Labsco
MCP SERVER

Bright Security MCP

by NeuraLegion ↗

Run Bright's DAST scans from your coding assistant — discover endpoints, scan them, and read the vulnerabilities back.

Vulnerability Scanning & Application Security
Summary
The repeater is what decides whether this works on localhost.

Because scanning happens in Bright's cloud rather than on your machine, a public target works immediately and a local one does not — until you create a repeater and start the Bright CLI to route traffic through your network. Worth setting that up before the first "scan my app at localhost" attempt, since it is the step that turns an obvious failure into an obvious success.

What it is

A cloud-hosted server run by Bright, connected over SSE or HTTP with an API key. There is nothing to install: you point your client at Bright's endpoint and the tool calls drive Bright's security-testing platform — listing projects, discovering endpoints, launching scans against them, and reporting findings. Scans run from Bright's cloud against your application.

What you get
  • Discovery: `runDiscovery` crawls or reads an API definition, `uploadApiDefinition` takes an OpenAPI/Swagger file by URL or content, `getDiscoveryStatus` and `listDiscoveries` track the runs
  • Entrypoints: `listEntrypoints` with filtering by HTTP method, status and text; `getEntrypoint`, `addEntrypoint` and `editEntrypoint` for individual requests
  • Scanning: `runScan` targets entrypoints by ID or status, `listTests` enumerates the available checks such as SQL injection, XSS and CSRF, `getScanStatus` and `listScans` follow progress
  • Findings: `listIssues` filters by severity — `Low`, `Medium`, `High`, `Critical` — status or entrypoint
  • Authentication configs: `listAuths`, `getAuth`, `addAuth`, `editAuth` cover static headers, OAuth 2.0/OIDC, multi-step HTTP flows, NTLM and browser-based login
  • Private targets: `createRepeater` and `listRepeaters` set up a tunnel so Bright's cloud can reach an application that is not public
  • `listProjects` finds the project IDs the other tools need
Requirements

A Bright account and an API key — personal, project or organisation level, with the relevant scopes. The server URL is `https://app.brightsec.com/mcp`, and the key goes in an `Authorization` header as `Api-Key` (declared as `BRIGHTSEC_API_KEY`). Transport is SSE or HTTP, so any client that supports remote MCP servers can connect. To scan something that is not publicly reachable you also need the Bright CLI running as a repeater. Bright's platform is a commercial product.

Setup effort

One command plus a key — npx -y mcp-remote https://app.brightsec.com/mcp, then supply credentials