> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oasm.dev/llms.txt
> Use this file to discover all available pages before exploring further.
# MCP Server
> Connect external AI applications to your OASM workspace data via the Model Context Protocol
The MCP Server allows external AI applications — such as Claude, Cursor, VS Code, and other MCP-compatible clients — to query and analyze your OASM workspace data using natural language.
By exposing your workspace through the **Model Context Protocol (MCP)**, AI tools can directly access assets, vulnerabilities, targets, and other security data without additional integration work.
## How it works
The OASM MCP Server implements the [Model Context Protocol](https://modelcontextprotocol.io), a standardised protocol that lets AI applications discover and interact with tools and data sources. Once configured with an API key, any MCP-compatible client can connect to your workspace and query your attack surface data.
The server is available at a URL and authenticates with your workspace API key:
* **MCP** stands for **Model Context Protocol** — the server exposes your workspace data to AI assistants as structured, discoverable tools.
* **Authentication** is handled by your workspace API key.
* **MCP guard** — every incoming request is checked before it runs, so only safe, recognised operations reach your workspace data.
The same workspace data is also available to the built-in [Chat Agent](/chat-agent), which can use MCP configs to reach additional data sources. See [Integrations](/integrations) for how MCP fits into the wider OASM ecosystem.
## Configure MCP clients
Below are configuration examples for popular MCP-compatible applications.
The configuration shown on the console page (**Settings → MCP Connect**) uses the dev console origin:
```json theme={null}
{
"mcpServers": {
"oasm-platform": {
"url": "http://localhost:5173/api/mcp",
"headers": {
"x-oasm-api-key": "YOUR_API_KEY"
}
}
}
}
```
```json theme={null}
{
"github.copilot.mcpServers": {
"oasm-platform": {
"url": "http://localhost:5173/api/mcp",
"headers": {
"x-oasm-api-key": "YOUR_API_KEY"
}
}
}
}
```
```json theme={null}
{
"mcpServers": {
"oasm-platform": {
"url": "http://localhost:5173/api/mcp",
"headers": {
"x-oasm-api-key": "YOUR_API_KEY"
}
}
}
}
```
The example uses the **dev console origin** (`http://localhost:5173`). Adjust the origin to match your deployment:
* **Docker deployments**: replace the origin with your console origin, e.g. `http://localhost:6276`.
* **Production**: use your real host, e.g. `https://asm.example.com`.
The `YOUR_API_KEY` value comes from **Settings → API keys** in the console — see [API keys](/api-keys).
### Claude Desktop
Add the configuration block from the code group above to your Claude Desktop configuration file, replacing the origin and API key with your own.
### VS Code (GitHub Copilot)
Add the configuration block to your VS Code settings file, replacing the origin and API key with your own.
### Cursor
Add the configuration block to your Cursor MCP configuration, replacing the origin and API key with your own.
### Other MCP-compatible clients
Any MCP-compatible client can connect using the same configuration pattern — set the server URL and provide your API key.
## Available tools
Once connected, the MCP server exposes the following tools for AI applications:
| Capability | What the AI can do |
| --------------------------- | ------------------------------------------------------------------------------------------------------------ |
| List assets | See the discovered assets in your workspace, such as domains, IP addresses, and web pages |
| Find vulnerabilities | See security vulnerabilities and their severity |
| Show scan targets | Review the domains and IP ranges currently being scanned |
| View dashboard statistics | Get a summary of your attack surface: asset and vulnerability counts, severity breakdown, and security score |
| Inspect an asset | Get full technical details of a single asset |
| List a target's assets | See the assets discovered for a specific scan target |
| Investigate a vulnerability | Get the full vulnerability report, including severity, proof of concept, and remediation steps |
| List open ports | See which network ports are open and how many assets use each |
| List technologies | See the software, frameworks, and servers detected in your environment |
| Check TLS certificates | See the SSL/TLS certificates in your environment, with their issuer, subject, and expiry date |
| Read a web page | Fetch and read a public web page |
| List security issues | See security issues and whether each is open or closed |
| Inspect an issue | Get full details of a single security issue |
| List workers | See which worker nodes are connected |
| Review jobs | See background scan jobs and their status |
Issues use the same statuses as on the [Issue](/issue) page: an issue is either open or closed.
## Example queries
Once configured, you can ask your AI assistant questions like:
* "What assets do we have in our production environment?"
* "Show me all critical vulnerabilities discovered this week"
* "How many open ports are on target example.com?"
* "Summarise the latest scan results across all targets"
* "List all assets running nginx"
* "What's the risk level of vulnerability CVE-2024-XXXX?"
## Security
The API key used for MCP configuration grants access to your workspace data. Treat it with the same care as any credential:
* **Never** commit your API key to version control
* **Never** share your API key in messages, emails, or public channels
* Use environment variables or secret management tools to store keys
* Rotate keys regularly and revoke unused ones
* Scope API keys with the minimum permissions required
Every request is authenticated with your workspace API key, and the MCP guard checks each operation before it runs.
## Troubleshooting
### Connection refused
Ensure the MCP server URL is correct and your network can reach your OASM instance. If you're using a self-hosted instance, replace the URL with your instance's MCP endpoint — for Docker deployments that is your console origin (e.g. `http://localhost:6276`), and in production your real host.
### Authentication error
Verify that the API key in your MCP configuration is correct and has not been rotated or revoked. Generate a new key from **Settings → API keys** in the OASM Console if needed — see [API keys](/api-keys).
### No tools found
Some MCP clients require a restart after configuration changes. Try restarting your AI application after updating the MCP server configuration.
## Related resources
Manage the workspace API key used to authenticate MCP clients
Use the built-in chat agent, which can also consume MCP configs
See how the MCP server fits into the wider OASM ecosystem