MCP Server

The MCP Server allows external AI applications — such as Claude, Cursor, VS Code, and other MCP-compatible clients — to query and analyze your OASM workspace data using natural language. By exposing your workspace through the Model Context Protocol (MCP), AI tools can directly access assets, vulnerabilities, targets, and other security data without additional integration work.

How it works

The OASM MCP Server implements the Model Context Protocol, a standardised protocol that lets AI applications discover and interact with tools and data sources. Once configured with an API key, any MCP-compatible client can connect to your workspace and query your attack surface data. The server is available at a URL and authenticates with your workspace API key:

MCP stands for Model Context Protocol — the server exposes your workspace data to AI assistants as structured, discoverable tools.
Authentication is handled by your workspace API key.
MCP guard — every incoming request is checked before it runs, so only safe, recognised operations reach your workspace data.

The same workspace data is also available to the built-in Chat Agent, which can use MCP configs to reach additional data sources. See Integrations for how MCP fits into the wider OASM ecosystem.

Configure MCP clients

Below are configuration examples for popular MCP-compatible applications. The configuration shown on the console page (Settings → MCP Connect) uses the dev console origin:

{
  "mcpServers": {
    "oasm-platform": {
      "url": "http://localhost:5173/api/mcp",
      "headers": {
        "x-oasm-api-key": "YOUR_API_KEY"
      }
    }
  }
}

{
  "github.copilot.mcpServers": {
    "oasm-platform": {
      "url": "http://localhost:5173/api/mcp",
      "headers": {
        "x-oasm-api-key": "YOUR_API_KEY"
      }
    }
  }
}

{
  "mcpServers": {
    "oasm-platform": {
      "url": "http://localhost:5173/api/mcp",
      "headers": {
        "x-oasm-api-key": "YOUR_API_KEY"
      }
    }
  }
}

The example uses the dev console origin (http://localhost:5173). Adjust the origin to match your deployment:

Docker deployments: replace the origin with your console origin, e.g. http://localhost:6276.
Production: use your real host, e.g. https://asm.example.com.

The YOUR_API_KEY value comes from Settings → API keys in the console — see API keys.

Claude Desktop

Add the configuration block from the code group above to your Claude Desktop configuration file, replacing the origin and API key with your own.

VS Code (GitHub Copilot)

Add the configuration block to your VS Code settings file, replacing the origin and API key with your own.

Cursor

Add the configuration block to your Cursor MCP configuration, replacing the origin and API key with your own.

Other MCP-compatible clients

Any MCP-compatible client can connect using the same configuration pattern — set the server URL and provide your API key.

Available tools

Once connected, the MCP server exposes the following tools for AI applications:

Capability	What the AI can do
List assets	See the discovered assets in your workspace, such as domains, IP addresses, and web pages
Find vulnerabilities	See security vulnerabilities and their severity
Show scan targets	Review the domains and IP ranges currently being scanned
View dashboard statistics	Get a summary of your attack surface: asset and vulnerability counts, severity breakdown, and security score
Inspect an asset	Get full technical details of a single asset
List a target’s assets	See the assets discovered for a specific scan target
Investigate a vulnerability	Get the full vulnerability report, including severity, proof of concept, and remediation steps
List open ports	See which network ports are open and how many assets use each
List technologies	See the software, frameworks, and servers detected in your environment
Check TLS certificates	See the SSL/TLS certificates in your environment, with their issuer, subject, and expiry date
Read a web page	Fetch and read a public web page
List security issues	See security issues and whether each is open or closed
Inspect an issue	Get full details of a single security issue
List workers	See which worker nodes are connected
Review jobs	See background scan jobs and their status

Issues use the same statuses as on the Issue page: an issue is either open or closed.

Example queries

Once configured, you can ask your AI assistant questions like:

“What assets do we have in our production environment?”
“Show me all critical vulnerabilities discovered this week”
“How many open ports are on target example.com?”
“Summarise the latest scan results across all targets”
“List all assets running nginx”
“What’s the risk level of vulnerability CVE-2024-XXXX?”

Security

The API key used for MCP configuration grants access to your workspace data. Treat it with the same care as any credential:

Never commit your API key to version control
Never share your API key in messages, emails, or public channels
Use environment variables or secret management tools to store keys
Rotate keys regularly and revoke unused ones
Scope API keys with the minimum permissions required

Every request is authenticated with your workspace API key, and the MCP guard checks each operation before it runs.

Troubleshooting

Connection refused

Ensure the MCP server URL is correct and your network can reach your OASM instance. If you’re using a self-hosted instance, replace the URL with your instance’s MCP endpoint — for Docker deployments that is your console origin (e.g. http://localhost:6276), and in production your real host.

Authentication error

Verify that the API key in your MCP configuration is correct and has not been rotated or revoked. Generate a new key from Settings → API keys in the OASM Console if needed — see API keys.

No tools found

Some MCP clients require a restart after configuration changes. Try restarting your AI application after updating the MCP server configuration.

API keys

Manage the workspace API key used to authenticate MCP clients

Chat Agent

Use the built-in chat agent, which can also consume MCP configs

Integrations

See how the MCP server fits into the wider OASM ecosystem

Getting started

Attack surface

Monitoring & analytics

Automation

AI & integrations

Management

Deployment & operations

How it works

Configure MCP clients

Claude Desktop

VS Code (GitHub Copilot)

Cursor

Other MCP-compatible clients

Available tools

Example queries

Security

Troubleshooting

Connection refused

Authentication error

No tools found

API keys

Chat Agent

Integrations

​How it works

​Configure MCP clients

​Claude Desktop

​VS Code (GitHub Copilot)

​Cursor

​Other MCP-compatible clients

​Available tools

​Example queries

​Security

​Troubleshooting

​Connection refused

​Authentication error

​No tools found

​Related resources

API keys

Chat Agent

Integrations

How it works

Configure MCP clients

Claude Desktop

VS Code (GitHub Copilot)

Cursor

Other MCP-compatible clients

Available tools

Example queries

Security

Troubleshooting

Connection refused

Authentication error

No tools found

Related resources