Security engineer builds an MCP server in 7 days that spooks an AI agent with vulnerabilities

An information security specialist has built himself an AI assistant with a touch of paranoia: AppSecGate, a local MCP server that runs scanners, maintains a findings database, and forces the agent to deal with vulnerabilities instead of brushing them off. The first version took 7 days, about 210M tokens, and roughly 3000 rubles, or about 14 rubles per million tokens. The latest run on OWASP Juice Shop took about 50 minutes and cost around 15 rubles. The agent, running on deepseek-v4-flash, processed 200 findings and fixed 56, including 8 critical and 45 high.

Why AppSec is becoming a bottleneck

The classic SSDLC looks like this: a developer writes code in an IDE, the code lands in Git, and CI/CD runs SAST, SCA, and DAST. The reports go to ASOC/ASPM, where they are deduplicated and enriched. A security engineer then triages the findings and creates tickets in a tracker. The main drawback of this setup is that fix speed is unpredictable. If a scanner breaks, there is no replacement for a vulnerable library, or the AppSec engineer goes on vacation, a fix can wait a very long time. The main advantage is a clear division of responsibility, and it is easy to explain to the business that security has to be paid for.

LLMs put extra load on this pipeline. Developers first hit TAB, then asked an agent to write a method, and now they feed it a spec that the model itself wrote from a task that was also written by a model. There is more code, it is more tangled, the triage volume keeps growing, and manual testing gets harder. Add vibe coders who build projects solo and believe the model won't confuse dev with prod.

If you simply put an agent in every role, you get a long loop where everything is closed and tokens are spent, but the process is hardly optimal. Having agents talk to each other directly is risky too. The author jokes that the first thing they may discover is that negotiating via prompt injection is faster. The only question is whether the token budget runs out first.

Fewer agents, more structure

The system the author proposes is simpler:

• TaskTracker drops out of findings processing, because agents are better off exchanging structured data. The tracker can stay for time tracking and token accounting.
• CI/CD keeps a single autonomous agent that receives context on findings from ASOC. It is optional: an agent launched by the security engineer can replace it.
• ASOC/ASPM turns from a system for people into a system for agents.
• Scanning shifts left (shift-left): the agent runs scanners itself while writing code, like a formatter or unit tests. Push is not blocked; the problem is escalated to AppSec or the Lead. Scanning only the diff saves tokens, because the agent is already working with that file. Local triage is recorded on a central server, and the approach's effectiveness can be shown to management.

How AppSecGate works

The MVP is a local MCP server in an isolated Docker container with a set of scanners and a SQLite database. The architecture leaves room for a central server. The agent works through Cline: the author switched to it from Continue and wrote an AGENTS.md. The agent has these tools:

• get_config — configuration check;
• scan_project — starts a scan and returns an aggregated result;
• query_findings_db — SQL access to the findings database (for some reason, the agent prefers this one even though there are alternatives);
• get_fix_context_batch — context on the detections for fixing them;
• verify_fix_batch — verifies a fix or suppresses a finding as FALSE_POSITIVE.

When asked to "Check the project's security" in planning mode, the agent went through this chain and concluded that nothing should be fixed, because Juice Shop is vulnerable on purpose. The author had to explain that the tools were what was being tested. After he switched it to Act mode, the agent began triage, periodically checked against the database, and assembled a report at the end.

The author tested local models with a benchmark of seven variants on a single RTX 4060 Ti 16GB. There was no clear winner, but he drew some conclusions.

The practical takeaway for teams is this. A structured MCP layer between scanners and the agent turns security into an ordinary step of the development cycle. A 15-ruble run on a cheap cloud model costs noticeably less than an hour of an AppSec engineer's time on routine triage.

The small things help too: an AGENTS.md with clear rules, separate Plan and Act modes, and an explicit FALSE_POSITIVE label with verification. This setup will not replace AppSec.

The agent takes the routine work, while people keep secure architecture and the hunt for logic vulnerabilities. A side effect is a ready-made tool for solo vibe coders who need TimeToMarket and don't want to end up as an illustration of AI failures in the news.