Onsecurity

This MCP server lets you query the OnSecurity API for rounds, findings, prerequisites, blocks, and notifications through a lightweight, reusable interface. It enables you to integrate OnSecurity data into your workflows and dashboards by exposing a consistent set of endpoints that you can feed into your MCP client or automation tools.

How to use

You access the OnSecurity MCP server through a client that supports MCP servers. Create or select the OnSecurity MCP configuration, then make queries using the available tools to retrieve rounds, findings, blocks, prerequisites, and notifications. Use these results to summarize pentests, track trends, highlight high-impact findings, and prepare stakeholder-ready reports. Your client will expose functions named after these tools, and you can compose questions and workflows around them (for example, dashboards of trends or summaries for different stakeholder groups). You can also query for new findings or items that require action to prevent test delays.

Practical usage patterns include: getting a latest-round summary, listing findings for a given engagement, fetching blocks that affect remediation plans, retrieving prerequisites for a test, and pulling the latest notifications. You can combine multiple tools in a single workflow to build executive summaries, technical reports, or task backlogs suitable for different audiences.

How to install

Prerequisites: you need a modern Node.js runtime installed on your machine. You also should have a working configuration environment for your MCP client. Ensure you have network access to the OnSecurity API base URL specified in the configuration.

{
  "mcpServers": {
    "onsec_mcp": {
      "command": "npx",
      "args": [
        "-y",
        "github:onsecurity/onsecurity-mcp-server"
      ],
      "env": {
        "ONSECURITY_API_TOKEN": "your_api_token",
        "ONSECURITY_API_BASE": "https://app.onsecurity.io/api/v2"
      }
    }
  }
}

Save this configuration in your MCP client’s configuration file, then restart the client. After restart, access the OnSecurity tools through the client interface.

Configuration notes and security

Environment variables shown configure access to the OnSecurity API. Treat tokens as secrets and store them securely. Do not commit tokens to public repositories.

The OnSecurity MCP server exposes the following tools for querying data: get-rounds, get-findings, get-blocks, get-notifications, get-prerequisites. Use these tools to assemble insights, track trends, and generate audience-appropriate reports.

Troubleshooting and tips

• If you cannot connect, verify your API token and base URL are correct.
• Restart the client after updating configuration.
• Ensure your network allows access to the OnSecurity API.

Notes on tools and endpoints

The MCP server provides command-based access to a defined set of endpoints. Use the tools to perform read-only queries that return structured data suitable for dashboards and reports.

Available tools

get-rounds

Fetches the list of rounds or engagements and provides summaries or metadata for each round.

get-findings

Retrieves findings for a given round or set of rounds, including severity and status.

get-blocks

Returns blocks related to a round or finding to help with remediation planning.

get-notifications

Fetches notifications related to ongoing engagements, new findings, or status changes.

get-prerequisites

Obtains prerequisites required before a test or engagement can proceed.