Apviso MCP
@apviso
About Apviso MCP
MCP server for interacting with the APVISO AI-powered penetration testing platform from Claude Code, Cursor, Windsurf, Codex, and other MCP-compatible tools.
Config
Add this server to your MCP-compatible client using the configuration below.
{
"mcpServers": {
"apviso": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@apviso/mcp"
],
"env": {
"APVISO_API_KEY": "apvk_your_key_here"
}
}
}
}Tools
18Get your current quota usage including subscription tier, credits remaining, and billing period dates. Use this to check available scan credits before starting a new scan.
List all your registered targets (domains). Returns paginated results with verification status.
Get details for a specific target including domain, verification status, and whether authentication is configured.
Register a new target domain for scanning. The target must be verified before it can be scanned. After creating, use get_verification_instructions to see how to verify ownership.
Verify ownership of a target using one of three methods: dns_txt (add a DNS TXT record), file (upload a verification file to /.well-known/penterep-verify.txt), or meta_tag (add a meta tag to your homepage). Use get_verification_instructions first to see the required values.
Get the verification token and step-by-step instructions for all three verification methods (DNS TXT, file upload, meta tag) for a target.
Delete a target. This will fail if the target has any associated scans.
List your scans with optional filtering by status. Returns paginated results including scan status, target info, and timestamps.
Get details for a specific scan including status, target, model preset, timestamps, and whether it's a retest. Use this to check scan progress.
Start a new penetration test scan. IMPORTANT: This creates a billable scan that costs credits. The target must be verified first. Check quota with get_quota before starting. modelPreset controls depth: 'free' uses free credits, 'low' is fastest, 'ultra' is most thorough and expensive.
List findings (vulnerabilities) for a specific scan. Results are paginated and descriptions are truncated — use get_report for full finding details. Filter by severity (critical/high/medium/low/info) or status (open/in_progress/fixed/accepted_risk/false_positive).
Update the status of a finding. Use this to track remediation progress: open → in_progress → fixed, or mark as accepted_risk or false_positive.
Get the full penetration test report for a completed scan. Returns the report as markdown content with complete finding details, evidence, and remediation guidance. Also includes a PDF download URL if available. This is the best tool for getting comprehensive scan results.
List all your scan schedules. Schedules automatically run scans on a recurring basis (daily, weekly, biweekly, or monthly). Requires Business or Enterprise tier.
Get details for a specific scan schedule including frequency, next run time, and configuration.
Create a recurring scan schedule for a verified target. Requires Business or Enterprise tier. Scans will run automatically at the specified time and frequency.
Update an existing scan schedule. You can change the frequency, timing, model preset, or enable/disable it.
Delete a scan schedule. This stops all future scheduled scans for this target.
Overview
What is Apviso MCP?
Apviso MCP is a Model Context Protocol server that connects AI coding assistants (Claude Code, Cursor, Windsurf, Codex) to the APVISO AI-powered penetration testing platform. It enables developers to register targets, launch scans, view findings, and manage security testing directly from their IDE.
How to use Apviso MCP?
Obtain an API key from your APVISO dashboard, then configure the server using Claude Code (claude mcp add) or by editing .mcp.json / ~/.claude.json with the required APVISO_API_KEY environment variable. The server runs via npx -y @apviso/mcp as a stdio transport.
Key features of Apviso MCP
- Manage targets (register, verify, delete)
- Launch penetration tests and monitor scan status
- List and update vulnerability findings
- Retrieve full pentest reports in markdown
- Configure recurring scan schedules (Business/Enterprise plans)
- Check account quota and billing period
Use cases of Apviso MCP
- Register a new domain and verify ownership before scanning
- Start a penetration test on a target and track its progress
- Review and triage discovered vulnerabilities directly from your assistant
- Set up automated recurring security scans for continuous testing
- Integrate security testing into development workflows without changing tools
FAQ from Apviso MCP
What transport does Apviso MCP use?
The server uses the stdio transport.
What environment variable is required?
APVISO_API_KEY is required; it must be an API key starting with apvk_.
How can I verify the server is running?
Inside Claude Code, run /mcp to check the server status.
Is it possible to use a different API URL?
Yes, set the optional APVISO_API_URL environment variable; it defaults to https://apviso.com/api.
Can I run Apviso MCP without Claude Code?
Yes, you can configure it in any MCP-compatible client by setting the command and environment variables as shown in the manual config section.
Frequently asked questions
What transport does Apviso MCP use?
The server uses the `stdio` transport.
What environment variable is required?
`APVISO_API_KEY` is required; it must be an API key starting with `apvk_`.
How can I verify the server is running?
Inside Claude Code, run `/mcp` to check the server status.
Is it possible to use a different API URL?
Yes, set the optional `APVISO_API_URL` environment variable; it defaults to `https://apviso.com/api`.
Can I run Apviso MCP without Claude Code?
Yes, you can configure it in any MCP-compatible client by setting the command and environment variables as shown in the manual config section.
Basic information
More Developer Tools MCP servers

discoverGPT
Joe MonastierodiscoverGPT is visualAI's unified MCP gateway for AI commerce, exposing 29 tools across four capabilities on one canonical product catalog: trimodal search (natural-language, precise-color, and image-similarity), AI cata

Skilder.ai
skilder.aiRun skills and MCP tools like production software: versioned, composed into roles, distributed to every agent from one governed library.

Air Pipe
airpipeBuild, validate, deploy — HTTP APIs, cron jobs, webhooks and MCP tools — from your AI client.
SecondSim
econdSim provisions real UK mobile numbers (non-VoIP) via eSIM, built for freelancers, sole traders, small businesses, and enterprise teams. Unlike VoIP apps and virtual numbers, SecondSim numbers register as genuine phy

directree
coburn2716directree MCP server — query the honest software directory from any AI assistant
Comments