Tools reference

All 5 tools exposed by the MCP server. Each maps to a /api/v1/* HTTP route.

scan_target

Tier required: Free+

Start a security scan against a public URL.

Parameters

• url (required) — string, the public URL to scan.
• wait_for_completion (optional) — boolean, default false. If true, blocks up to 60s for completion.
• modules (optional) — array of module IDs (subset of 20).

get_scan_status

Tier required: Free+

Poll the status of a scan.

Parameters

• scan_id (required) — UUID.

list_findings

Tier required: Free+ (own scans only)

List findings for a scan as a markdown table.

Parameters

• scan_id (required) — UUID.
• severity (optional) — one of critical | high | medium | low | info.
• limit (optional) — 1-100, default 20.

propose_fix

Tier required: Pro+

Generate an AI code fix for a specific finding.

Parameters

• finding_id (required) — UUID.

Returns the fix code, an explanation, and a confidence score. Cached by evidence_hash — second call is instant.

apply_fix

Tier required: Business+

Mark a fix as applied and re-run the affected module to verify the vulnerability is gone.

Parameters

• finding_id (required) — UUID.

Returns retest_status: fixed | still_vulnerable | new_finding | inconclusive.