MCP

4 min

, , , ,

Hacktron’s MCP server is at https://mcp.hacktron.ai/mcp. Choose your client and copy its configuration. You sign in to Hacktron in the browser, so no API key is required.

Connect your client

Claude Code

Run this in a terminal:

claude mcp add --transport http hacktron https://mcp.hacktron.ai/mcp

Then authenticate the connection:

Start Claude Code in your project.
Type /mcp, select hacktron, and choose Authenticate.
Complete the Hacktron sign-in in the browser.

To use an API key instead, create an organisation API key with the authentication guide. Grant read and write access if your assistant should triage findings.

Run this in a terminal:

claude mcp add --transport http hacktron https://mcp.hacktron.ai/mcp --header "Authorization: Bearer hacktron_your_key_here"

Warning

An API key is a long-lived secret. Store it in your client’s secret settings, never commit it to source control, and grant the narrowest scope your workflow needs.

Claude Desktop

Add the server to Claude Desktop’s configuration:

1
{
2
  "mcpServers": {
3
    "hacktron": {
4
      "command": "npx",
5
      "args": ["-y", "mcp-remote", "https://mcp.hacktron.ai/mcp"]
6
    }
7
  }
8
}

Restart Claude Desktop to apply the change.

The first time Claude Desktop connects to Hacktron, complete the Hacktron sign-in in the browser. If the prompt doesn’t appear, open Claude Desktop’s MCP server settings and reconnect hacktron.

To use an API key instead, create an organisation API key with the authentication guide. Grant read and write access if your assistant should triage findings.

1
{
2
  "mcpServers": {
3
    "hacktron": {
4
      "command": "npx",
5
      "args": ["-y", "mcp-remote", "https://mcp.hacktron.ai/mcp", "--header", "Authorization: Bearer hacktron_your_key_here"]
6
    }
7
  }
8
}

Warning

An API key is a long-lived secret. Store it in your client’s secret settings, never commit it to source control, and grant the narrowest scope your workflow needs.

Cursor

Add the server to Cursor’s configuration:

1
{
2
  "mcpServers": {
3
    "hacktron": {
4
      "url": "https://mcp.hacktron.ai/mcp"
5
    }
6
  }
7
}

After saving, reload Cursor: press Cmd+Shift+P and choose Reload Window.

When Cursor asks you to authenticate hacktron, complete the Hacktron sign-in in the browser. You can also open Cursor’s MCP settings, select hacktron, and start authentication from there.

To use an API key instead, create an organisation API key with the authentication guide. Grant read and write access if your assistant should triage findings.

1
{
2
  "mcpServers": {
3
    "hacktron": {
4
      "url": "https://mcp.hacktron.ai/mcp",
5
      "headers": {
6
        "Authorization": "Bearer hacktron_your_key_here"
7
      }
8
    }
9
  }
10
}

Warning

An API key is a long-lived secret. Store it in your client’s secret settings, never commit it to source control, and grant the narrowest scope your workflow needs.

Codex

Run this in a terminal:

codex mcp add hacktron --url https://mcp.hacktron.ai/mcp

Then authenticate the connection:

codex mcp login hacktron

Complete the Hacktron sign-in in the browser. In an interactive Codex session, type /mcp to check the server’s connection and authentication status.

To use an API key instead, create an organisation API key with the authentication guide. Grant read and write access if your assistant should triage findings.

Add the key to your shell profile, ~/.zshrc or ~/.bashrc:

export HACKTRON_API_KEY=hacktron_your_key_here

Then register the server:

codex mcp add hacktron --url https://mcp.hacktron.ai/mcp --bearer-token-env-var HACKTRON_API_KEY

Warning

An API key is a long-lived secret. Store it in your client’s secret settings, never commit it to source control, and grant the narrowest scope your workflow needs.

Antigravity

Add the server to Antigravity’s configuration:

1
{
2
  "mcpServers": {
3
    "hacktron": {
4
      "serverUrl": "https://mcp.hacktron.ai/mcp"
5
    }
6
  }
7
}

Click Refresh in the MCP Servers panel to apply the change.

Select hacktron in the MCP Servers panel and complete the Hacktron sign-in in the browser when asked.

Tools

These tools let your AI assistant work with Hacktron. Each one has a REST API endpoint with the same operation and the same permission requirements.

Viewers can read scans and findings. Members can update findings and prepare pentests. Starting a pentest or changing the Review settings needs an organisation admin.

Scans and findings

Tool	Description
`list_scans` `GET /scans`	List scans with their finding counts by severity
`get_scan` `GET /scans/{id}`	Get the details of a scan
`export_findings` `GET /scans/{id}/findings/export`	Export a scan’s findings as JSON, CSV, or SARIF
`stop_scan` `POST /scans/{id}/stop`	Stop a running scan or pentest
`list_findings` `GET /findings`	List findings across your organisation
`count_findings` `GET /findings/counts`	Count findings by severity, state, and repository
`get_finding` `GET /findings/{id}`	Get the details of a finding
`update_finding` `PATCH /findings/{id}`	Change a finding’s state or severity
`add_finding_comment` `POST /findings/{id}/comments`	Post a comment on a finding

Whitebox

Tool	Description
`list_repositories` `GET /repos`	List the connected repositories
`request_archive_upload` `POST /archives/uploads`	Get a URL to upload a code archive to
`create_pentest_draft` `POST /pentests`	Create a draft with code and optional live sites
`update_pentest_draft` `PATCH /pentests/{id}`	Change a pentest that hasn’t started
`verify_pentest_login` `POST /pentests/{id}/login-checks`	Check that Hacktron can sign in to each site
`estimate_pentest` `POST /pentests/{id}/estimate`	Estimate a draft pentest’s credit cost
`get_cost_estimation` `GET /cost-estimations/{id}`	Get a pentest’s cost estimate
`get_credit_balance` `GET /credits`	Read your organisation’s Whitebox credit balance
`start_pentest` `POST /pentests/{id}/start`	Start a pentest and spend its credits (admins only)
`discard_pentest_draft` `DELETE /pentests/{id}`	Delete a pentest that hasn’t started

Review

Tool	Description
`get_pr_review_settings` `GET /pr-review-settings`	Read your organisation’s PR review settings
`update_pr_review_settings` `PATCH /pr-review-settings`	Change the review comments, the check’s severity threshold, and the filters (admins only)
`set_pr_reviews` `POST /repos/pr-reviews`	Turn PR reviews on or off for repositories (admins only)

Warning

For signed-in testing, your assistant sends the login details to Hacktron, which stores them encrypted. Anything you type in the conversation also goes to your assistant’s model provider. Use dedicated test credentials.

When you create an API key, you choose its access scopes. The REST API offers these operations to your own scripts and applications too.

Authentication API overview

MCP

Connect your client

Tools

Scans and findings

Whitebox

Review

Related