complyeah-mcp

A Model Context Protocol server for complyeah. It lets an MCP-compatible AI assistant (Claude Desktop, IDE assistants, and others) use your complyeah account: list domains and scans, read findings, and start an external penetration test.

It is a thin client of the complyeah REST API — the same API documented at https://complyeah.com/api. Reads are free; starting a comprehensive scan spends one scan credit, exactly as in the web app.

Setup

1. Create an API key on your account's API page and copy it (it's shown once). Keys look like cmply_live_….

2. Add the server to your MCP client. For Claude Desktop, in claude_desktop_config.json:

   {
     "mcpServers": {
       "complyeah": {
         "command": "npx",
         "args": ["-y", "complyeah-mcp"],
         "env": { "COMPLYEAH_API_KEY": "cmply_live_your_key_here" }
       }
     }
   }

3. Restart the client. The complyeah tools appear automatically.

The key is read from the COMPLYEAH_API_KEY environment variable — it is never passed through the model. To point at a non-default API host, set COMPLYEAH_API_URL (defaults to https://api.complyeah.com).

Related MCP server: reptor-mcp

Tools

trigger_scan is marked as a non-read-only action, so a well-behaved host asks for your confirmation before it runs. It accepts an optional idempotency_key so a retried request never starts (or charges for) a second scan.

Develop

npm install
npm run build          # compiles src/ -> dist/
COMPLYEAH_API_KEY=cmply_live_… npm start

License

MIT — see LICENSE.