Summary
The whole pentest loop, target to report, inside the tool you fix the code in.
Ownership verification comes before scanning, so the only domains you can test are ones you can prove you control. Scans cost credits: create_scan spends them and get_quota tells you what is left, which is worth reading before a schedule fires on its own.
What it is
A server for the APVISO penetration-testing platform: register targets, verify ownership, run scans, and work through the vulnerabilities they return.
What you get
- A domain registered, ownership verified by DNS, file or meta tag, and targets listed or removed (create_target, get_verification_instructions, verify_target, list_targets, get_target, delete_target)
- A penetration test started and followed to completion (create_scan, get_scan, list_scans)
- The vulnerabilities a scan found, each with a status you can set as you deal with it (list_findings, update_finding_status)
- The full pentest report as markdown (get_report)
- Recurring scans created, listed, changed and removed (create_schedule, list_schedules, get_schedule, update_schedule, delete_schedule)
- Your remaining credit balance (get_quota)
Requirements
An APVISO API key created in the dashboard and passed as APVISO_API_KEY; keys start with apvk_. Runs through npx, and an environment variable can point it at a different API base.
Setup effort
One command plus a key — npx -y @apviso/mcp, then supply credentials