MCP Server | Pensar

Overview

Pensar provides a remote Model Context Protocol (MCP) server that lets AI tools interact directly with your Pensar workspace. Through MCP, you can list scans, launch pentests, review security issues, and retrieve auto-generated fixes using tools like Claude Code, Desktop, or Web, or even directly in Slack.

MCP is an open standard that allows AI assistants to connect to external tools and data sources. Pensar’s MCP server implements the Streamable HTTP transport so it works with any MCP-compatible client.

Prerequisites

Before connecting an MCP client to Pensar you need:

A Pensar Console account at console.pensar.dev
At least one workspace with a connected repository
An MCP-compatible client (e.g., Claude Desktop, Claude Code, Cursor, Windsurf)

Server URL

The Pensar MCP server is available at:

https://api.pensar.dev/mcp

Authentication

The Pensar MCP server uses OAuth 2.0 for authentication, following the MCP Authorization specification (2025-03-26). When you first connect, your MCP client will open a browser window where you sign in with your Pensar Console credentials. After signing in, the client receives a token and uses it automatically for all subsequent requests.

Most MCP clients handle the OAuth flow automatically. You do not need to create or manage API keys, just sign in.

Setup

Claude Code

Claude Desktop / Web

Cursor

Windsurf

Open Claude Code by running claude in your terminal
Add the Pensar MCP server:

$ claude mcp add Pensar --transport http https://api.pensar.dev/mcp

Run the /mcp command, you’ll see Pensar with a needs authentication status
Select it and choose Authenticate to sign in with Pensar in your browser

Available Tools

The Pensar MCP server exposes the following tools to your AI coding agent:

Scans

list_scans

List all scans in your workspace.

Parameters: None

Returns: A list of scans with their IDs, labels, statuses, scan types, branches, and timestamps.

Example prompt: “Show me all my Pensar scans.”

get_scan

Get detailed information about a specific scan.

Parameters:

Parameter	Type	Required	Description
`scanId`	string	Yes	Scan ID to retrieve details for

Returns: Detailed scan information including workspace name, status, error messages, issue count, and whether a report is ready.

Example prompt: “What’s the status of scan xyz-789?”

dispatch_pentest

Launch a Pensar security pentest in your workspace. The scan is queued and executed asynchronously.

Parameters:

Parameter	Type	Required	Description
`branch`	string	No	Target branch to scan. Defaults to the repository’s default branch.
`scanLevel`	string	No	Scan depth: `"priority"` for a quick check or `"full"` for comprehensive analysis. Defaults to `"priority"`.

Returns: The queued scan’s ID, label, status, and a confirmation message.

Example prompt: “Run a full pentest against the main branch.”

Issues

list_issues

List security issues with optional filtering.

Parameters:

Parameter	Type	Required	Description
`scanId`	string	No	Filter by scan ID
`status`	string	No	Filter by issue status (e.g., `"open"`, `"closed"`)
`severity`	string	No	Filter by severity (`"critical"`, `"high"`, `"medium"`, `"low"`)
`branch`	string	No	Filter by git branch

Returns: A list of issues with their IDs, issueLabel references (VULN-000123), console urls, titles, severities, statuses, and file locations. Closed issues also carry closedAt and closedDisposition, so a closed finding is not mistaken for a resolved one; both are null while the issue is open.

Example prompt: “Show me all critical open issues.”

get_issue

Get detailed information about a specific security issue.

Parameters:

Parameter	Type	Required	Description
`issueId`	string	Yes	Issue UUID or label (e.g. `VULN-000123`) to retrieve details for

Returns: Full issue details including the issueLabel reference, the console url, description, affected file and line range, CWE classification, branch, proof-of-concept, and workspace information. A closed issue adds the full close record: closedAt, closedDisposition, closedMethod, closedReason, and closedComments.

Example prompt: “Give me the details on VULN-000123.”

update_issue

Update the status of a security issue — close it, mark it as a false positive, or reopen it.

Parameters:

Parameter	Type	Required	Description
`issueId`	string	Yes	Issue UUID or label (e.g. `VULN-000123`) to update
`status`	string	No	New status: `"open"`, `"closed"`, `"false-positive"`, or `"in-review"`
`userFlaggedFalsePositive`	boolean	No	Flag the issue as a false positive
`userFlaggedFalsePositiveReason`	string	No	Reason for flagging as false positive
`closedDisposition`	string	No	Structured close verdict: `resolved`, `wont-fix`, `out-of-scope`, `risk-accepted`
`closedReason`	string	No	Free-text reason for closing
`closedComments`	string	No	Additional comments on closure

Pair closedDisposition with status: "closed" — without it the finding reads as Resolved whatever the reason says. Reopening clears it, and false-positive never carries one. other is not accepted, as it is being retired from the vocabulary.

Returns: The updated issue details, including closedAt, closedReason, and closedDisposition.

Example prompt: “Close issue abc-123 as risk-accepted, we have a WAF rule in front of it.”

Fixes

list_fixes

List all available fixes for a security issue.

Parameters:

Parameter	Type	Required	Description
`issueId`	string	Yes	Issue UUID or label (e.g. `VULN-000123`) to list fixes for

Returns: A list of fixes with their IDs and affected file paths.

Example prompt: “Are there any fixes for issue def-456?”

get_fix

Get detailed information about a specific fix, including the code diff.

Parameters:

Parameter	Type	Required	Description
`fixId`	string	Yes	Fix ID to retrieve details for

Returns: The fix details including the file path, a unified diff of the changes, an explanation of what the fix does, and the related issue ID.

Example prompt: “Show me the diff for fix ghi-789.”

Agent Logs

list_agent_logs

List agent execution logs for a specific issue. Useful for understanding how the agent discovered and verified a vulnerability.

Parameters:

Parameter	Type	Required	Description
`issueId`	string	Yes	Issue UUID or label (e.g. `VULN-000123`) to list logs for
`level`	string	No	Filter by log level: `"debug"`, `"info"`, `"warn"`, `"error"`
`role`	string	No	Filter by role: `"assistant"`, `"user"`, `"system"`, `"tool-call"`, `"tool-result"`
`limit`	number	No	Maximum number of log entries to return

Returns: A list of agent log entries with timestamps, levels, roles, and content.

Example prompt: “Show me the agent logs for issue abc-123.”

search_agent_logs

Search agent execution logs by text pattern with configurable context lines.

Parameters:

Parameter	Type	Required	Description
`issueId`	string	Yes	Issue UUID or label (e.g. `VULN-000123`) to search logs for
`query`	string	Yes	Text pattern to search for
`level`	string	No	Filter by log level
`role`	string	No	Filter by role
`contextLines`	number	No	Number of surrounding context lines to include

Returns: Matching log entries with surrounding context.

Example prompt: “Search the agent logs for issue abc-123 for mentions of SQL injection.”

REST API

Every MCP tool has a matching REST API endpoint for programmatic access via API keys. The REST API is a superset — it also exposes attack-surface endpoints (apps and endpoints) that are not available over MCP. See the REST API documentation for full endpoint details and authentication instructions.

Usage Examples

Once connected, you can interact with Pensar through natural language in your AI coding agent. Here are some common workflows:

Run a Security Scan

Ask your agent to launch a pentest and then check the results:

“Run a Pensar pentest and let me know when it finishes.”

The agent will use dispatch_pentest to start the scan, then get_scan to poll for completion.

Review Security Issues

Ask your agent to summarize findings from a recent scan:

“Show me all high and critical issues from my latest scan.”

The agent will use list_scans to find the most recent scan, then list_issues with severity filters to retrieve the relevant findings.

Apply a Fix

Ask your agent to retrieve and apply a recommended fix:

“Get the fix for issue abc-123 and apply it to my codebase.”

The agent will use list_fixes to find available fixes, get_fix to retrieve the diff, and then apply the patch to your local files.

Supported Clients

The Pensar MCP server works with any client that supports the Streamable HTTP transport and OAuth-based authorization. Tested clients include Claude Code, Claude Desktop, Cursor, and Windsurf.

If your preferred client is not listed above, consult its documentation on adding a remote MCP server.

Next Steps

Hybrid Testing

Learn about Pensar’s hybrid testing methodology that powers MCP issue and fix data.

Auto-Remediation

Understand how Pensar generates fixes you can retrieve via MCP.

CI/CD Integration

Automate pentesting in your pipeline alongside MCP-driven workflows.

Getting Started

Set up your workspace and connect your first repository.