> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oasm.io/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP Server

> Connect external AI applications to your OASM workspace data via the Model Context Protocol

The MCP Server allows external AI applications — such as Claude, Cursor, VS Code, and other MCP-compatible clients — to query and analyze your OASM workspace data using natural language.

By exposing your workspace through the **Model Context Protocol (MCP)**, AI tools can directly access assets, vulnerabilities, targets, and other security data without additional integration work.

## How it works

The OASM MCP Server implements the [Model Context Protocol](https://modelcontextprotocol.io), a standardised protocol that lets AI applications discover and interact with tools and data sources. Once configured with an API key, any MCP-compatible client can connect to your workspace and query your attack surface data.

The server is available at a URL and authenticates with your workspace API key:

* **MCP** stands for **Model Context Protocol** — the server exposes your workspace data to AI assistants as structured, discoverable tools.
* **Authentication** is handled by your workspace API key.
* **MCP guard** — every incoming request is checked before it runs, so only safe, recognised operations reach your workspace data.

The same workspace data is also available to the built-in [Chat Agent](/chat-agent), which can use MCP configs to reach additional data sources. See [Integrations](/integrations/overview) for how MCP fits into the wider OASM ecosystem.

## Configure MCP clients

Below are configuration examples for popular MCP-compatible applications.

The configuration shown on the console page (**Settings → MCP Connect**) uses the dev console origin:

**Claude Desktop**

```json theme={null}
{
  "mcpServers": {
    "oasm-platform": {
      "url": "http://localhost:5173/api/mcp",
      "headers": {
        "x-oasm-api-key": "YOUR_API_KEY"
      }
    }
  }
}
```

**VS Code (GitHub Copilot)**

```json theme={null}
{
  "github.copilot.mcpServers": {
    "oasm-platform": {
      "url": "http://localhost:5173/api/mcp",
      "headers": {
        "x-oasm-api-key": "YOUR_API_KEY"
      }
    }
  }
}
```

**Cursor**

```json theme={null}
{
  "mcpServers": {
    "oasm-platform": {
      "url": "http://localhost:5173/api/mcp",
      "headers": {
        "x-oasm-api-key": "YOUR_API_KEY"
      }
    }
  }
}
```

> [!NOTE]
>
> The example uses the **dev console origin** (`http://localhost:5173`). Adjust the origin to match your deployment:
>
> * **Docker deployments**: replace the origin with your console origin, e.g. `http://localhost:6276`.
> * **Production**: use your real host, e.g. `https://asm.example.com`.
>
> The `YOUR_API_KEY` value comes from **Settings → API keys** in the console — see [API keys](/api-keys).

### Claude Desktop

Add the configuration block from the code group above to your Claude Desktop configuration file, replacing the origin and API key with your own.

### VS Code (GitHub Copilot)

Add the configuration block to your VS Code settings file, replacing the origin and API key with your own.

### Cursor

Add the configuration block to your Cursor MCP configuration, replacing the origin and API key with your own.

### Other MCP-compatible clients

Any MCP-compatible client can connect using the same configuration pattern — set the server URL and provide your API key.

## Available tools

Once connected, the MCP server exposes the following tools for AI applications:

| Capability | What the AI can do |
| - | - |
| List assets | See the discovered assets in your workspace, such as domains, IP addresses, and web pages |
| Find vulnerabilities | See security vulnerabilities and their severity |
| Show scan targets | Review the domains and IP ranges currently being scanned |
| View dashboard statistics | Get a summary of your attack surface: asset and vulnerability counts, severity breakdown, and security score |
| Inspect an asset | Get full technical details of a single asset |
| List a target's assets | See the assets discovered for a specific scan target |
| Investigate a vulnerability | Get the full vulnerability report, including severity, proof of concept, and remediation steps |
| List open ports | See which network ports are open and how many assets use each |
| List technologies | See the software, frameworks, and servers detected in your environment |
| Check TLS certificates | See the SSL/TLS certificates in your environment, with their issuer, subject, and expiry date |
| Read a web page | Fetch and read a public web page |
| List security issues | See security issues and whether each is open or closed |
| Inspect an issue | Get full details of a single security issue |
| List workers | See which worker nodes are connected |
| Review jobs | See background scan jobs and their status |

> [!NOTE]
>
> Issues use the same statuses as on the [Issue](/issue) page: an issue is either open or closed.

## Example queries

Once configured, you can ask your AI assistant questions like:

* "What assets do we have in our production environment?"
* "Show me all critical vulnerabilities discovered this week"
* "How many open ports are on target example.com?"
* "Summarise the latest scan results across all targets"
* "List all assets running nginx"
* "What's the risk level of vulnerability CVE-2024-XXXX?"

## Security

> [!CAUTION]
>
> The API key used for MCP configuration grants access to your workspace data. Treat it with the same care as any credential:

* **Never** commit your API key to version control
* **Never** share your API key in messages, emails, or public channels
* Use environment variables or secret management tools to store keys
* Rotate keys regularly and revoke unused ones
* Scope API keys with the minimum permissions required

Every request is authenticated with your workspace API key, and the MCP guard checks each operation before it runs.

## Troubleshooting

### Connection refused

Ensure the MCP server URL is correct and your network can reach your OASM instance. If you're using a self-hosted instance, replace the URL with your instance's MCP endpoint — for Docker deployments that is your console origin (e.g. `http://localhost:6276`), and in production your real host.

### Authentication error

Verify that the API key in your MCP configuration is correct and has not been rotated or revoked. Generate a new key from **Settings → API keys** in the OASM Console if needed — see [API keys](/api-keys).

### No tools found

Some MCP clients require a restart after configuration changes. Try restarting your AI application after updating the MCP server configuration.

## Related resources

> **[API keys](/api-keys)**
>
> Manage the workspace API key used to authenticate MCP clients

> **[Chat Agent](/chat-agent)**
>
> Use the built-in chat agent, which can also consume MCP configs

> **[Integrations](/integrations/overview)**
>
> See how the MCP server fits into the wider OASM ecosystem


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.