VS Code Extensions
HCL AppScan MCP

HCL AppScan MCP

by HCLTechnologies

Connect HCL AppScan on Cloud and HCL AppScan 360º to VS Code via the Model Context Protocol.

Downloads

2

Rating

— (0)

Version

1.0.0

Last updated

Aug 07, 2026

AI Chat #llm #MCP #sast #security #copilot #ai agent #model context protocol #assistant #chatbot #sca #chat-participant #bot #appscan #dast #hcl #iast

Connect HCL AppScan on Cloud and HCL AppScan 360° to VS Code via the Model Context Protocol. Ask Copilot Chat about your SAST, DAST, SCA, and IAST findings using natural language, and apply remediation directly to your code.

AppScan sign in

Requirements

  • Visual Studio Code 1.101 or later (also compatible with Cursor and Windsurf)
  • GitHub Copilot Chat extension
  • An HCL AppScan on Cloud or HCL AppScan 360° account with a valid API key

Features

  • One-click MCP registration: No manual mcp.json editing required. The extension registers AppScan through the official VS Code MCP Provider API and writes an MCP fallback configuration for Cursor and Windsurf automatically.

  • Secure credentials: Your API Key ID is stored in VS Code settings, and your API Key Secret is stored in VS Code SecretStorage. Credentials are validated at sign-in.

  • @appscan chat participant (VS Code only) with built-in slash commands:

    Command Description
    /doc Loads AppScan documentation context and summarizes available capabilities.
    /apps Lists your AppScan applications, with optional filtering.
    /scans Lists or describes scans for an application.
    /issues Queries AppScan findings, defaulting to open High/Critical issues unless you narrow it.
    /remediate Fetches issue details and proposes a code fix for matching files in your workspace.

  • Status bar: Displays connection state and current tenant at a glance.

  • Dashboard button: Opens the AppScan dashboard for your connected tenant (visible in the sidebar when signed in).

  • Built-in walkthrough: Guides you through connection setup and first use.

  • Region support: HCL AppScan on Cloud (US), HCL AppScan on Cloud (EU), or HCL AppScan 360° and single-tenant instances via custom URL.

Quick start

  1. Install this extension and GitHub Copilot Chat.

  2. Run AppScan: Sign In from the Command Palette and select your region.

  3. Enter your API Key ID and API Key Secret when prompted.

  4. In VS Code, open Copilot Chat and type: @appscan list my applications.

  5. In Cursor or Windsurf, use the synced AppScan MCP server from your IDE's AI chat. The @appscan chat participant is not available outside VS Code, but the MCP tools are fully accessible through Cursor's and Windsurf's native AI interfaces.

Tip: For richer responses in VS Code, type /mcp.appscan-mcp.appscan-doc in Copilot Chat first, or run AppScan: Insert appscan-doc Prompt in Chat from the Command Palette. This loads the AppScan tool descriptions so Copilot can give more accurate answers.

AppScan after login

Commands

Command Description
AppScan: Sign In Connect to HCL AppScan using your API key.
AppScan: Sign Out Remove the active AppScan connection.
AppScan: Reconfigure Update the active connection settings.
AppScan: Open Dashboard Open the AppScan dashboard for the connected tenant.
AppScan: Show Output Open the extension output channel.
AppScan: Insert appscan-doc Prompt in Chat Insert the AppScan documentation prompt into Copilot Chat.
AppScan: Open Getting Started Walkthrough Open the guided setup walkthrough.
AppScan: Open Copilot Chat with @appscan Open Copilot Chat with the AppScan participant.
AppScan: Open Settings Open the extension settings.

Usage examples

After you sign in, try these prompts in Copilot Chat (VS Code) or your IDE's AI chat (Cursor or Windsurf):

  • @appscan List my applications
  • @appscan Show critical and high issues in MyApp
  • @appscan Summarize the latest SAST scan
  • @appscan Suggest a fix for issue [#1234](https://github.com/hcl/appscan-mcp-vscode/issues/1234)

AppScan issue list

Connection requirements

The extension connects to AppScan MCP servers over HTTPS with trusted certificates.

  • AppScan on Cloud: Select the US or EU region during sign-in. No additional configuration is needed.
  • AppScan 360° or single-tenant instances: Select Custom URL during sign-in and enter your server's HTTPS URL (must use a trusted certificate).

Settings

Setting Description
hclAppscan.region cloud (default), eu, or custom. Determines the MCP and REST API base URL.
hclAppscan.serverUrl Override MCP server URL when region is custom. Example: https://cloud.appscan.com/mcp.
hclAppscan.apiBaseUrl Override REST API base URL when region is custom. Example: https://cloud.appscan.com.
hclAppscan.apiKeyId AppScan API Key ID. The API Key Secret is stored securely in SecretStorage.

Privacy

Your API Key Secret never leaves your machine. It is sent only as the X-API-KEY header to the AppScan MCP endpoint you configure. On VS Code, the secret stays in SecretStorage.

Support

To report an issue or request a feature, select Report an Issue in the extension sidebar or visit the AppScan Resources issue tracker.

License

License information is available in LICENSE.txt.

Related extensions

Ollama

Ollama

Ollama

Ollama language model provider for VS Code.

AI #Agent
158,039 4.3
GitHub Copilot upgrade

GitHub Copilot upgrade

ms-dotnettools

Upgrade your projects with GitHub Copilot. Analyzes your code and drives framework upgrades, dependency migrations, and other upgrade tasks with AI assistance.

AI Chat #copilot
99,892
Antigravity for VS Code

Antigravity for VS Code

lyadhgod

Bring Google's Antigravity CLI (agy) into VS Code: an agentic coding companion with a Material 3 Expressive chat UI, a slash-command navigator, interactive sessions with in-chat option pickers, and Google sign-in.

AI Chat #ai
38,533 3.3
Mistral Vibe VS Code

Mistral Vibe VS Code

mistralai

Mistral Vibe is an AI coding agent for VS Code that works across your whole project.

Programming Languages Machine Learning #ai
29,456 4.4