Use Vulnix0 from AI agents

What this is

MCP is a standard way for AI agents to discover and call tools. Instead of every AI application manually building Vulnix0 API wrappers, the agent can connect to the Vulnix0 MCP endpoint, list the available tools, and call the right tool for the user's request.

Quick start

Authentication

Every MCP request must use a Vulnix0 API key. Browser login cookies and JWT sessions are not accepted by MCP.

Authorization: Bearer YOUR_VULNIX0_API_KEY

The legacy API-key header is also supported:

api-key: YOUR_VULNIX0_API_KEY

To select an organization, use one of these:

X-Org-Id: YOUR_ORG_ID

{
  "org_id": "YOUR_ORG_ID"
}

Tool reference

{
  "target": "aquilax.ai",
  "org_id": "optional",
  "project_id": "optional",
  "scan_policy_id": "optional",
  "web": true,
  "openapi_spec": "optional raw OpenAPI spec",
  "api_base_path": "/api"
}

{
  "reqid": "scan-request-id",
  "org_id": "optional",
  "include_evidence": false
}

{
  "target": "aquilax.ai",
  "org_id": "optional",
  "project_id": "optional"
}

Example agent workflows

User: Scan aquilax.ai and summarize the important risks.

User: What changed for aquilax.ai since the last completed scan?

JSON-RPC examples

List the available Vulnix0 MCP tools:

curl -s https://vulnix0.com/mcp \
  -H "Authorization: Bearer YOUR_VULNIX0_API_KEY" \
  -H "X-Org-Id: YOUR_ORG_ID" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Mcp-Protocol-Version: 2025-06-18" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/list",
    "params": {}
  }'

Start a scan for aquilax.ai:

curl -s https://vulnix0.com/mcp \
  -H "Authorization: Bearer YOUR_VULNIX0_API_KEY" \
  -H "X-Org-Id: YOUR_ORG_ID" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Mcp-Protocol-Version: 2025-06-18" \
  -d '{
    "jsonrpc": "2.0",
    "id": 2,
    "method": "tools/call",
    "params": {
      "name": "vulnix0_start_scan",
      "arguments": {
        "target": "aquilax.ai",
        "web": true
      }
    }
  }'

Fetch scan results with the returned request id:

curl -s https://vulnix0.com/mcp \
  -H "Authorization: Bearer YOUR_VULNIX0_API_KEY" \
  -H "X-Org-Id: YOUR_ORG_ID" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Mcp-Protocol-Version: 2025-06-18" \
  -d '{
    "jsonrpc": "2.0",
    "id": 3,
    "method": "tools/call",
    "params": {
      "name": "vulnix0_get_scan_result",
      "arguments": {
        "reqid": "SCAN_REQUEST_ID",
        "include_evidence": false
      }
    }
  }'

Python smoke test

For local or private testing, call the MCP endpoint from Python using JSON-RPC:

import json
import urllib.request

url = "https://vulnix0.com/mcp"
api_key = "YOUR_VULNIX0_API_KEY"
org_id = "YOUR_ORG_ID"

headers = {
    "Authorization": f"Bearer {api_key}",
    "X-Org-Id": org_id,
    "Content-Type": "application/json",
    "Accept": "application/json, text/event-stream",
    "Mcp-Protocol-Version": "2025-06-18",
}

payload = {
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/list",
    "params": {},
}

request = urllib.request.Request(
    url,
    data=json.dumps(payload).encode("utf-8"),
    headers=headers,
    method="POST",
)

with urllib.request.urlopen(request) as response:
    print(response.read().decode("utf-8"))

Permissions and safety

• vulnix0_start_scan requires permission to start scans in the selected organization.
• vulnix0_get_scan_result requires permission to view scan details.
• vulnix0_get_asset_latest_change requires scan visibility for the selected organization.
• Only scan assets you are authorized to assess.
• Store API keys as secrets in your agent runtime. Never place API keys in prompts, frontend code, or public repositories.
• Use saved scan policies to control scan depth, rates, and optional checks.
• Set include_evidence: true only when the agent needs raw HTTP request and response evidence.