MCP server

Vulmon Recon exposes a remote Model Context Protocol server at:

https://<host>/api/public/v1/mcp

There is nothing to install. This is a remote server over Streamable HTTP, so your client connects to the URL above — no local command, no extra process.

You choose each key's access when you create it: read only, or read and write. A read key can query your data. A write key can also add and remove seeds, set scope, and change the status of a finding.

A client only ever sees the tools its key allows, so a read key does not list the write tools at all. Access cannot be changed afterwards — to change it, revoke the key and add a new one. Keys you created before write access existed are read keys.

Nothing else can be changed over MCP. Tags, owners and notes are read only.

Connect a client

Open Settings → MCP and create an MCP key, then configure your client with the server URL and an authentication header. MCP keys are separate credentials: public REST API keys cannot connect to MCP, and MCP keys cannot call REST endpoints.

The exact settings file differs by client, but clients that support remote HTTP servers commonly accept this shape:

{
  "mcpServers": {
    "vulmon-recon": {
      "url": "https://<host>/api/public/v1/mcp",
      "headers": {
        "Authorization": "Bearer <key>"
      }
    }
  }
}

Do not put the key in the URL or commit it to source control. The client must support remote MCP servers over Streamable HTTP and custom authorization headers; a client that supports only local stdio servers cannot connect directly.

After saving the configuration, restart or reconnect the client. It should discover the server as vulmon-recon and list the available tools automatically.