Apviso MCP
About
MCP server for interacting with the APVISO AI-powered penetration testing platform from Claude Code, Cursor, Windsurf, Codex, and other MCP-compatible tools.
Details
- Author
- apviso
- Downloads
- 292
- Categories
- Other, AI, Developer Tools, Security
Jump to
- Manage targets (register, verify, delete)
- Launch penetration tests and monitor scan status
- List and update vulnerability findings
- Retrieve full pentest reports in markdown
- Configure recurring scan schedules (Business/Enterprise plans)
- Check account quota and billing period
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Apviso MCPCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Obtain an API key from your APVISO dashboard, then configure the server using Claude Code (claude mcp add) or by editing .mcp.json / ~/.claude.json with the required APVISO_API_KEY environment variable. The server runs via npx -y @apviso/mcp as a stdio transport.
get_quota
Get your current quota usage including subscription tier, credits remaining, and billing period dates. Use this to check available scan credits before starting a new scan.
list_targets
List all your registered targets (domains). Returns paginated results with verification status.
get_target
Get details for a specific target including domain, verification status, and whether authentication is configured.
create_target
Register a new target domain for scanning. The target must be verified before it can be scanned. After creating, use get_verification_instructions to see how to verify ownership.
verify_target
Verify ownership of a target using one of three methods: dns_txt (add a DNS TXT record), file (upload a verification file to /.well-known/penterep-verify.txt), or meta_tag (add a meta tag to your homepage). Use get_verification_instructions first to see the required values.
get_verification_instructions
Get the verification token and step-by-step instructions for all three verification methods (DNS TXT, file upload, meta tag) for a target.
delete_target
Delete a target. This will fail if the target has any associated scans.
list_scans
List your scans with optional filtering by status. Returns paginated results including scan status, target info, and timestamps.
get_scan
Get details for a specific scan including status, target, model preset, timestamps, and whether it's a retest. Use this to check scan progress.
create_scan
Start a new penetration test scan. IMPORTANT: This creates a billable scan that costs credits. The target must be verified first. Check quota with get_quota before starting. modelPreset controls depth: 'free' uses free credits, 'low' is fastest, 'ultra' is most thorough and expensive.
list_findings
List findings (vulnerabilities) for a specific scan. Results are paginated and descriptions are truncated — use get_report for full finding details. Filter by severity (critical/high/medium/low/info) or status (open/in_progress/fixed/accepted_risk/false_positive).
update_finding_status
Update the status of a finding. Use this to track remediation progress: open → in_progress → fixed, or mark as accepted_risk or false_positive.
get_report
Get the full penetration test report for a completed scan. Returns the report as markdown content with complete finding details, evidence, and remediation guidance. Also includes a PDF download URL if available. This is the best tool for getting comprehensive scan results.
list_schedules
List all your scan schedules. Schedules automatically run scans on a recurring basis (daily, weekly, biweekly, or monthly). Requires Business or Enterprise tier.
get_schedule
Get details for a specific scan schedule including frequency, next run time, and configuration.
create_schedule
Create a recurring scan schedule for a verified target. Requires Business or Enterprise tier. Scans will run automatically at the specified time and frequency.
update_schedule
Update an existing scan schedule. You can change the frequency, timing, model preset, or enable/disable it.
delete_schedule
Delete a scan schedule. This stops all future scheduled scans for this target.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"apviso mcp": {
"apviso": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@apviso/mcp"
],
"env": {
"APVISO_API_KEY": "apvk_your_key_here"
}
}
}
}
}McpServers
{
"apviso": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@apviso/mcp"
],
"env": {
"APVISO_API_KEY": "apvk_your_key_here"
}
}
}@apviso/mcp
MCP server for interacting with the APVISO AI-powered penetration testing platform from Claude Code, Cursor, Windsurf, Codex, and other MCP-compatible tools.
Setup
1. Get your API key
Go to your APVISO dashboard → Settings → API Keys and create a new key.
2. Add to Claude Code
claude mcp add --transport stdio apviso \
--env APVISO_API_KEY=apvk_your_key_here \
-- npx -y @apviso/mcp
On Windows (not WSL):
claude mcp add --transport stdio apviso ^
--env APVISO_API_KEY=apvk_your_key_here ^
-- cmd /c npx -y @apviso/mcp
Alternative: manual config
Add to your .mcp.json (project-scoped) or ~/.claude.json (user-scoped):
{
"mcpServers": {
"apviso": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@apviso/mcp"],
"env": {
"APVISO_API_KEY": "apvk_your_key_here"
}
}
}
}
For team projects, use environment variable expansion in .mcp.json so each developer uses their own key:
{
"mcpServers": {
"apviso": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@apviso/mcp"],
"env": {
"APVISO_API_KEY": "${APVISO_API_KEY}"
}
}
}
}
3. Verify
Run /mcp inside Claude Code to check the server status.
Configuration
| Variable | Required | Default | Description |
|----------|----------|---------|-------------|
| APVISO_API_KEY | Yes | — | Your API key (starts with apvk_) |
| APVISO_API_URL | No | https://apviso.com/api | API base URL |
Tools
Targets
| Tool | Description |
|------|-------------|
| list_targets | List all registered targets |
| get_target | Get target details |
| create_target | Register a new domain |
| verify_target | Verify domain ownership (DNS, file, or meta tag) |
| get_verification_instructions | Get verification steps for a target |
| delete_target | Remove a target |
Scans
| Tool | Description |
|------|-------------|
| list_scans | List scans with optional status filter |
| get_scan | Get scan details and status |
| create_scan | Start a new penetration test (costs credits) |
Findings
| Tool | Description |
|------|-------------|
| list_findings | List vulnerabilities for a scan |
| update_finding_status | Mark findings as fixed, accepted risk, etc. |
Reports
| Tool | Description |
|------|-------------|
| get_report | Get the full pentest report as markdown |
Schedules
| Tool | Description |
|------|-------------|
| list_schedules | List recurring scan schedules |
| get_schedule | Get schedule details |
| create_schedule | Set up recurring scans (Business/Enterprise) |
| update_schedule | Modify a schedule |
| delete_schedule | Remove a schedule |
Quota
| Tool | Description |
|------|-------------|
| get_quota | Check remaining credits and billing period |
License
MIT
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
