# 42Crunch MCP for AI Agents AI Agent Connect

> 42Crunch MCP lets you manage your API security lifecycle through your AI agent. You can import OpenAPI specs, trigger security audits, and check conformance scans without leaving your workspace. It pulls real-time security scores and detailed risk reports directly into your conversation.

## Overview
- **Category:** developer-tools
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_Gi3PrK2xNbiurYu9rVegSxEQmPykAdCxogXvksIV/ai-agent-connect
- **Tags:** api-security, vulnerability-scanning, openapi, swagger, security-audit, shift-left

## Description

Connecting your 42Crunch account to your AI agent changes how you handle API security from a chore into a conversation. Instead of jumping between tabs to upload Swagger files or hunting through dashboards to find out why an endpoint failed a scan, you just ask your agent to do it. You can bring in new specifications, check the security health of your various collections, and get immediate feedback on design risks. It handles the heavy lifting of fetching audit reports and tracking historical scans so you can focus on fixing the actual vulnerabilities. This Connector is part of the Vinkius catalog, making it easy to plug into your existing workflow. You get a clear picture of your security posture without the manual overhead of navigating complex UIs. It's about getting answers fast so you can ship code with confidence.

## Tools

### get_audit_report
Downloads the static security audit report for a specific API to show design risks.

### list_scans
Shows a history of dynamic conformance scans performed against a live API.

### get_scan_report
Provides the results of a dynamic conformance scan to highlight implementation flaws.

### trigger_audit
Starts a fresh static security audit on an API definition after you update the spec.

### delete_api
Removes an API definition from your platform to keep your environment clean.

### get_api
Pulls detailed metadata and the current security score for a specific API.

### get_collection
Fetches the metadata and security score for an entire API collection.

### import_api
Brings an OpenAPI definition into a collection for immediate security testing.

### list_apis
Shows all API entries in a collection along with their unique IDs and scores.

### list_collections
Lists all your API collections so you can find the right ID for your work.

## Prompt Examples

**Prompt:** 
```
What's the security score for my 'Payments' collection?
```

**Response:** 
```
The **Payments** collection currently has a security score of **85/100**. 

Here is the breakdown:
- **Total APIs**: 12
- **High Risk Endpoints**: 2
- **Status**: Needs attention on the `/process` route.

Would you like me to pull the audit report for that specific API?
```

**Prompt:** 
```
Run a security audit on the 'User Auth' API and tell me the top 3 risks.
```

**Response:** 
```
I have triggered a new static security audit for the **User Auth** API. 

Here are the top 3 risks identified:
1. **Missing Rate Limits** on `/login` (CWE-307)
2. **OAuth2 Scope Issues**
3. **Generic Object Acceptance** in user schema

I can provide the full report or suggest the YAML fixes for these.
```

**Prompt:** 
```
List all my recent conformance scans for the 'Gateway' API.
```

**Response:** 
```
Here are the recent dynamic conformance scans for the **Gateway** API:

| Scan ID | Date | Status | 
| :--- | :--- | :--- |
| `sc_9921` | 2026-07-10 | Completed |
| `sc_9880` | 2026-07-08 | Completed |
| `sc_9850` | 2026-07-05 | Completed |

Would you like to see the detailed results for the most recent one?
```

## Capabilities

### Import OpenAPI definitions
Bring your Swagger or OpenAPI specs into your collections for immediate testing.

### Trigger static security audits
Run a fresh security audit on an API definition as soon as you update it.

### Retrieve security audit reports
Get a detailed breakdown of design risks and security scores for any API.

### Monitor collection security scores
View the aggregated security health of your entire API collections at once.

### Review dynamic conformance scans
Access historical reports on how your live APIs behave in production.

### Manage API lifecycle
Delete decommissioned definitions to keep your security environment clean.

## Use Cases

### Instant audit after a spec update
A developer updates a Swagger file and asks the agent to trigger_audit. The agent confirms the scan started and then retrieves the report to show the new security score.

### Security health overview for platform teams
A platform lead asks the agent to list_collections. The agent shows the security scores for all microservices, highlighting which ones need immediate attention.

### Identifying production behavior flaws
An engineer notices an issue in production and asks the agent to list_scans for the Gateway API to find the last dynamic conformance report.

### Cleaning up decommissioned APIs
A team is retiring an old service. They ask the agent to delete_api to ensure the old definition no longer shows up in their security audits.

## Benefits

- Skip manual uploads by using import_api to bring specs into your collections instantly.
- Get immediate feedback on design flaws using trigger_audit and get_audit_report for every update.
- Monitor the security health of your entire microservices ecosystem using list_collections and get_collection.
- Spot undocumented behavior in live environments by reviewing results from list_scans and get_scan_report.
- Clean up your environment quickly by removing old specs with delete_api to maintain a single source of truth.

## How It Works

The bottom line is you get automated API security governance directly inside your AI chat.

1. Subscribe to the Connector and provide your 42Crunch API token.
2. Connect your preferred AI client to the 42Crunch instance.
3. Ask your agent to audit a spec or check a collection score.

## Frequently Asked Questions

**Can I use 42Crunch MCP to find my API security scores?**
Yes, you can see security scores for specific APIs and entire collections. Your agent can pull these scores instantly to give you a snapshot of your security health.

**How do I get a security audit report through the 42Crunch MCP?**
Just ask your agent to trigger an audit and then fetch the report. It will pull the full details of design risks and vulnerabilities directly into the chat.

**Can I import OpenAPI specs into my 42Crunch account using an AI agent?**
Yes, the Connector allows you to import definitions directly into your collections. This lets you start security testing as soon as you finish writing your spec.

**Does 42Crunch MCP support both static and dynamic scans?**
It does. You can trigger static audits for your specifications and view reports for dynamic conformance scans against your live APIs.

**Can I manage my API collections with this Connector?**
Yes, you can list, view, and delete collections and their definitions. It makes it easy to organize your environment and keep it clean.

**Is 42Crunch MCP good for DevSecOps teams?**
It is built for them. It automates the feedback loop between code updates and security results, helping teams catch vulnerabilities earlier in the lifecycle.

**Can my AI agent explain the vulnerabilities found in a 42Crunch audit?**
Yes. After retrieving an audit report using your agent, you can ask the agent to act as a DevSecOps engineer. It can break down exactly why you received a low score, explain specific OWASP findings, and write the YAML or JSON patch needed to fix your OpenAPI spec instantly.

**How do I test a new API update before merging?**
Simply paste your updated OpenAPI definitions into your AI agent's chat context. Ask the agent to import the new API definition into a staging collection. The platform will automatically run a static security audit upon import, and your agent can report back the new security score before you hit merge.

**What is the difference between static audits and dynamic conformance scans?**
Audits strictly verify the design of your JSON/YAML contract against security best practices without making network calls. Scans, however, send live HTTP traffic against your implemented endpoint to make sure your back-end truly conforms to what you wrote. Your agent can retrieve both reports for side-by-side comparison.