Skip to main content

apPosture MCP server

apPosture ships its own Model Context Protocol (MCP) server so an AI dev tool - Claude Code, GitHub Copilot, Cursor, Codex, Gemini - can query your security posture in-context. Ask "what are my exploitable findings in this repo?" and the assistant answers from apPosture, with your data, without leaving the IDE.

Two different "MCP" concepts

This page is about apPosture providing context to your assistant. The separate concern of governing which MCP servers your agents are wired to lives in the AI config scan.

What it exposes

The server speaks JSON-RPC 2.0 over HTTP at /api/v1/mcp and is read-only by design - it can never change anything. It offers four tools:

ToolReturns
search_findingsFindings matching a query / filter
get_findingOne finding in full, with its proof
posture_summaryThe current posture score and headline numbers
list_repositoriesThe repositories in scope

Authentication and scope

Every call authenticates with a Personal Access Token (Authorization: Bearer apt_…) and inherits that token owner's RBAC and application scope - the assistant sees exactly what the user behind the token is allowed to see, and nothing more. Create a token under Account & security → API & service tokens (see Add a Kubernetes cluster for the same token flow).

Connecting your assistant

GET /api/v1/mcp/info returns the exact connection command for your tool. For Claude Code, for example:

claude mcp add --transport http apposture https://aspm.apposture.com/api/v1/mcp \
--header "Authorization: Bearer $APPOSTURE_TOKEN"

Point the endpoint at your own apPosture URL if you are self-hosting. Because the server is read-only and token-scoped, connecting an assistant grants query access only - never write access to your posture.