcp-security.yaml
name: MCP Security Scan

on:
  push:
    branches: [main]
  pull_request:

jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install mcpctl
        run: |
          curl -fsSL https://registry.truvant.ai/install.sh | sh
          echo "$HOME/.local/bin" >> $GITHUB_PATH

      - name: Scan MCP servers
        env:
          MCPCTL_CLI_REGISTRY_URL: https://registry.truvant.ai
        run: mcpctl scan --format sarif -o results.sarif --no-import

      - name: Upload SARIF to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif

Standards mapping

Truvant scan findings are mapped to established security standards and frameworks. SARIF output includes rule metadata with standards references so findings appear in the correct category in your security tooling.

SIEM Integration

The mcpctl agent writes structured signal files to a local directory after each enforcement decision. These files are designed for ingestion by Microsoft Defender for Endpoint (MDE) and any SIEM that can read JSON from a watched directory (Splunk UF, Elastic Agent, Cribl, Filebeat, etc.).

Signal files have the following characteristics:

• Format — Newline-delimited JSON, one event per line.
• Deduplication — Identical events within a 60-second window are collapsed into a single signal with an incremented count field.
• Rotation — Files are rotated daily. The active file is always named mcpctl-signals.jsonl; rotated files use the pattern mcpctl-signals-YYYY-MM-DD.jsonl.
• Retention — Rotated files older than 30 days are removed automatically by the agent.

Configuration

The signal file directory defaults to ~/.config/mcpctl/signals/. Override it by setting the MCPCTL_SIGNALS_DIR environment variable, or by editing signals_dir in config.yaml. Point your SIEM agent or custom ingest pipeline at the configured directory.

# Override the signal directory via environment variable
export MCPCTL_SIGNALS_DIR=/var/log/mcpctl/signals

# Or set it in config.yaml
# signals_dir: /var/log/mcpctl/signals

mcpctl restart

Identity Providers

Truvant uses OpenID Connect (OIDC) for authentication. The following identity providers are supported out of the box. Any standards-compliant OIDC provider can be configured using the custom OIDC setup below.

Enterprise SSO setup

To connect a custom OIDC provider, follow these steps:

1. Create a new OIDC application (sometimes called an "OAuth 2.0 client" or "app registration") in your identity provider's admin console.
2. Set the redirect URI to https://trust.truvant.ai/auth/callback.
3. Note the issuer URL (e.g., https://your-domain.okta.com) and client ID from the application settings.
4. Run mcpctl login --provider custom on each developer machine that will authenticate through this provider.
5. When prompted, enter the issuer URL and client ID. mcpctl stores these in the config file so subsequent logins require only mcpctl login.