MCP

Alkonos exposes an authenticated Streamable HTTP MCP server at:

https://api.alkonos.ai/mcp/console/

MCP lets an AI client search inventory, inspect findings, launch scans, and perform permitted mutations without constructing GraphQL requests manually.

Connect Claude Code

  1. Open MCP & API Keys in Alkonos.

  2. Create an organization-scoped API key.

  3. Copy the generated command, or run:

claude mcp add alkonos \
  --transport http \
  https://api.alkonos.ai/mcp/console/ \
  --header "Authorization: Bearer $ALKONOS_API_KEY"

Restart or reload the client if it does not discover the tools immediately.

For another MCP client, configure a Streamable HTTP server at the same URL and send Authorization: Bearer <key> on every request. Configuration file shapes are client-specific.

Key permissions

The server exposes tools allowed by the key:

  • A read-only key can search assets, list groups, scans, scanners, and vulnerabilities, and inspect details.

  • An admin key can also create groups, add or remove group members, manage credentials, launch scans, comment on findings, assign findings, and change finding status.

  • Platform-admin tools appear only to superadmin keys.

Use the least-privileged key that satisfies the workflow.

Useful tool sequences

Find a host and scan it

  1. search_assets — find the host asset ID.

  2. get_host_ports — find the service port ID.

  3. list_scanners — optionally choose DAST agents.

  4. create_dast_scan — launch the scan.

  5. get_scan — poll status and per-agent progress.

  6. list_vulnerabilities — review results.

Create and populate a group

  1. create_asset_group

  2. add_hostname_to_group

  3. list_asset_groups or get_asset_group

  4. search_assets

Triage findings

  1. list_vulnerabilities

  2. get_vulnerability

  3. add_vulnerability_comment

  4. assign_vulnerability

  5. update_vulnerability_status

Scan source code

Use create_sast_scan with a branch asset ID. Repository branches are created after a connected repository is added and indexed.

Example requests

List asset groups with critical or high findings. Do not change anything.

Find api.example.com, show its discovered ports, and ask me which port to scan.

Create a group named "Production API" with api.example.com as a seed, then show the created group ID.

List open critical findings, summarize the evidence and remediation, and leave their statuses unchanged.

For destructive or high-impact operations, include explicit group, asset, port, scan, or vulnerability IDs in the request and review the tool call before approval.