apPosture MCP server
apPosture ships its own Model Context Protocol (MCP) server so an AI dev tool - Claude Code, GitHub Copilot, Cursor, Codex, Gemini - can query your security posture in-context. Ask "what are my exploitable findings in this repo?" and the assistant answers from apPosture, with your data, without leaving the IDE.
This page is about apPosture providing context to your assistant. The separate concern of governing which MCP servers your agents are wired to lives in the AI config scan.
What it exposes
The server speaks JSON-RPC 2.0 over HTTP at /api/v1/mcp and is read-only by design -
it can never change anything. It offers four tools:
| Tool | Returns |
|---|---|
search_findings | Findings matching a query / filter |
get_finding | One finding in full, with its proof |
posture_summary | The current posture score and headline numbers |
list_repositories | The repositories in scope |
Authentication and scope
Every call authenticates with a Personal Access Token (Authorization: Bearer apt_…)
and inherits that token owner's RBAC and application scope - the assistant sees exactly
what the user behind the token is allowed to see, and nothing more. Create a token under
Account & security → API & service tokens (see
Add a Kubernetes cluster for the same token flow).
Connecting your assistant
GET /api/v1/mcp/info returns the exact connection command for your tool. For Claude
Code, for example:
claude mcp add --transport http apposture https://aspm.apposture.com/api/v1/mcp \
--header "Authorization: Bearer $APPOSTURE_TOKEN"
Point the endpoint at your own apPosture URL if you are self-hosting. Because the server is read-only and token-scoped, connecting an assistant grants query access only - never write access to your posture.