Hosting

Remote hosted

Transport

Streamable HTTP; hostname may vary by account cluster

Endpoint

https://app.brightsec.com/mcp

Authentication

Bright API key in `Authorization: Api-Key <key>`. Use the client's secure secret input. Create a dedicated key with least-privilege scopes; `projects:read` is required to run scans and operations need corresponding scopes.

Requirements

• Bright account with access to a project
• Bright personal, project, or organization API key with required scopes
• Use cluster-specific hostname if not on app.brightsec.com
• Only scan systems owned or explicitly authorized; interactive workflow is intended for development/staging, not production

Setup steps

1. Add HTTP MCP server at https://app.brightsec.com/mcp; adjust hostname for the Bright cluster if necessary.
2. Set `Authorization` header to `Api-Key ${input:apiKey}` through secure client input and supply the key there.
3. Create a dedicated least-privilege API key with only scopes needed for intended actions.
4. Start the server and verify with a harmless read such as listing projects; do not start a scan as a setup test.

Current Bright Security reference enumerates 36 exact tools across scans, discovery, entrypoints, vulnerabilities, authentication configs, project/test listing and repeaters. Several start/stop scans, alter or delete entrypoints/auth/repeaters; use the project API key scopes and user authorization deliberately.

• runScan

  Start a security scan against entrypoints. Supports targeting by specific `entrypointIds` or by `entrypointStatuses` (e.g., `["new", "changed", "vulnerable"]`). For test configuration, provide either `tests` or `templateId`. For private/local targets, specify a connected repeater via `repeaters`.

  01
• getScanStatus

  Get the current status of a scan run.

  02
• stopScan

  Stop a running scan. Only succeeds when the scan is in a stoppable state.

  03
• listScans

  List scans for a project.

  04
• getScanLogs

  Get engine logs for a scan with optional severity, search, and cursor filters.

  05
• getScanWarnings

  Get scan errors and warnings with mitigation details when available.

  06
• listScanVulnerabilities

  List security vulnerabilities found during a specific scan with filters and pagination.

  07
• getScanVulnerability

  Get detailed information about a specific vulnerability found during a scan, including additional API detail fields when available.

  08
• listScanEntrypoints

  List entrypoints observed during a specific scan.

  09
• getScanEntrypoint

  Get detailed request/response data for a scan entrypoint.

  10
• runDiscovery

  Discover API endpoints using crawling (`crawlerUrls`) or API definitions (`fileId` from `uploadApiDefinition`). For private/local targets, specify a connected repeater via `repeaters`.

  11
• getDiscoveryStatus

  Get the current status of a discovery run.

  12
• stopDiscovery

  Stop a running discovery. Only succeeds when the discovery is in a stoppable state.

  13
• listDiscoveries

  List discoveries for a project.

  14
• getDiscoveryLogs

  Get engine logs for a discovery with optional severity, search, and cursor filters.

  15
• getDiscoveryWarnings

  Get warnings recorded on a discovery run.

  16
• listDiscoveryEntrypoints

  List entrypoints observed during a specific discovery.

  17
• getDiscoveryEntrypoint

  Get detailed request/response data for a discovery entrypoint.

  18
• uploadApiDefinition

  Upload an API definition file (OpenAPI/Swagger) by URL or content. Returns a file ID to reference in discovery runs.

  19
• listEntrypoints

  List discovered API endpoints/URLs for a project.

  20
• getEntrypoint

  Get detailed information about a specific entrypoint by ID, including headers, body, and configuration.

  21
• addEntrypoint

  Add a new entrypoint to a project. Entrypoints define HTTP requests that can be used for security scanning.

  22
• editEntrypoint

  Update an existing entrypoint in a project.

  23
• deleteEntrypoint

  Delete an entrypoint from a project. This operation cannot be undone.

  24
• listVulnerabilities

  List security vulnerabilities found for a project.

  25
• listAuths

  List authentication configurations for a project.

  26
• getAuth

  Get a single authentication configuration by ID.

  27
• addAuth

  Create a new authentication configuration (auth object).

  28
• editAuth

  Update an existing authentication configuration.

  29
• deleteAuth

  Delete an authentication configuration. This operation cannot be undone.

  30
• testAuth

  Run an authentication test and return a verification verdict with per-result evidence.

  31
• listProjects

  List all projects available to the API key.

  32
• listTests

  List available security tests (e.g., SQL injection, XSS) that can be run in scans.

  33
• createRepeater

  Create a repeater for accessing private/local targets. The response includes arguments for starting the repeater with the Bright CLI.

  34
• deleteRepeater

  Delete a repeater. This operation cannot be undone.

  35
• listRepeaters

  List repeaters that route traffic to private/local targets.

  36

• Scans/discoveries send active requests; run only against owned or explicitly authorized systems.
• Bright positions interactive use for development/staging, not production.
• Coverage depends on reachable endpoints, authentication, selected tests, and target behavior.
• Tools can create, edit, stop, or delete external resources; deleting entrypoints, auth configs, or repeaters is irreversible.
• Official tool reference gives names and summaries, not full JSON input/output schemas.

• official client setup

  No evidence summary is recorded for this source.

• official tool reference

  Official tool reference lists the complete set of 36 named tools and summaries.

• official authentication documentation

  Bright documents key scope permissions including project, scan, discovery, entrypoint, auth, and repeater access.

• official limitations documentation

  Bright FAQ states authorized-target requirement, collected scan data, and development/staging use.

• official current complete tool reference

  Current vendor table documents all 36 exact tool names and operation descriptions, including destructive actions and private-target repeater support.

Documentation checked 2026-10-28T00:00:00Z. Connection has not been runtime tested.