Skip to main content
Glama
OWASP-BLT

BLT-MCP

by OWASP-BLT
OverviewSchemaRelated ServersScoreDiscussions
Python
Remote

BLT-MCP

An MCP (Model Context Protocol) server that provides AI agents and developers with structured access to the BLT (Bug Logging Tool) ecosystem. This server enables seamless integration with IDEs and chat interfaces to log bugs, triage issues, query data, and manage security workflows.

Overview

BLT-MCP implements the MCP standard, giving AI agents structured access to BLT through three powerful layers:

🔗 Resources (blt:// URIs)

Access BLT data through standardized URIs:

  • blt://issues - All issues in the system

  • blt://issues/{id} - Specific issue details

  • blt://repos - Tracked repositories

  • blt://repos/{id} - Specific repository details

  • blt://contributors - All contributors

  • blt://contributors/{id} - Specific contributor details

  • blt://workflows - All workflows

  • blt://workflows/{id} - Specific workflow details

  • blt://leaderboards - Leaderboard rankings and statistics

  • blt://rewards - Rewards and bacon points

🛠️ Tools

Perform actions on BLT:

  • submit_issue - Report new bugs and vulnerabilities

  • award_bacon - Award bacon points to contributors (gamification)

  • update_issue_status - Change issue status (open, in_progress, resolved, closed, wont_fix)

  • add_comment - Add comments to issues

💡 Prompts

AI-guided workflows for common security tasks:

  • triage_vulnerability - Guide AI through vulnerability triage and severity assessment

  • plan_remediation - Create comprehensive remediation plans for security issues

  • review_contribution - Evaluate contributions with quality assessment and bacon point recommendations

Features

  • ✅ JSON-RPC 2.0 - Standard protocol for reliable communication

  • ✅ OAuth/API Key Authentication - Secure access to BLT endpoints

  • ✅ Unified Interface - Single agent-friendly interface to all BLT functionality

  • ✅ Autonomous Workflows - Enable AI agents to work independently

  • ✅ Gamification Support - Built-in support for BLT's bacon point system

  • ✅ Security-First - Designed for vulnerability management and security workflows

Installation

Prerequisites

  • Node.js 18 or higher

  • npm or yarn

Install Dependencies

npm install

Build

npm run build

Configuration

Environment Variables

Create a .env file based on .env.example:

cp .env.example .env

Configure the following variables:

BLT_API_BASE=https://blt.owasp.org/api
BLT_API_KEY=your_api_key_here

MCP Client Configuration

To use this server with an MCP client (like Claude Desktop or Cline), add it to your MCP settings:

{
  "mcpServers": {
    "blt": {
      "command": "node",
      "args": ["/absolute/path/to/blt-mcp/dist/index.js"],
      "env": {
        "BLT_API_BASE": "https://blt.owasp.org/api",
        "BLT_API_KEY": "your_api_key_here"
      }
    }
  }
}

Usage

Running the Server

The server runs using stdio transport for MCP communication:

node dist/index.js

Using with AI Agents

Once configured in your MCP client, you can interact with BLT through natural language:

Example: Submitting an Issue

"Submit a new critical vulnerability in the authentication system of repo 123"

The AI agent will use the submit_issue tool to create the issue.

Example: Accessing Resources

"Show me the leaderboard"

The AI agent will read from blt://leaderboards to display the rankings.

Example: Using Prompts

"Help me triage this XSS vulnerability in the login form"

The AI agent will use the triage_vulnerability prompt to guide the analysis.

API Reference

Resources

List All Issues

URI: blt://issues
Returns: JSON array of all issues

Get Specific Issue

URI: blt://issues/{id}
Returns: JSON object with issue details

Leaderboards

URI: blt://leaderboards
Returns: JSON object with leaderboard data

Tools

submit_issue

Submit a new issue to BLT.

Parameters:

  • title (string, required) - Issue title

  • description (string, required) - Detailed description

  • repo_id (string, optional) - Repository ID

  • severity (string, optional) - One of: low, medium, high, critical

  • type (string, optional) - One of: bug, vulnerability, feature, other

Example:

{
  "title": "XSS vulnerability in login form",
  "description": "The login form is vulnerable to reflected XSS...",
  "repo_id": "123",
  "severity": "high",
  "type": "vulnerability"
}

award_bacon

Award bacon points to a contributor.

Parameters:

  • contributor_id (string, required) - Contributor ID

  • points (number, required) - Points to award

  • reason (string, required) - Reason for the award

update_issue_status

Update the status of an issue.

Parameters:

  • issue_id (string, required) - Issue ID

  • status (string, required) - One of: open, in_progress, resolved, closed, wont_fix

  • comment (string, optional) - Explanation for status change

add_comment

Add a comment to an issue.

Parameters:

  • issue_id (string, required) - Issue ID

  • comment (string, required) - Comment text

Prompts

triage_vulnerability

Guides AI through vulnerability triage.

Arguments:

  • vulnerability_description (required) - Description of the vulnerability

  • affected_component (optional) - Affected component or system

plan_remediation

Creates remediation plans for security issues.

Arguments:

  • issue_id (required) - Issue ID to create plan for

  • context (optional) - Additional context

review_contribution

Evaluates security contributions.

Arguments:

  • contribution_id (required) - Contribution ID

  • contribution_type (optional) - Type of contribution

JSON-RPC Example

Since BLT-MCP uses JSON-RPC 2.0 over stdio, below is an example request and response format.

Example: Calling submit_issue Tool

Request:

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "submit_issue",
    "arguments": {
      "title": "Test issue from JSON-RPC",
      "description": "This is a test issue created via raw JSON-RPC request.",
      "severity": "low"
    }
  }
}

Example Response:

{
  "jsonrpc": "2.0",
  "id": 1,
  "result": {
    "success": true,
    "message": "Issue submitted successfully"
  }
}

Troubleshooting

Node Version

Ensure you are running Node.js v18 or higher:

node -v

Missing Environment Variables

Make sure .env is properly configured:

BLT_API_BASE=https://blt.owasp.org/api
BLT_API_KEY=your_api_key_here

Build Issues

If dist/index.js is missing, run:

npm run build

Development

Watch Mode

For development, use watch mode to automatically rebuild on changes:

npm run watch

Project Structure

blt-mcp/
├── src/
│   └── index.ts          # Main server implementation
├── dist/                 # Compiled JavaScript (generated)
├── package.json          # Project dependencies
├── tsconfig.json         # TypeScript configuration
├── .env.example          # Example environment configuration
└── mcp-config.json       # Example MCP client configuration

Security Considerations

  • API Keys: Never commit API keys to version control. Use environment variables.

  • Access Control: Ensure proper authentication is configured for production use.

  • Rate Limiting: Be mindful of API rate limits when making requests.

  • Input Validation: The server validates all inputs before sending to the BLT API.

Contributing

Contributions are welcome! Please follow these guidelines:

  1. Fork the repository

  2. Create a feature branch

  3. Make your changes

  4. Submit a pull request

License

MIT License - see LICENSE file for details

Support

For issues, questions, or contributions, please visit:

Acknowledgments

Available Tools

4 tools
add_commentC

Add a comment to an existing issue in the BLT system.

ParametersJSON Schema
NameRequiredDescriptionDefault
issue_idYesThe ID of the issue to comment on
commentYesThe comment text to add

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden for behavioral disclosure. It states the tool adds a comment but doesn't describe what happens after (e.g., is the comment immediately visible, does it trigger notifications, are there rate limits or authentication requirements?). For a mutation tool with zero annotation coverage, this is a significant gap in transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that directly states the tool's function without unnecessary words. It's front-loaded with the core action and resource, making it easy to parse quickly. Every word earns its place in this minimal but complete statement.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given this is a mutation tool with no annotations and no output schema, the description is incomplete. It doesn't address behavioral aspects like permissions, side effects, or response format, leaving the agent with insufficient context to use the tool effectively beyond basic parameter passing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with both parameters ('issue_id' and 'comment') clearly documented in the schema. The description doesn't add any additional meaning beyond what the schema provides (e.g., format examples or constraints), so it meets the baseline for adequate but unenhanced parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Add a comment') and target resource ('to an existing issue in the BLT system'), making the purpose immediately understandable. However, it doesn't differentiate from sibling tools like 'submit_issue' or 'update_issue_status' which also involve issue interactions, missing an opportunity for clearer distinction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites (e.g., issue must exist), exclusions, or comparisons to sibling tools like 'submit_issue' (for creating issues) or 'update_issue_status' (for modifying status). This leaves the agent without context for tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

award_baconC

Award bacon points to a contributor for their contribution. This is part of BLT's gamification system.

ParametersJSON Schema
NameRequiredDescriptionDefault
contributor_idYesThe ID of the contributor to award
pointsYesThe number of bacon points to award
reasonYesThe reason for awarding the bacon points

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. While 'award' implies a write/mutation operation, the description doesn't specify whether this requires special permissions, if points are reversible, what happens if the contributor doesn't exist, or any rate limits. For a mutation tool with zero annotation coverage, this leaves significant behavioral questions unanswered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is appropriately concise with two sentences that directly address the tool's purpose. Both sentences earn their place - the first states what the tool does, and the second provides important context about the gamification system. No wasted words or unnecessary elaboration.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool with no annotations and no output schema, the description is insufficient. It doesn't explain what happens after awarding points (success/failure responses), whether the operation is idempotent, what permissions are required, or how this integrates with the broader system. The context about BLT's gamification system is helpful but doesn't compensate for the missing behavioral information.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all three parameters (contributor_id, points, reason) are documented in the schema. The description doesn't add any parameter-specific information beyond what's already in the schema, such as format requirements for contributor_id, valid ranges for points, or examples for reason. Baseline 3 is appropriate when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('award bacon points') and target ('to a contributor'), explaining it's part of a gamification system. However, it doesn't differentiate this tool from its siblings (add_comment, submit_issue, update_issue_status), which all seem to be different types of actions in what appears to be an issue tracking system.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides minimal guidance - it only states this is for awarding points in a gamification system. There's no explicit guidance on when to use this tool versus alternatives, nor any mention of prerequisites, constraints, or appropriate contexts for use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

submit_issueB

Submit a new issue to the BLT system. Use this to report bugs, vulnerabilities, or other issues.

ParametersJSON Schema
NameRequiredDescriptionDefault
titleYesThe title of the issue
descriptionYesDetailed description of the issue
repo_idNoThe repository ID where the issue was found
severityNoThe severity level of the issue
typeNoThe type of issue

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It states this is for submitting new issues, implying a write operation, but doesn't disclose behavioral traits such as authentication requirements, rate limits, whether submissions are public or private, or what happens on success/failure. For a mutation tool with zero annotation coverage, this is a significant gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with zero waste: the first states the purpose, and the second provides usage context. It's appropriately sized and front-loaded, making it easy to understand quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given this is a mutation tool (submitting new issues) with no annotations and no output schema, the description is incomplete. It doesn't cover important aspects like what the tool returns, error conditions, or side effects, which are crucial for an agent to use it correctly in a workflow.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all 5 parameters thoroughly. The description adds no additional meaning beyond what the schema provides (e.g., it doesn't explain parameter relationships or usage nuances). Baseline 3 is appropriate when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Submit a new issue to the BLT system' with specific examples of what to report ('bugs, vulnerabilities, or other issues'). It distinguishes from siblings like 'add_comment' or 'update_issue_status' by focusing on creation rather than modification, though it doesn't explicitly name these alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use this tool ('to report bugs, vulnerabilities, or other issues'), but it doesn't provide explicit guidance on when not to use it or when to choose alternatives like 'add_comment' for existing issues. The context is clear but lacks exclusion criteria or direct sibling comparisons.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

update_issue_statusC

Update the status of an existing issue in the BLT system.

ParametersJSON Schema
NameRequiredDescriptionDefault
issue_idYesThe ID of the issue to update
statusYesThe new status for the issue
commentNoOptional comment explaining the status change

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It states this is an update operation, implying mutation, but doesn't cover critical aspects like required permissions, whether changes are reversible, error handling, or response format. This leaves significant gaps for a mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that directly states the tool's purpose without unnecessary words. It's appropriately sized for a simple update tool, though it could be slightly more informative without losing conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity as a mutation operation with no annotations and no output schema, the description is incomplete. It lacks details on behavioral traits (e.g., side effects, authentication), usage context, and expected outcomes, making it inadequate for safe and effective use by an AI agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents all parameters (issue_id, status, comment). The description adds no additional semantic context beyond what's in the schema, such as format details or usage examples, meeting the baseline for high coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb ('update') and resource ('status of an existing issue'), specifying the action and target. However, it doesn't differentiate from sibling tools like 'add_comment' or 'submit_issue', which also involve issue operations but for different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites (e.g., needing an existing issue ID), exclusions, or comparisons to siblings like 'add_comment' for comments without status changes or 'submit_issue' for creating new issues.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 4 tool updatesv1.0.0
    • First observedadd_comment
    • First observedaward_bacon
    • First observedsubmit_issue
    • First observedupdate_issue_status
Install Server
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

B3.4/5.0
Disambiguation5/5

Each tool has a clearly distinct purpose: add_comment modifies an issue's discussion, award_bacon handles gamification rewards, submit_issue creates new issues, and update_issue_status changes issue states. There is no overlap in functionality, making tool selection straightforward for an agent.

Naming Consistency5/5

All tools follow a consistent verb_noun naming pattern (e.g., add_comment, award_bacon, submit_issue, update_issue_status). The verbs are descriptive and appropriately chosen for their actions, with no deviations in style or convention.

Tool Count4/5

With 4 tools, the server is well-scoped for issue management and gamification in the BLT system. However, it feels slightly thin as it lacks tools for viewing or listing issues, which could be a minor gap in the workflow. The count is reasonable but not fully optimal.

Completeness3/5

The tools cover core actions like creating, updating, and commenting on issues, plus gamification. However, there are notable gaps: no tools to retrieve or list existing issues, which limits an agent's ability to query the system state. This could cause workarounds or failures in workflows that require issue discovery.

Maintenance

ActivityNo data
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/OWASP-BLT/BLT-MCP'

If you have feedback or need assistance with the MCP directory API, please join our Discord server