OnSecurity MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| get-roundsC | Get all rounds data from OnSecurity from client in a high level summary. When replying, only include the summary, not the raw data and be sure to present the data in a way that is easy to understand for the client. Rounds can be pentest rounds, scan rounds, or radar rounds. |
| get-findingsB | Get all findings data from OnSecurity from client in a high level summary, only include the summary, not the raw data and be sure to present the data in a way that is easy to understand for the client. You can optionally filter findings by round_id. HOWEVER ONLY USE THIS TOOL WHEN ASKED FOR FINDINGS RELATED TO A CLIENT OR MY FINDINGS, NOT THE BLOCKS TOOL. |
| get-notificationsC | Get all notifications data from OnSecurity from client in a high level summary, only include the summary, not the raw data and be sure to present the data in a way that is easy to understand for the client. |
| get-prerequisitesC | Get all prerequisites data from OnSecurity for a specific round. Prerequisites are requirements that need to be fulfilled before a security assessment can begin. |
| get-blocksB | Get all blocks data from OnSecurity. Blocks are reusable security finding templates that can be used across different assessments. They contain standardized vulnerability descriptions, risks, and recommendations. Note that you can get how often a block is used, which is a way to get the most common findings ACROSS ALL CLIENTS ONLY as blocks are the basis of findings across pentests and scans. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 5 tools
Each tool has a clearly distinct purpose targeting different resources: blocks (security templates), findings (client security issues), notifications (client alerts), prerequisites (assessment requirements), and rounds (assessment cycles). The descriptions explicitly differentiate them, with notes like 'NOT THE BLOCKS TOOL' to prevent confusion, ensuring no overlap in functionality.
All tool names follow a consistent verb_noun pattern with hyphens (e.g., get-blocks, get-findings, get-notifications). This uniform naming convention makes the tool set predictable and easy to navigate, with no deviations in style or structure across the five tools.
With 5 tools, the count is reasonable for a security assessment server, covering key areas like templates, findings, notifications, prerequisites, and rounds. It is slightly lean but well-scoped; minor gaps like update or delete operations are acceptable given the server's focus on data retrieval for client summaries.
The tool set provides good read-only coverage for retrieving security assessment data, but there are notable gaps in CRUD operations. For example, there are no tools for creating, updating, or deleting findings, blocks, or rounds, which limits agents to viewing data without modifying it, potentially hindering workflow completeness in a security management context.