{
  "markdown": "# Bright MCP Integration\n\nBright's [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) integration brings **AI-powered application security testing** directly into your development workflow. Your AI coding assistant can discover API endpoints, run security scans, and review vulnerabilities — all through natural language conversation.\n\n> **Bright MCP is a remote, cloud-hosted MCP server.** There is nothing to install locally — you simply point your MCP-compatible client at Bright's endpoint and authenticate with an API key.\n\n## Quick Start\n\n### 1. Get a Bright API Key\n\nCreate a dedicated API key in your Bright account. This can be a **personal**, **project**, or **organization-level** key with the relevant scopes. See [Personal API Key Scopes](https://docs.brightsec.com/docs/personal-api-key-scopes) for details.\n\n### 2. Configure Your Client\n\nAdd Bright as a remote MCP server in your IDE or tool of choice. The server URL is:\n\n```\nhttps://app.brightsec.com/mcp\n```\n\n> **Note:** If your organization uses a dedicated Bright cluster, replace `app.brightsec.com` with your cluster's hostname.\n\nSee [Client Configuration](#client-configuration) below for IDE-specific instructions.\n\n### 3. Start Using It\n\nAsk your AI assistant something like:\n\n```\nScan https://my-app.example.com for security vulnerabilities\n```\n\nYour assistant will use the Bright MCP tools to list projects, discover entrypoints, run scans, and report findings.\n\n---\n\n## Client Configuration\n\n### VS Code (GitHub Copilot)\n\nAdd the following to your MCP configuration (via Command Palette → \"MCP: Add Server\" → Global, or manually edit your `mcp.json`):\n\n```json\n{\n  \"servers\": {\n    \"brightsec.com\": {\n      \"type\": \"sse\",\n      \"url\": \"https://app.brightsec.com/mcp\",\n      \"headers\": {\n        \"Authorization\": \"Api-Key ${input:apiKey}\"\n      }\n    }\n  },\n  \"inputs\": [\n    {\n      \"type\": \"promptString\",\n      \"id\": \"apiKey\",\n      \"description\": \"Enter your Bright API Key\",\n      \"password\": true\n    }\n  ]\n}\n```\n\nThen go to the **Extensions tab**, right-click the **brightsec.com** MCP server, and choose **Start Server**. You'll be prompted to enter your API key.\n\n> Full guide: [Configure Bright MCP in VS Code](https://docs.brightsec.com/docs/configure-in-vscode)\n\n### Augment Code\n\n1. Open the **Augment Code** extension settings → **Tools** → **MCP**.\n2. Click **+ Add remote MCP**.\n3. Fill in:\n   - **Connection Type:** HTTP\n   - **Authentication Type:** Header\n   - **Name:** BrightSec\n   - **URL:** `https://app.brightsec.com/mcp`\n   - **Header Name:** `Authorization`\n   - **Header Value:** `Api-Key YOUR_API_KEY`\n4. Click **Save**.\n\n> Full guide: [Configure Bright MCP in Augment Code](https://docs.brightsec.com/docs/configure-bright-mcp-in-augment-code)\n\n### Cursor\n\nAdd to your Cursor MCP settings (`.cursor/mcp.json`):\n\n```json\n{\n  \"mcpServers\": {\n    \"brightsec\": {\n      \"url\": \"https://app.brightsec.com/mcp\",\n      \"headers\": {\n        \"Authorization\": \"Api-Key YOUR_API_KEY\"\n      }\n    }\n  }\n}\n```\n\n### Windsurf\n\nAdd to your Windsurf MCP configuration (`~/.codeium/windsurf/mcp_config.json`):\n\n```json\n{\n  \"mcpServers\": {\n    \"brightsec\": {\n      \"serverUrl\": \"https://app.brightsec.com/mcp\",\n      \"headers\": {\n        \"Authorization\": \"Api-Key YOUR_API_KEY\"\n      }\n    }\n  }\n}\n```\n\n### Generic MCP Client\n\nAny MCP-compatible client that supports **remote HTTP/SSE servers** can connect to Bright. Configure it with:\n\n| Setting         | Value                              |\n| --------------- | ---------------------------------- |\n| **Transport**   | SSE (Server-Sent Events) or HTTP   |\n| **URL**         | `https://app.brightsec.com/mcp`    |\n| **Auth Header** | `Authorization: Api-Key YOUR_KEY`  |\n\n---\n\n## Available Tools\n\nBright MCP exposes the following tools to your AI assistant:\n\n### Project Management\n\n| Tool | Description |\n| ---- | ----------- |\n| **listProjects** | List all projects accessible to your API key. Use this to find project IDs needed for other operations. |\n\n### Endpoint Discovery\n\n| Tool | Description |\n| ---- | ----------- |\n| **runDiscovery** | Discover API endpoints using crawling (`crawlerUrls`) or API definitions (`fileId` from `uploadApiDefinition`). Before running, check if the project already has entrypoints with `listEntrypoints`. For private/local targets, specify a connected repeater via `repeaters`. |\n| **getDiscoveryStatus** | Get the current status of a discovery run. |\n| **listDiscoveries** | List discovery history for a project. View past discovery runs or monitor ongoing endpoint discovery. |\n| **uploadApiDefinition** | Upload an API definition file (OpenAPI/Swagger) by URL or content. Returns a file ID to reference in discovery runs. |\n\n### Entrypoint Management\n\n| Tool | Description |\n| ---- | ----------- |\n| **listEntrypoints** | List discovered API endpoints/URLs for a project. Use this to select entrypoints for scans or evaluate attack surface coverage. Supports filtering by HTTP method, status, and text search. |\n| **getEntrypoint** | Get detailed information about a specific entrypoint by ID, including headers, body, and configuration. |\n| **addEntrypoint** | Add a new entrypoint to a project. Entrypoints define HTTP requests (method, URL, headers, body) that can be used for security scanning. |\n| **editEntrypoint** | Update an existing entrypoint. Modify the HTTP request definition, authentication, or repeater settings. |\n\n### Security Scanning\n\n| Tool | Description |\n| ---- | ----------- |\n| **runScan** | Start a security scan against selected entrypoints. Supports targeting specific entrypoints by ID or by status (e.g., `new`, `changed`, `vulnerable`). Configure which tests to run or use a scan template. For private/local targets, specify a connected repeater. |\n| **getScanStatus** | Get the current status of a running scan. |\n| **listScans** | List scan history for a project. View past scan results or check the status of multiple ongoing scans. |\n| **listTests** | List all available security tests (e.g., SQL injection, XSS, CSRF) that can be included in scans. |\n\n### Vulnerability Management\n\n| Tool | Description |\n| ---- | ----------- |\n| **listIssues** | List security vulnerabilities found for a project. Filter by severity (`Low`, `Medium`, `High`, `Critical`), status (`new`, `recurring`, `resolved`, `ignored`), or entrypoint. |\n\n### Authentication Configuration\n\n| Tool | Description |\n| ---- | ----------- |\n| **listAuths** | List authentication configurations for a project. Use before scanning protected endpoints that require authentication. |\n| **getAuth** | Get detailed information about a specific authentication configuration. |\n| **addAuth** | Create a new authentication configuration. Supports multiple auth types: static headers, OAuth 2.0/OIDC, multi-step HTTP flows, NTLM, browser-based login, and recorded browser flows. |\n| **editAuth** | Update an existing authentication configuration. |\n\n### Private/Local Target Access\n\n| Tool | Description |\n| ---- | ----------- |\n| **createRepeater** | Create a repeater for accessing private/local targets. After creation, run the Bright CLI to start the repeater and establish the connection. |\n| **listRepeaters** | List repeaters and their connection status. Verify a repeater is connected before scanning non-public applications. |\n\n---\n\n## Usage Examples\n\n### Scan a Public Application\n\n> \"Scan https://my-app.example.com for security vulnerabilities\"\n\nThe assistant will:\n1. List your projects to find the appropriate one\n2. Get all discovered entrypoints for the project\n3. Run a security scan against those entrypoints\n4. Monitor the scan status and report findings\n\n### Discover Endpoints from an OpenAPI Spec\n\n> \"Discover API endpoints from the OpenAPI spec at https://my-app.example.com/openapi.json\"\n\nThe assistant will:\n1. Upload the OpenAPI definition file\n2. Run file-based discovery\n3. Monitor the discovery status\n\n### Scan a Local/Private Application\n\n> \"Scan my local application at http://localhost:3000\"\n\nThe assistant will:\n1. Check if Bright CLI is installed for repeater connectivity\n2. List your projects to find the appropriate one\n3. Create a repeater if needed\n4. Run a security scan through the repeater\n5. Monitor the scan status and report findings\n\n### Check for Critical Vulnerabilities\n\n> \"Show me all critical and high severity issues in my project\"\n\nThe assistant will:\n1. List your projects\n2. Query issues filtered by `Critical` and `High` severity\n3. Present findings with details\n\n### Scan with Authentication\n\n> \"Scan my API that requires Bearer token authentication\"\n\nThe assistant will:\n1. Create or find an existing auth configuration\n2. Set up the proper headers/token flow\n3. Run the scan with authentication applied\n\nSee the [`examples/`](./examples/) directory for more detailed workflow examples.\n\n---\n\n## How It Works\n\n```\n┌─────────────────────┐         ┌──────────────────────┐\n│   AI Assistant       │  MCP    │   Bright Cloud       │\n│   (VS Code, Cursor,  │◄──────►│   (app.brightsec.com)│\n│    Windsurf, etc.)   │  SSE    │                      │\n└─────────────────────┘         └──────────┬───────────┘\n                                           │\n                                           │ Scans\n                                           ▼\n                                ┌──────────────────────┐\n                                │   Your Application   │\n                                │   (public or via      │\n                                │    repeater)          │\n                                └──────────────────────┘\n```\n\n1. **Your AI assistant** connects to Bright's MCP endpoint over SSE/HTTP.\n2. **Bright's cloud platform** receives tool calls and orchestrates security operations.\n3. **Scans run against your application** — either directly (public targets) or through a **Repeater** (private/local targets).\n\n---\n\n## Repeaters (Private/Local Targets)\n\nTo scan applications that aren't publicly accessible, Bright uses **Repeaters** — lightweight agents that route scan traffic from Bright's cloud through your local network.\n\n1. Create a repeater via the MCP tool (`createRepeater`)\n2. Start the repeater using the Bright CLI:\n   ```bash\n   bright-cli repeater \\\n     --id <REPEATER_ID> \\\n     --hostname app.brightsec.com \\\n     --token <YOUR_API_KEY>\n   ```\n3. Reference the repeater when running scans or discoveries\n\n> See the [Bright CLI Installation Guide](https://docs.brightsec.com/docs/cli-installation-guide) for setup instructions.\n\n---\n\n## Resources\n\n- [Bright Documentation](https://docs.brightsec.com/)\n- [Bright MCP Tools Reference](https://docs.brightsec.com/docs/bright-mcp-tools)\n- [VS Code Configuration Guide](https://docs.brightsec.com/docs/configure-in-vscode)\n- [Augment Code Configuration Guide](https://docs.brightsec.com/docs/configure-bright-mcp-in-augment-code)\n- [API Key Scopes](https://docs.brightsec.com/docs/personal-api-key-scopes)\n- [Bright CLI Installation](https://docs.brightsec.com/docs/cli-installation-guide)\n- [Model Context Protocol Specification](https://modelcontextprotocol.io/)\n\n---\n\n## License\n\nThis repository contains configuration examples and documentation for Bright's MCP integration. Bright's security scanning platform is a commercial SaaS product — visit [brightsec.com](https://brightsec.com) for more information.\n",
  "bytes": 11335,
  "sha": "684d3999d899c69bf91743b8fe6fb09f570c78a2e965037c897be8be141f0079",
  "repo_slug": "neuralegion/mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_neuralegion_mcp_caf18506/readme"
}