LABSCO SUMMARY

The repeater is what decides whether this works on localhost.

Because scanning happens in Bright's cloud rather than on your machine, a public target works immediately and a local one does not — until you create a repeater and start the Bright CLI to route traffic through your network. Worth setting that up before the first "scan my app at localhost" attempt, since it is the step that turns an obvious failure into an obvious success.

What it is

A cloud-hosted server run by Bright, connected over SSE or HTTP with an API key. There is nothing to install: you point your client at Bright's endpoint and the tool calls drive Bright's security-testing platform — listing projects, discovering endpoints, launching scans against them, and reporting findings. Scans run from Bright's cloud against your application.

What you get

Discovery: runDiscovery crawls or reads an API definition, uploadApiDefinition takes an OpenAPI/Swagger file by URL or content, getDiscoveryStatus and listDiscoveries track the runs
Entrypoints: listEntrypoints with filtering by HTTP method, status and text; getEntrypoint, addEntrypoint and editEntrypoint for individual requests
Scanning: runScan targets entrypoints by ID or status, listTests enumerates the available checks such as SQL injection, XSS and CSRF, getScanStatus and listScans follow progress
Findings: listIssues filters by severity — Low, Medium, High, Critical — status or entrypoint
Authentication configs: listAuths, getAuth, addAuth, editAuth cover static headers, OAuth 2.0/OIDC, multi-step HTTP flows, NTLM and browser-based login
Private targets: createRepeater and listRepeaters set up a tunnel so Bright's cloud can reach an application that is not public
listProjects finds the project IDs the other tools need

Requirements

A Bright account and an API key — personal, project or organisation level, with the relevant scopes. The server URL is https://app.brightsec.com/mcp, and the key goes in an Authorization header as Api-Key (declared as BRIGHTSEC_API_KEY). Transport is SSE or HTTP, so any client that supports remote MCP servers can connect. To scan something that is not publicly reachable you also need the Bright CLI running as a repeater. Bright's platform is a commercial product.

Setup effort

Add the hosted endpoint plus a key — paste it into your client, then supply credentials

See installation options

USE CASES

Scanning a running application for vulnerabilities

Ask for a scan of a URL; the client finds the project, gathers entrypoints, runs the scan and reports what came back.

listProjectslistEntrypointsrunScangetScanStatuslistIssues

Turning an OpenAPI spec into an attack surface

Upload the definition and run file-based discovery, so the scanner works from the documented endpoints rather than a crawl.

uploadApiDefinitionrunDiscoverygetDiscoveryStatus

Testing something that only exists on your network

Create a repeater, start the Bright CLI against it, and reference it when launching the scan.

createRepeaterlistRepeatersrunScan

Scanning behind a login

Add an auth configuration — header, OAuth flow or recorded browser login — and run the scan with it applied.

addAuthlistAuthsrunScan

20 tools

Listed in project docs. Your client may show a different list.

listProjects

runDiscovery

getDiscoveryStatus

listDiscoveries

uploadApiDefinition

listEntrypoints

getEntrypoint

addEntrypoint

editEntrypoint

runScan

getScanStatus

listScans

listTests

listIssues

listAuths

INSTALLATION

Connect your client

Server setup

ENDPOINT URL

https://app.brightsec.com/mcp

Add this hosted endpoint to your MCP client using the credentials listed under Requirements.

MCP Clients

VS Code

VS CODE · JSON

{
  "servers": {
    "brightsec.com": {
      "type": "sse",
      "url": "https://app.brightsec.com/mcp",
      "headers": {
        "Authorization": "Api-Key ${input:apiKey}"
      }
    }
  },
  "inputs": [
    {
      "type": "promptString",
      "id": "apiKey",
      "description": "Enter your Bright API Key",
      "password": true
    }
  ]
}

Augment Code

Connection Type: HTTP

Authentication Type: Header

Name: BrightSec

URL: https://app.brightsec.com/mcp

Header Name: Authorization

Header Value: Api-Key YOUR_API_KEY

Cursor

CURSOR · JSON

{
  "mcpServers": {
    "brightsec": {
      "url": "https://app.brightsec.com/mcp",
      "headers": {
        "Authorization": "Api-Key <YOUR_API_KEY>"
      }
    }
  }
}

Windsurf

WINDSURF · JSON

{
  "mcpServers": {
    "brightsec": {
      "serverUrl": "https://app.brightsec.com/mcp",
      "headers": {
        "Authorization": "Api-Key <YOUR_API_KEY>"
      }
    }
  }
}

Any MCP client

Transport: SSE (Server-Sent Events) or HTTP

URL: https://app.brightsec.com/mcp

Auth Header: Authorization: Api-Key YOUR_KEY

Bright Security MCP

The repeater is what decides whether this works on localhost.

What it is

What you get

Requirements

Setup effort

Scanning a running application for vulnerabilities

Turning an OpenAPI spec into an attack surface

Testing something that only exists on your network

Scanning behind a login

20 tools

What to know first

Tools you get

Requires

Connect your client

Server setup

MCP Clients

VS Code

Augment Code

Cursor

Windsurf

Any MCP client

Bright Security MCP

The repeater is what decides whether this works on localhost.

What it is

What you get

Requirements

Setup effort

Scanning a running application for vulnerabilities

Turning an OpenAPI spec into an attack surface

Testing something that only exists on your network

Scanning behind a login

20 tools

What to know first

Tools you get

Requires

Connect your client

Server setup

MCP Clients

VS Code

Augment Code

Cursor

Windsurf

Any MCP client

Same category

ZeroPath MCP Server

Codacy

Kali MCP Server

C++ Core Guidelines