OnSecurity MCP Server
# OnSecurity MCP
A Model Context Protocol (MCP) server for the OnSecurity API with the ability query rounds, findings, prerequisites, blocks and notifications.
## Installation
Add the following to your Claude Desktop configuration file (adjust the paths as needed) and choose UAT or Prod:
```bash
{
"mcpServers": {
"onsec-mcp": {
"command": "npx",
"args": [
"-y",
"github:onsecurity/onsecurity-mcp-server"
],
"env": {
"ONSECURITY_API_TOKEN": "your_api_token",
"ONSECURITY_API_BASE": "https://app.onsecurity.io/api/v2"
}
}
}
}
```
After adding this configuration, restart Claude Desktop, and you'll be able to access the OnSecurity tools through Claude.
## Usage
Once configured, Claude will have access to the following tools:
- `get-rounds`
- `get-findings`
- `get-blocks`
- `get-notifications`
- `get-prerequisites`
#### Example Questions
- Give me a summary of my most recent pentest/scan.
- Show me trends across my pentests as a graph.
- What can I address to make the most impact most quickly on my most recent pentest?
- I would like summaries for different types of stakeholders on the state of our recent pentest engagemenets - eg high level, technical, managerial etc
- Do I need to action anything to prevent test getting held up?
- Are there any new findings?
- What are the top 10 most common findings across pentests and scans.
*Note: It is useful sometimes to configure Claude to "Extended thinking" for some questions.*
TDQS
Scored across 5 tools
Each tool has a clearly distinct purpose targeting different resources: blocks (security templates), findings (client security issues), notifications (client alerts), prerequisites (assessment requirements), and rounds (assessment cycles). The descriptions explicitly differentiate them, with notes like 'NOT THE BLOCKS TOOL' to prevent confusion, ensuring no overlap in functionality.
All tool names follow a consistent verb_noun pattern with hyphens (e.g., get-blocks, get-findings, get-notifications). This uniform naming convention makes the tool set predictable and easy to navigate, with no deviations in style or structure across the five tools.
With 5 tools, the count is reasonable for a security assessment server, covering key areas like templates, findings, notifications, prerequisites, and rounds. It is slightly lean but well-scoped; minor gaps like update or delete operations are acceptable given the server's focus on data retrieval for client summaries.
The tool set provides good read-only coverage for retrieving security assessment data, but there are notable gaps in CRUD operations. For example, there are no tools for creating, updating, or deleting findings, blocks, or rounds, which limits agents to viewing data without modifying it, potentially hindering workflow completeness in a security management context.