MCP Server
Overview
Pensar provides a remote Model Context Protocol (MCP) server that lets AI tools interact directly with your Pensar workspace. Through MCP, you can list projects, launch pentests, review security issues, and retrieve auto-generated fixes using tools like Claude Code, Desktop, or Web, or even directly in Slack.
MCP is an open standard that allows AI assistants to connect to external tools and data sources. Pensar’s MCP server implements the Streamable HTTP transport so it works with any MCP-compatible client.
Prerequisites
Before connecting an MCP client to Pensar you need:
- A Pensar Console account at console.pensar.dev
- At least one workspace with a connected project
- An MCP-compatible client (e.g., Claude Desktop, Claude Code, Cursor, Windsurf)
Server URL
The Pensar MCP server is available at:
Authentication
The Pensar MCP server uses OAuth 2.0 for authentication, following the MCP Authorization specification (2025-03-26). When you first connect, your MCP client will open a browser window where you sign in with your Pensar Console credentials. After signing in, the client receives a token and uses it automatically for all subsequent requests.
Most MCP clients handle the OAuth flow automatically. You do not need to create or manage API keys, just sign in.
Setup
Claude Code
Claude Desktop / Web
Cursor
Windsurf
- Open Claude Code by running
claudein your terminal - Add the Pensar MCP server:
- Run the
/mcpcommand, you’ll see Pensar with a needs authentication status - Select it and choose Authenticate to sign in with Pensar in your browser
Available Tools
The Pensar MCP server exposes the following tools to your AI coding agent:
Projects
list_projects
List all projects in your workspace.
Parameters: None
Returns: A list of projects with their IDs, names, and sources.
Example prompt: “List all my Pensar projects.”
Scans
list_scans
List all scans for a given project.
Parameters:
Returns: A list of scans with their IDs, labels, statuses, scan types, branches, and timestamps.
Example prompt: “Show me the scans for project abc-123.”
get_scan
Get detailed information about a specific scan.
Parameters:
Returns: Detailed scan information including project name, status, error messages, issue count, and whether a report is ready.
Example prompt: “What’s the status of scan xyz-789?”
dispatch_pentest
Launch a Pensar security pentest against a project. The scan is queued and executed asynchronously.
Parameters:
Returns: The queued scan’s ID, label, and status.
Example prompt: “Run a full pentest on my backend project against the main branch.”
Issues
list_issues
List security issues with optional filtering.
Parameters:
Returns: A list of issues with their IDs, titles, severities, statuses, and file locations.
Example prompt: “Show me all critical open issues for project abc-123.”
get_issue
Get detailed information about a specific security issue.
Parameters:
Returns: Full issue details including description, affected file and line range, CWE classification, branch, endpoint, proof-of-concept, and project information.
Example prompt: “Give me the details on issue def-456.”
Fixes
list_fixes
List all available fixes for a security issue.
Parameters:
Returns: A list of fixes with their IDs and affected file paths.
Example prompt: “Are there any fixes for issue def-456?”
get_fix
Get detailed information about a specific fix, including the code diff.
Parameters:
Returns: The fix details including the file path, a unified diff of the changes, an explanation of what the fix does, and the related issue ID.
Example prompt: “Show me the diff for fix ghi-789.”
Usage Examples
Once connected, you can interact with Pensar through natural language in your AI coding agent. Here are some common workflows:
Run a Security Scan
Ask your agent to launch a pentest and then check the results:
“Run a Pensar pentest on my project and let me know when it finishes.”
The agent will use list_projects to find your project, dispatch_pentest to start the scan, and get_scan to poll for completion.
Review Security Issues
Ask your agent to summarize findings from a recent scan:
“Show me all high and critical issues from my latest scan.”
The agent will use list_scans to find the most recent scan, then list_issues with severity filters to retrieve the relevant findings.
Apply a Fix
Ask your agent to retrieve and apply a recommended fix:
“Get the fix for issue abc-123 and apply it to my codebase.”
The agent will use list_fixes to find available fixes, get_fix to retrieve the diff, and then apply the patch to your local files.
Supported Clients
The Pensar MCP server works with any client that supports the Streamable HTTP transport and OAuth-based authorization. Tested clients include Claude Code, Claude Desktop, Cursor, and Windsurf.
If your preferred client is not listed above, consult its documentation on adding a remote MCP server.
Next Steps
Learn about Pensar’s hybrid testing methodology that powers MCP issue and fix data.
Understand how Pensar generates fixes you can retrieve via MCP.
Automate pentesting in your pipeline alongside MCP-driven workflows.
Set up your workspace and connect your first project.
