APVISO MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| APVISO_API_KEY | Yes | Your API key (starts with apvk_) | |
| APVISO_API_URL | No | API base URL | https://apviso.com/api |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| get_quotaA | Get your current quota usage including subscription tier, credits remaining, and billing period dates. Use this to check available scan credits before starting a new scan. |
| list_targetsB | List all your registered targets (domains). Returns paginated results with verification status. |
| get_targetB | Get details for a specific target including domain, verification status, and whether authentication is configured. |
| create_targetA | Register a new target domain for scanning. The target must be verified before it can be scanned. After creating, use get_verification_instructions to see how to verify ownership. |
| verify_targetA | Verify ownership of a target using one of three methods: dns_txt (add a DNS TXT record), file (upload a verification file to /.well-known/penterep-verify.txt), or meta_tag (add a meta tag to your homepage). Use get_verification_instructions first to see the required values. |
| get_verification_instructionsC | Get the verification token and step-by-step instructions for all three verification methods (DNS TXT, file upload, meta tag) for a target. |
| delete_targetA | Delete a target. This will fail if the target has any associated scans. |
| list_scansA | List your scans with optional filtering by status. Returns paginated results including scan status, target info, and timestamps. |
| get_scanB | Get details for a specific scan including status, target, model preset, timestamps, and whether it's a retest. Use this to check scan progress. |
| create_scanA | Start a new penetration test scan. IMPORTANT: This creates a billable scan that costs credits. The target must be verified first. Check quota with get_quota before starting. modelPreset controls depth: 'free' uses free credits, 'low' is fastest, 'ultra' is most thorough and expensive. |
| list_findingsA | List findings (vulnerabilities) for a specific scan. Results are paginated and descriptions are truncated — use get_report for full finding details. Filter by severity (critical/high/medium/low/info) or status (open/in_progress/fixed/accepted_risk/false_positive). |
| update_finding_statusA | Update the status of a finding. Use this to track remediation progress: open → in_progress → fixed, or mark as accepted_risk or false_positive. |
| get_reportA | Get the full penetration test report for a completed scan. Returns the report as markdown content with complete finding details, evidence, and remediation guidance. Also includes a PDF download URL if available. This is the best tool for getting comprehensive scan results. |
| list_schedulesA | List all your scan schedules. Schedules automatically run scans on a recurring basis (daily, weekly, biweekly, or monthly). Requires Business or Enterprise tier. |
| get_scheduleB | Get details for a specific scan schedule including frequency, next run time, and configuration. |
| create_scheduleA | Create a recurring scan schedule for a verified target. Requires Business or Enterprise tier. Scans will run automatically at the specified time and frequency. |
| update_scheduleC | Update an existing scan schedule. You can change the frequency, timing, model preset, or enable/disable it. |
| delete_scheduleB | Delete a scan schedule. This stops all future scheduled scans for this target. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 18 tools
Every tool has a clearly distinct purpose with no ambiguity. Tools are organized around specific resources (scans, targets, schedules, findings, quota) and actions (create, get, list, update, delete, verify), making it easy for an agent to select the right one. For example, list_findings and get_report serve complementary but non-overlapping roles for accessing scan results.
Tool names follow a consistent verb_noun pattern throughout, such as create_scan, get_report, list_targets, update_schedule, and delete_target. This predictability enhances readability and usability for agents, with no deviations or mixed conventions observed.
With 18 tools, the server is well-scoped for its penetration testing domain, covering the full lifecycle from target registration and verification to scanning, reporting, and remediation tracking. Each tool earns its place by addressing a specific need without redundancy, making the count appropriate for the server's purpose.
The tool surface provides complete CRUD/lifecycle coverage for penetration testing. It includes target management (create, get, list, delete, verify), scan operations (create, get, list, schedule management), reporting (get_report, list_findings), quota checking, and finding status updates, with no obvious gaps that would hinder agent workflows.