MCP Server Overview

The MCP server lets AI assistants — Claude Code, Cursor, OpenCode, Codex, Claude Web, Claude Desktop — read your Vygl data and trigger AI verification, all without leaving the editor. Authenticate with an API key for editor clients or via OAuth for web clients (no key needed).

Tools exposed

Reads

Tool	What it does
list_authorized_orgs	List the orgs this connector can act in (the entry point for multi-org users).
list_projects	List all projects in your organization.
search_findings	Search findings with filters — severity, status, scan type, file path, project, rule, AI verdict.
get_finding_detail	Full context on a finding — snippet, AI verdict, reasoning, history.
get_security_posture	Org-wide summary — severity counts, MTTR, AI coverage.
get_project_health	Per-project health score with severity breakdown.
list_container_images	All scanned images with CVE counts.
get_container_image_detail	Image layer breakdown and vulnerable packages.
search_image_vulnerabilities	Vulnerabilities (CVEs) in container images.
get_container_correlations	Source dependencies that share a CVE with container findings.
get_container_analysis	Cached AI risk summary for an image.
list_memories	List organizational memory entries.
preview_memory	Render a draft memory’s effective system prompt without saving.
suggest_memory_from_finding	Ask the LLM to draft a memory based on a specific finding.

Writes

Tool	What it does
ai_verify_finding	Trigger AI verification on a finding; returns verdict + reasoning + suggested fix.
triage_finding	Set a single finding’s status (false_positive, ignored, acknowledged, etc.).
bulk_triage_findings	Triage multiple findings in one call.
create_memory	Create an organizational memory entry.

Authentication

Client	Auth
Claude Code, Cursor, OpenCode, Codex	API key (Bearer token).
Claude Web, Claude Desktop	OAuth 2.1 Dynamic Client Registration.

Editor clients use the same API keys you generate in Settings → API Keys. Web clients click “Add custom integration” in Claude, enter the Vygl MCP URL, and complete a browser OAuth flow — no key management.

Data scoping

Every MCP request is scoped to the organization that owns the API key (or the user’s signed-in org for OAuth). Permissions and rate limits match the API key’s scopes — the MCP server is not a privilege bypass.

If your connector is authorized for multiple Vygl orgs (e.g. an OAuth user who belongs to several), call list_authorized_orgs first to discover the available org_ids, then pass org_id on subsequent tool calls to disambiguate.

Pick scopes deliberately

For read-only assistants, scope the API key to read only. Add triage:write to let the AI call triage_finding / bulk_triage_findings. Add memory:write to let it call create_memory. ai_verify_finding is the AI-tier write — leave it on if you want the AI to be able to dispatch verifications, off if you want a human-driven verification flow.

What’s next

See IDE Setup for ready-to-paste configs for every supported client.