Skip to main content
Beta Scan dependencies, detect vulnerabilities, find leaked secrets, and review code for security issues directly inside IntelliJ IDEA, powered by your AI agent.

​
What you can do

With the Endor Labs MCP server, you can:
  • Check dependency safety before adding a new package
  • Scan for vulnerabilities and malware in your open source dependencies
  • Find leaked secrets accidentally committed in your Git history
  • Run AI security reviews on your code changes (Enterprise Edition)

​
Install the MCP server

The Developer Edition is free and uses default security policies from Endor Labs. When you use the MCP server for the first time, a browser window opens for authentication through GitHub, GitLab, or Google.Open GitHub Copilot Chat, switch to Agent mode, select Configure Tools, then select + Add More Tools… to open mcp.json. Copy and paste the generated configuration.
Have questions? Email us at community-support@endor.ai.

​
Verify the installation

Save and close mcp.json. Switch from Agent to Ask mode in the chat and then back to Agent mode to reload the MCP server. After installing, in GitHub Copilot Chat, switch to Agent mode and select Configure Tools to confirm endor-cli-tools appears in the list and is enabled.

​
Try a test prompt

After installing the MCP server, try the following prompt in your AI chat or CLI to verify that the tools are working. 
Check if the npm package lodash version 4.17.20 has any vulnerabilities
The MCP server uses the check_dependency_for_vulnerabilities tool to check for known vulnerabilities and return the results. If you see a response with vulnerability details, the MCP server is working correctly.

​
How to use the Endor Labs MCP server

The Endor Labs MCP server provides the following tools:
  • check_dependency_for_vulnerabilities: Check if a dependency in your project is vulnerable.
  • check_dependency_for_risks: Check a dependency for security risks including vulnerabilities and malware.
  • get_endor_vulnerability: Get the details of a specific vulnerability from the Endor Labs vulnerability database.
  • get_resource: Retrieve additional context from commonly used Endor Labs resources about your software, such as findings, vulnerabilities, and projects.
  • scan: Run an Endor Labs security scan to detect risks in your open source dependencies, find common security issues, and spot any credentials accidentally exposed in your Git repository.
  • security_review: Perform security review analysis on code diffs. Analyzes local uncommitted changes (both staged and unstaged) compared to HEAD, or diffs between the main branch and the last commit. Requires the Enterprise Edition. You must specify your namespace in the MCP server configuration. You must also enable AI security code review for your namespace in the Endor Labs platform. See AI security code review for setup instructions.
After you set up the MCP server, you can choose to disable the tools that you do not want to use.

​
Configure Copilot rules

Set up Copilot rules in .github/instructions/*.md to use the Endor Labs MCP server throughout the development process. See Add repository custom instructions for GitHub Copilot for more details.

​
Example Copilot rules

Copilot instructions define the guidelines that Copilot should follow throughout the development process. The following examples demonstrate how to use the Endor Labs MCP server within Copilot rules. 
---
description: "Dependency vulnerability scanning using Endor Labs via MCP server integration"
applyTo: '**/package.json, **/package-lock.json, **/yarn.lock, **/pnpm-lock.yaml, **/requirements.txt, **/Pipfile, **/Pipfile.lock, **/pyproject.toml, **/poetry.lock, **/go.mod, **/go.sum, **/Cargo.toml, **/Cargo.lock, **/pom.xml, **/build.gradle, **/build.gradle.kts, **/gradle.lockfile, **/composer.json, **/composer.lock'

---

# Software Composition Analysis (SCA) Rule (Endor Labs via MCP)
This project uses Endor Labs for automated dependency (SCA) scanning, integrated through the MCP server as configured in `mcp.json`.

## Workflow

Every time a manifest or lockfile listed above is created or modified in any way immediately do the following prior to performing your next task.

**Important**: Do not proceed after creating or modifying a manifest file without running this first. Do not write any other code or continue with your existing prompt. This is top priority whenever a manifest file is created or updated.

- Run `endor-cli-tools` using the `check_dependency_for_vulnerabilities` tool via the MCP server.
- Provide the **ecosystem**, **dependency name**, and **version** always when making this tool call. Do not forget to provide a version.
- If a vulnerability or error is identified:
  - Upgrade to the suggested safe version, or
  - Replace the dependency with a non-vulnerable alternative.
  - The AI agent must attempt to automatically correct all detected errors and vulnerabilities before session completion.
- Re-run the check using `endor-cli-tools` to confirm the issue is resolved.
- If an error occurs in any MCP server tool call (such as missing required parameters like version, invalid arguments, or tool invocation failures):
  - The AI agent must review the error, determine the cause, and automatically correct the tool call or input parameters.
  - Re-attempt the tool call with the corrected parameters.
  - Continue this process until the tool call succeeds or it is determined that remediation is not possible, in which case the issue and reason must be reported.

## Notes
- All scans must be performed using the MCP server integration (`endor-cli-tools`) as configured in `mcp.json`. Do not invoke `endorctl` directly.
- For troubleshooting, ensure the MCP server is running and `endorctl` is installed and accessible in your environment.

This rule ensures that all dependency changes are evaluated for risk at the time of introduction, and that the project remains clean and secure after each coding session. The scan may be performed at the end of an agent session, provided all modifications are checked and remediated before session completion.

​
Troubleshooting

Use the following troubleshooting steps to resolve common issues with the Endor Labs MCP server.
Run npx --version in your terminal. If the command fails, install Node.js version 18 or later. After installing, restart your IDE or CLI to reload the MCP server configuration.
Ensure your IDE or CLI can open a browser. Check firewall or security software that might block browser launch. For Enterprise Edition with SSO, verify that ENDOR_MCP_SERVER_AUTH_MODE and ENDOR_MCP_SERVER_AUTH_TENANT are set correctly in your MCP configuration.
Install endorctl globally and update your MCP config to call it directly instead of using npx. For more information, see Install endorctl.Replace the command and args entries with:
"command": "endorctl",
"args": ["ai-tools", "mcp-server"]
Verify your namespace is correct and your user has Read-Only permissions in Endor Labs. See Authorization policies for details. Also ensure endorctl is on your PATH if you installed it globally instead of using npx.
On Windows, ensure the following prerequisites are met:
  • Node.js is installed
  • npm global bin directory is in your PATH

​
Install Node.js

If Node.js is not installed, download and install the LTS version from nodejs.org. During installation, ensure the option to add Node.js to PATH is selected.

​
Configure the PATH environment variable

After installing Node.js, verify that the npm global bin directory is in your PATH:
  1. Run the following command in the command line. 
    npm config get prefix
    This returns the npm global directory path, typically C:\Users\<YourUsername>\AppData\Roaming\npm.
  2. Add the npm global directory path to the Path variable under User variables in your system’s environment variables settings.
  3. Restart for the PATH changes to take effect.

​
Verify the setup

Run the following command in your terminal.
npx --version
If this returns a version number, your Windows setup is complete and the MCP server can use npx to run endorctl.