BLOGCritical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)
MCP Server

Talk to Detectify from your AI tools

Connect Claude Code, Cursor, and other AI tools to Detectify, and ask about your findings, scans, and assets in plain language.

Book a demoStart a trial

Where MCP Server fits

Every product runs on the same Discovery layer. The MCP Server gives your AI tools read-only access to it, so you can ask about findings, scans and assets from every product.

Discovery

The system of record for your attack surface. Every asset flows through Discovery, so assessments read from it and findings feed back into it.

Asset inventoryEvery domain, IP, and app you own
Classification & recommendationsAuto-tag assets and recommend actions
IntegrationsJira, Slack, Splunk, AWS Route53, GCP and more
You are hereAPI & MCP accessProgrammatic & AI-agent hooks
Custom policiesRules tuned to your environment
+And morePermissions, audit history, and more
+
Surface

Surface Monitoring

External domains and IPs
Application

Application Scanning

Custom applications
API

API Scanning

REST and GraphQL
Internal

Internal Scanning

Staging and internal apps
Compliance

PCI ASV Scanning

PCI-scope domains and IPs
AI · Agentic

Agentic Tooling

AI coding agent testing
New

How MCP Server works

Add one URL to your AI tool

The MCP Server is hosted by Detectify, so there's nothing to install or run. Add the server URL to your AI tool, sign in once, and start asking. The setup steps for each tool are in our documentation.

  • Hosted by Detectify, nothing to install
  • Claude Code, Codex, Copilot CLI, Cursor, OpenCode, VS Code and Dust
  • Setup steps for each tool in the documentation

Sign in once, then just ask

The first time your AI tool connects, you sign in to Detectify with OAuth, using your password, Google or SSO. After that, it works in the background.

  • OAuth 2.1 sign-in on first use
  • Password, Google or SSO
  • No API keys to paste into your AI tool

Ask about findings, scans, reports and assets

The MCP Server gives your AI tool a curated set of Detectify tools, not open access to the API. Ask about findings, scans, reports and the status of your assets in plain language, and your AI tool answers from your Detectify data.

  • Findings, scans, reports and asset status
  • A curated set of tools that we choose and review
  • Read-only, so your AI tool can't change anything in Detectify

The same authorization as the web app

Every request goes through the same authorization as the Detectify web app. Each tool call is logged and attributed to a user and team, and the MCP Server passes your data through without storing it.

  • Same authorization as the Detectify web app
  • Every tool call logged to a user and team
  • Your Detectify data isn't stored by the MCP Server

Where security teams put MCP Server to work

Developers

Check findings without leaving your editor

Ask which findings are open on the domain you're working on, or whether the latest scan has finished, from the AI tool you already code in.

FindingsScan statusIn your editor

AppSec engineers

Triage in a conversation

Pull this month's high-severity findings, or a summary for one domain, and share it with the team without opening the dashboard.

TriageSummariesSharing

Security teams

Build your own security automations

Give the internal agents and automations your team builds a standard way to read Detectify data, instead of writing a custom API integration.

Internal agentsAutomationsStandard MCP
There aren't enough hours in the day to manually look at vulnerabilities, so automation is the only way. There’s no reason to waste human energy on it.
Marcin HoppeSenior Engineering Manager, Auth0
Read case study

FAQs

01What can the MCP Server do?

It gives your AI tool a curated set of read-only Detectify tools for findings, scans, reports and asset status, so you can ask about your Detectify data in plain language. It can't change anything in Detectify.

Claude Code, Codex, Copilot CLI, Cursor, OpenCode, VS Code and Dust, plus the Detectify Claude Code marketplace. The setup steps for each are in the documentation.

Add the MCP Server URL to your AI tool. The first time it connects, you sign in to Detectify with OAuth, using your password, Google or SSO. A team admin turns it on for your team in the Detectify app first.

Only the tools we've chosen for the MCP Server, not the whole API. Every request goes through the same authorization as the Detectify web app.

No. It passes data between Detectify and your AI tool without storing it. Each tool call is logged with who made it, which tool, and the outcome. What your AI tool does with the answers depends on the tool and its provider.

No. All the tools are read-only, so your AI tool can look at findings, scans, reports and assets but can't change settings, start scans or edit data.

The API is for integrations you build and maintain yourself. The MCP Server gives AI tools a ready-made set of tools and an OAuth sign-in, so you don't need to write an integration.

It's included in every Detectify plan at no extra charge.

Every product builds on Discovery

See the full platform
AI · Agentic

Agentic Tooling

Payload-based testing that AI coding agents can call directly, so what they ship gets tested against your live attack surface.

Learn more about Agentic Tooling
DAST · APIs

API Scanning

Payload-based testing for REST and GraphQL APIs, driven by your OpenAPI spec or GraphQL schema, including prompt injection on AI endpoints.

Learn more about API Scanning
AI · Engine

Alfred AI

Turns newly disclosed CVEs into payload-based tests, and a Detectify security researcher reviews every one before it goes live.

Learn more about Alfred AI

Connect your AI tools to Detectify

Included in every plan. Sign in once and start asking about your findings, scans and assets.

Book a demoStart a trial