# Equixly MCP for AI Agents AI Agent Connect

> Equixly automates API security testing. It lets you manage target services, trigger autonomous AI pentests, and audit vulnerability findings directly from your AI agent. It handles the heavy lifting of finding BOLA, IDOR, and injection flaws so you don't have to manually run every scan.

## Overview
- **Category:** developer-tools
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_nyZHBp8MEawkoza3tzHMDtA3eBgX7w9c0cUuHFQx/ai-agent-connect
- **Tags:** api-security, penetration-testing, autonomous-testing, vulnerability-management, cybersecurity, logic-errors

## Description

Equixly lets you put your API security on autopilot. Instead of jumping between different security tools and spreadsheets to track vulnerabilities, you can just talk to your AI agent to see what's broken. You can register new API targets, upload your specs, and tell your agent to start a penetration test right now. It handles the complex stuff like exploring the attack surface for logic errors or broken authentication. When the scan finishes, you can ask for a list of the most critical issues, get the specific evidence of how they were exploited, and see exactly how to fix them. It's a huge shift from reactive security to proactive management. Because Vinkius hosts this Connector, you can plug it into your existing workflow and get these security insights directly where you're already working.

## Tools

### create_service
Register a new API target with a base URL and name. This lets you define what the AI should attack.

### delete_service
Remove an API service and its history from your account. Use this to clean up old test environments.

### list_scans
See all past and active pentest sessions for a service. It shows the status and total vulnerabilities found.

### list_services
View all the API base URLs you've registered. This helps you keep track of your entire attack surface.

### get_scan_findings
Download a list of all exploitable vulnerabilities from a finished scan. It includes severity and remediation steps.

### get_scan
Get a summary of a specific pentest scan. You can see the total requests made and the severity breakdown.

### get_service
Fetch the configuration details for a specific API service. You need this before you can modify scan behavior.

### list_api_specs
See which API specifications you've uploaded for a service. This helps you manage your attack surface coverage.

### trigger_scan
Launch a new autonomous AI penetration test against a target. It checks for BOLA, IDOR, and injection flaws.

### upload_api_spec
Upload a Postman, OpenAPI, or GraphQL spec to a service. This tells the AI exactly what it's allowed to test.

## Prompt Examples

**Prompt:** 
```
Trigger a security scan for API service 'Billing-v1'
```

**Response:** 
```
Pentest initiated! I've triggered an autonomous attack session for 'Billing-v1' (ID: svc_123). The AI Hacker is now exploring and testing your API. I'll notify you when the results are ready.
```

**Prompt:** 
```
Show me the critical findings from the latest scan of service 'Payments'
```

**Response:** 
```
Retrieving findings for 'Payments'... I found 2 critical vulnerabilities: **Unauthenticated IDOR on /users/me** and **BOLA on /orders/{id}**. Would you like the remediation guidance for these?
```

**Prompt:** 
```
List all registered API target services
```

**Response:** 
```
I found 3 registered services: 

| Name | URL |
| --- | --- |
| Billing-v1 | https://api.billing.com |
| Payments | https://pay.example.com |
| Auth-Service | https://auth.example.com |

Each is configured for continuous security monitoring.
```

## Capabilities

### Trigger autonomous pentests
Start a full attack session to find flaws like BOLA or injection.

### Manage API targets
Register and organize the base URLs and rules for your services.

### Audit vulnerabilities
Get a list of confirmed flaws with severity ratings and remediation steps.

### Monitor scan progress
Track how many requests were made and which endpoints were hit in real time.

### Upload API specs
Provide OpenAPI or GraphQL files to help the AI discover more attack surface.

### Fetch target metadata
Get details on authentication hooks and production safety toggles.

## Use Cases

### Immediate post-deployment checks
A developer just pushed a new billing API. They ask the agent to trigger_scan to check for injection flaws immediately.

### Security audit summaries
A security lead needs a summary of the last week's tests. They ask the agent to list_scans and summarize the critical findings.

### Remediation guidance for high-risk flaws
A team needs to know how to fix a high-severity BOLA. They use get_scan_findings to get the exact remediation guidance.

### Verifying attack surface coverage
A developer wants to see what endpoints the AI can see. They use list_api_specs to verify the uploaded OpenAPI file is correct.

## Benefits

- Stop manual scanning: Use trigger_scan to start a full pentest without clicking through a complex UI.
- Faster remediation: Get specific evidence and fix instructions for flaws using get_scan_findings.
- Better coverage: Upload specs with upload_api_spec so the AI knows every endpoint to test.
- Real-time tracking: Monitor scan progress and request counts with list_scans and get_scan.
- Centralized management: Keep all your API targets organized in one place using list_services.
- Proactive security: Identify BOLA and IDOR flaws automatically before they hit production.

## How It Works

The bottom line is you get a way to run and audit professional-grade API pentests using only natural language.

1. Subscribe to the Equixly MCP in your AI client.
2. Provide your Equixly API Token from your platform settings.
3. Ask your agent to list services or trigger a new security scan.

## Frequently Asked Questions

**What is Equixly MCP for?**
It's a tool that lets your AI agent run autonomous penetration tests on your APIs. You can find flaws like BOLA and IDOR without having to manually configure complex security software.

**How do I start a security scan?**
Just tell your agent to trigger a scan for a specific service. It will launch the AI Hacker to explore your API and report back with a list of vulnerabilities.

**Can I see the specific steps to fix a bug?**
Yes, when you ask for scan findings, it provides actionable remediation guidance for every confirmed flaw it finds.

**Does it support different API types?**
It works with OpenAPI, GraphQL, Postman, and WSDL specs. You just upload the file and the AI uses it to map out the attack surface.

**How do I manage my target services?**
You can list all your registered services, get details on specific ones, or add new ones just by describing the name and URL to your agent.

**Can I use this for my CI/CD pipeline?**
You can trigger scans upon every deployment to ensure new code doesn't introduce security regressions or logic errors.

**Can my agent trigger an autonomous penetration test on a specific API?**
Yes. Use the 'trigger_scan' tool with the target Service ID. The Equixly AI Hacker will begin an autonomous session, learning and attacking the API for various flaws including BOLA and business logic errors.

**How do I see the security vulnerabilities found in the last scan via chat?**
Use the 'get_scan_findings' tool. Provide the Service and Scan IDs. The agent will retrieve a detailed list of confirmed security flaws, including severity levels and actionable remediation guidance.

**Can I upload an OpenAPI specification to improve scan coverage through the agent?**
Absolutely. Use the 'upload_api_spec' tool. Provide the spec content and format (e.g., 'openapi'). This allows the AI Hacker to understand the full attack surface and maximize vulnerability discovery.