Security — MCP Tools
14 tools in the Security group of the Routebase MCP server.
cancel_scan_run
Ask a running security scan to stop. Idempotent — cancelling a run that already completed, failed or was cancelled changes nothing. The worker observes the request between scanner steps, so the run stays 'running' for a moment afterwards; poll list_scan_runs for the final status. Requires project context.
Required scope: security:execute
| Parameter | Type | Required | Description |
|---|---|---|---|
scanRunId |
string | Yes | Public Id (Guid) of the scan run to cancel (from list_scan_runs) |
export_findings_sarif
Export the active project's security findings as a SARIF 2.1.0 document — the format GitHub Code Scanning and comparable CI tools ingest. Defaults to open findings so the export reflects the current posture. Requires project context.
Required scope: security:read
| Parameter | Type | Required | Description |
|---|---|---|---|
status |
string | No | Only findings in this status: 'open' (default), 'inProgress', 'fixed', 'falsePositive', 'acceptedRisk' or 'duplicate' |
get_finding_remediation
Get remediation advice for a single finding as GitHub-flavored markdown. When AI Assist is enabled and within budget this is a suggestion written for this exact finding; otherwise it falls back to the static guidance-library text and says so in 'source'. Unlike the other reads this one can spend AI budget, which is why it is a separate tool. Requires project context.
Required scope: security:read
| Parameter | Type | Required | Description |
|---|---|---|---|
findingId |
string | Yes | Public Id (Guid) of the finding (from get_security_findings) |
get_security_findings
List security findings for the active project, optionally filtered by status, severity, scanner, or a free-text search. Findings are ordered by severity (most severe first). Pass findingId to get one finding in full, including the raw evidence the scanner captured (request and response) — that blob is omitted from the list to keep it small. Requires project context.
Required scope: security:read
| Parameter | Type | Required | Description |
|---|---|---|---|
findingId |
string | No | Public Id (Guid) of a single finding. When given, the filters are ignored. |
status |
string | No | Filter by status: 'open', 'inProgress', 'fixed', 'falsePositive', 'acceptedRisk', 'duplicate' (omit for all) |
severity |
string | No | Filter by severity: 'info', 'low', 'medium', 'high', 'critical' (omit for all) |
scannerId |
string | No | Filter by scanner id (omit for all scanners) |
search |
string | No | Free-text search over finding title/description |
skip |
integer | No (default 0) |
Number of findings to skip (for pagination, default 0) |
take |
integer | No (default 50) |
Number of findings to return (default 50, max 100) |
get_security_score
Get the active project's security score (0–100) and the count of open findings by severity. Pass trendDays to also get the daily score history over that many days — that is how you tell whether a project is improving or drifting. Requires project context.
Required scope: security:read
| Parameter | Type | Required | Description |
|---|---|---|---|
trendDays |
integer | No | Days of score history to include, 1-365. Omit for the current score only. |
list_personas
List the security personas of the active project — the identities the authorization scanners impersonate. Pass personaId to get a single one. Secret values in the auth config are always returned masked as '********'; the plain values never leave the server. Requires project context.
Required scope: security:read
| Parameter | Type | Required | Description |
|---|---|---|---|
personaId |
string | No | Public Id (Guid) of a single persona. When given, only that persona is returned. |
list_scan_profiles
List the security scan profiles configured for the active project. A scan profile bundles the target spec/environment and the enabled scanners; its public ID is required by run_security_scan. Pass scanProfileId to get one profile with its full configuration instead. Requires project context.
Required scope: security:read
| Parameter | Type | Required | Description |
|---|---|---|---|
scanProfileId |
string | No | Public Id (Guid) of a single scan profile. When given, returns it in full. |
list_scan_runs
List the security scan runs of the active project, newest first. Pass scanRunId to get a single run with its live progress instead — that is how you poll a scan started by run_security_scan. Requires project context.
Required scope: security:read
| Parameter | Type | Required | Description |
|---|---|---|---|
scanRunId |
string | No | Public Id (Guid) of a single scan run. When given, the filters are ignored. |
scanProfileId |
string | No | Only runs of this scan profile (public Guid) |
status |
string | No | Only runs in this state: 'queued', 'running', 'completed', 'failed' or 'cancelled' |
page |
integer | No (default 1) |
Page number, 1-based (default 1) |
pageSize |
integer | No (default 25) |
Runs per page (default 25, max 100) |
list_security_guidance
List the static security guidance library — one entry per OWASP API-security issue with its remediation text, code examples and references. Pass guidanceId (the guidanceId of a finding) for a single entry. The library is global, not project-specific.
Required scope: security:read
| Parameter | Type | Required | Description |
|---|---|---|---|
guidanceId |
string | No | Id of a single guidance entry, e.g. 'api2-jwt-alg-none'. Returns it with code examples. |
manage_persona
Create, update or delete a security persona. action: 'create' (needs name and authConfigJson), 'update' (needs personaId and name; omit authConfigJson to keep the stored credentials), 'delete' (needs personaId — fails while a scan profile still assigns the persona). Requires project context.
Required scope: security:write
| Parameter | Type | Required | Description |
|---|---|---|---|
action |
string | Yes | What to do: 'create', 'update' or 'delete' |
personaId |
string | No | Public Id (Guid) of the persona. Required for 'update' and 'delete'. |
name |
string | No | Persona name, e.g. 'admin' or 'guest'. Required for 'create' and 'update'. |
description |
string | No | Optional description of who this identity represents |
authConfigJson |
string | No | Auth config as JSON with a 'type' field, e.g. {"type":"bearer","token":"…"} or {"type":"basic","username":"…","password":"…"}. Pass plain values — they are encrypted server-side. Required for 'create'. On 'update', omitting it keeps the stored credentials; never pass the masked '********' value back. |
manage_scan_profile
Create, update or delete a security scan profile — the target spec + environment, the enabled scanners and the request budget a scan run uses. action: 'create' (needs name, environmentId, apiSpecId and scannersJson), 'update' (needs scanProfileId; every omitted field keeps its current value), 'delete' (needs scanProfileId). Get profile ids from list_scan_profiles. Requires project context.
Required scope: security:write
| Parameter | Type | Required | Description |
|---|---|---|---|
action |
string | Yes | What to do: 'create', 'update' or 'delete' |
scanProfileId |
string | No | Public Id (Guid) of the scan profile. Required for 'update' and 'delete'. |
name |
string | No | Profile name. Required for 'create'. |
description |
string | No | Optional description |
environmentId |
string | No | Public Id (Guid) of the environment to scan (from list_environments). Required for 'create'. |
apiSpecId |
string | No | Public Id (Guid) of the API specification to scan (from list_specs). Required for 'create'. |
scannersJson |
string | No | JSON object mapping scanner id to enabled, e.g. {"api2-broken-auth":true}. At least one scanner must be true. Known scanner ids: api1-bola, api1-bola-enum, api2-broken-auth, api3-property-auth, api4-resource-consumption, api5-bfla, api6-business-flow, api7-ssrf, api8-misconfig, api8-tls-version, api9-inventory, fuzz-schema, fuzz-mutation. An unknown id is not rejected — it is simply never run. Required for 'create'. |
personaAssignmentsJson |
string | No | JSON object mapping scanner id to the persona names it should use, e.g. {"api1-bola":["admin","guest"]}. Personas come from list_personas; the BOLA and BFLA scanners need at least two, the property-auth scanner one. |
excludedEndpointIds |
string | No | Comma-separated endpoint public Ids to exclude from the scan |
maxConcurrentRequests |
integer | No | Parallel requests the scan may send, 1-50 (default 5 on create) |
requestDelayMs |
integer | No | Delay between requests in milliseconds, 0-10000 (default 200 on create) |
requestTimeBudgetSeconds |
integer | No | Wall-clock budget for a run in seconds, 30-3600 (default 600 on create) |
enableRateLimitProbe |
boolean | No | Send oversized payloads to probe rate limits (default false on create) |
maxProbePayloadBytes |
integer | No | Size of the payload probe in bytes (default 1048576 on create) |
fuzzingIntensity |
string | No | Fuzzing intensity: 'off', 'low', 'medium' or 'high' (default 'off' on create) |
notifyOnCritical |
boolean | No | Notify on new critical findings. 'update' only. |
notifyOnHigh |
boolean | No | Notify on new high findings. 'update' only. |
isEnabled |
boolean | No | Whether the profile is active. 'update' only. |
scheduleCron |
string | No | Cron expression for scheduled runs, or an empty string to unschedule. 'update' only. |
run_security_scan
Enqueue a security scan run for the active project using an existing scan profile. Use list_scan_profiles to obtain a scanProfileId. The scan runs asynchronously; poll get_security_findings and get_security_score for results once it completes. Requires project context.
Required scope: security:execute
| Parameter | Type | Required | Description |
|---|---|---|---|
scanProfileId |
string | Yes | Public ID (GUID) of the scan profile to run (from list_scan_profiles) |
test_persona
Probe a persona's credentials against an environment before a scan relies on them — one GET to probePath with the persona's resolved auth. A 2xx, 401 or 403 counts as success: the headers reached the target. Requires project context.
Required scope: security:read
| Parameter | Type | Required | Description |
|---|---|---|---|
personaId |
string | Yes | Public Id (Guid) of the persona to probe (from list_personas) |
environmentId |
string | Yes | Public Id (Guid) of the environment supplying the base URL (from list_environments) |
probePath |
string | No | Path to probe, default '/' |
update_finding_status
Triage one or several security findings — set their status, optionally assign them to a user and record resolution notes. Pass a single finding id for strict behaviour: an illegal status transition is an error and the updated finding is returned. Pass several comma-separated ids for best-effort behaviour: valid findings are updated and the response lists every id that was skipped with its reason. Get finding ids from get_security_findings. Requires project context.
Required scope: security:write
| Parameter | Type | Required | Description |
|---|---|---|---|
findingIds |
string | Yes | Public Id (Guid) of the finding, or several ids separated by commas |
status |
string | Yes | New status: 'open', 'inProgress', 'fixed', 'falsePositive', 'acceptedRisk' or 'duplicate' |
assignedToUserId |
string | No | Public Id (Guid) of the user to assign the finding(s) to. Omit to leave the current assignee unchanged. |
resolutionNotes |
string | No | Free-text note stored with the finding, e.g. why it was accepted as a risk |