# Bright MCP
> Bright's hosted MCP server lets AI clients inspect Bright projects, entrypoints, discoveries, scans, and findings, and run scans or discoveries when the API key permits.
Canonical: https://www.mcpfolio.com/servers/bright-security
Last updated: 2026-10-28
## Catalog record

- Publisher: Bright Security
- Categories: web-scraping

## Website

https://www.brightsec.com/

## Transports

Streamable HTTP; hostname may vary by account cluster

## Authentication

Bright API key in `Authorization: Api-Key <key>`. Use the client's secure secret input. Create a dedicated key with least-privilege scopes; `projects:read` is required to run scans and operations need corresponding scopes.

## Tools

- **runScan**: Start a security scan against entrypoints. Supports targeting by specific `entrypointIds` or by `entrypointStatuses` (e.g., `["new", "changed", "vulnerable"]`). For test configuration, provide either `tests` or `templateId`. For private/local targets, specify a connected repeater via `repeaters`.
- **getScanStatus**: Get the current status of a scan run.
- **stopScan**: Stop a running scan. Only succeeds when the scan is in a stoppable state.
- **listScans**: List scans for a project.
- **getScanLogs**: Get engine logs for a scan with optional severity, search, and cursor filters.
- **getScanWarnings**: Get scan errors and warnings with mitigation details when available.
- **listScanVulnerabilities**: List security vulnerabilities found during a specific scan with filters and pagination.
- **getScanVulnerability**: Get detailed information about a specific vulnerability found during a scan, including additional API detail fields when available.
- **listScanEntrypoints**: List entrypoints observed during a specific scan.
- **getScanEntrypoint**: Get detailed request/response data for a scan entrypoint.
- **runDiscovery**: Discover API endpoints using crawling (`crawlerUrls`) or API definitions (`fileId` from `uploadApiDefinition`). For private/local targets, specify a connected repeater via `repeaters`.
- **getDiscoveryStatus**: Get the current status of a discovery run.
- **stopDiscovery**: Stop a running discovery. Only succeeds when the discovery is in a stoppable state.
- **listDiscoveries**: List discoveries for a project.
- **getDiscoveryLogs**: Get engine logs for a discovery with optional severity, search, and cursor filters.
- **getDiscoveryWarnings**: Get warnings recorded on a discovery run.
- **listDiscoveryEntrypoints**: List entrypoints observed during a specific discovery.
- **getDiscoveryEntrypoint**: Get detailed request/response data for a discovery entrypoint.
- **uploadApiDefinition**: Upload an API definition file (OpenAPI/Swagger) by URL or content. Returns a file ID to reference in discovery runs.
- **listEntrypoints**: List discovered API endpoints/URLs for a project.
- **getEntrypoint**: Get detailed information about a specific entrypoint by ID, including headers, body, and configuration.
- **addEntrypoint**: Add a new entrypoint to a project. Entrypoints define HTTP requests that can be used for security scanning.
- **editEntrypoint**: Update an existing entrypoint in a project.
- **deleteEntrypoint**: Delete an entrypoint from a project. This operation cannot be undone.
- **listVulnerabilities**: List security vulnerabilities found for a project.
- **listAuths**: List authentication configurations for a project.
- **getAuth**: Get a single authentication configuration by ID.
- **addAuth**: Create a new authentication configuration (auth object).
- **editAuth**: Update an existing authentication configuration.
- **deleteAuth**: Delete an authentication configuration. This operation cannot be undone.
- **testAuth**: Run an authentication test and return a verification verdict with per-result evidence.
- **listProjects**: List all projects available to the API key.
- **listTests**: List available security tests (e.g., SQL injection, XSS) that can be run in scans.
- **createRepeater**: Create a repeater for accessing private/local targets. The response includes arguments for starting the repeater with the Bright CLI.
- **deleteRepeater**: Delete a repeater. This operation cannot be undone.
- **listRepeaters**: List repeaters that route traffic to private/local targets.

## Sources

- [official_client_setup](https://docs.brightsec.com/docs/configure-in-vscode)
- [official_tool_reference](https://docs.brightsec.com/docs/bright-mcp-tools)
- [official_authentication_documentation](https://docs.brightsec.com/docs/personal-api-key-scopes)
- [official_limitations_documentation](https://docs.brightsec.com/docs/faqs)
- [official_current_complete_tool_reference](https://docs.brightsec.com/docs/bright-mcp-tools.md)

## Setup

Use the interactive setup panel on [the detail page](https://www.mcpfolio.com/servers/bright-security) to view instructions for each supported client.