list_targetsLABSCO SUMMARY
The whole pentest loop, target to report, inside the tool you fix the code in.
Ownership verification comes before scanning, so the only domains you can test are ones you can prove you control. Scans cost credits: create_scan spends them and get_quota tells you what is left, which is worth reading before a schedule fires on its own.
What it is
A server for the APVISO penetration-testing platform: register targets, verify ownership, run scans, and work through the vulnerabilities they return.
What you get
- A domain registered, ownership verified by DNS, file or meta tag, and targets listed or removed (create_target, get_verification_instructions, verify_target, list_targets, get_target, delete_target)
- A penetration test started and followed to completion (create_scan, get_scan, list_scans)
- The vulnerabilities a scan found, each with a status you can set as you deal with it (list_findings, update_finding_status)
- The full pentest report as markdown (get_report)
- Recurring scans created, listed, changed and removed (create_schedule, list_schedules, get_schedule, update_schedule, delete_schedule)
- Your remaining credit balance (get_quota)
Requirements
An APVISO API key created in the dashboard and passed as APVISO_API_KEY; keys start with apvk_. Runs through npx, and an environment variable can point it at a different API base.
Setup effort
One command plus a key — npx -y @apviso/mcp, then supply credentials
USE CASES
01
Getting a domain ready to test
Register it, read the verification steps, then verify by DNS, file or meta tag.
02
Running a penetration test on a site you just shipped
Start the scan and poll its status until it completes.
03
Working through what a scan found
List the findings, then set each one to fixed or accepted risk as you deal with it.
04
Handing a report to someone who needs it
Pull the full report as markdown and paste it where it has to go.
05
Keeping a site tested without remembering to run it
Create a schedule and check later what is queued against it.
06
Checking what a scan will cost you first
Read the remaining quota before starting a test or letting a schedule run.
18 tools
Listed in project docs. Your client may show a different list.
get_targetcreate_targetverify_targetget_verification_instructionsdelete_targetlist_scansget_scancreate_scanlist_findingsupdate_finding_statusget_reportlist_schedulesget_schedulecreate_scheduleupdate_scheduledelete_scheduleget_quotaBEFORE YOU INSTALL
What to know first
Tools you get
18 tools named in the project's documentation.
Requires
- npx on PATH
- APVISO_API_KEY in your environment
INSTALLATION
Connect your client
Server setup
TERMINAL
npx -y @apviso/mcpMCP Clients
Claude Code
CLAUDE CODE · TERMINAL
claude mcp add --transport stdio apviso \
--env APVISO_API_KEY=<YOUR_APVISO_API_KEY> \
-- npx -y @apviso/mcpClaude Code — Windows
CLAUDE CODE — WINDOWS · TERMINAL
claude mcp add --transport stdio apviso ^
--env APVISO_API_KEY=<YOUR_APVISO_API_KEY> ^
-- cmd /c npx -y @apviso/mcpAny MCP client — inline key
ANY MCP CLIENT — INLINE KEY · JSON
{
"mcpServers": {
"apviso": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@apviso/mcp"
],
"env": {
"APVISO_API_KEY": "<YOUR_APVISO_API_KEY>"
}
}
}
}Any MCP client — env variable
ANY MCP CLIENT — ENV VARIABLE · JSON
{
"mcpServers": {
"apviso": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@apviso/mcp"
],
"env": {
"APVISO_API_KEY": "${APVISO_API_KEY}"
}
}
}
}Values written as ${…} are filled in only by clients that expand variables.
