# StackHawk MCP for AI Agents AI Agent Connect > StackHawk MCP connects your AI client to the StackHawk DAST platform. It lets your agent run security scans, triage vulnerabilities, and manage your application environments directly. Instead of digging through dashboards, you can ask your AI to find critical risks in your production code and handle the fallout immediately. ## Overview - **Category:** security-compliance - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_jum2d82i9iEL2aHAYqrgxEwcXG8hsTWADiZhQ3ew/ai-agent-connect - **Tags:** dast, application-security, security-testing, vulnerability-management, ci-cd-pipeline, automated-scanning ## Description This Connector bridges the gap between your security stack and your daily development workflow. It lets you talk to your StackHawk data using plain English, making it way easier to stay on top of security without constantly switching tabs. You can tell your AI to pull the latest scan results, identify which alerts actually matter, and update their status in one go. It handles the heavy lifting of navigating complex security reports so your team can focus on fixing bugs rather than hunting for them. By bringing these capabilities into your conversational workspace, you can move faster on risk remediation. It's part of the massive collection of tools you'll find in the Vinkius catalog, where you can plug in your security stack and get straight to work. You get a direct line to your security posture, allowing for faster triage and more proactive defense across your entire CI/CD pipeline. ## Tools ### list_scans View all past and current DAST scan executions for an application. It provides scan IDs and high-level alert counts. ### login Authenticate with StackHawk to get a bearer token for all other actions. This is the first step for any authenticated request. ### get_application_details Get the full configuration for a specific StackHawk application. This provides a deep look at your app settings. ### get_organization_details View your organization details and current subscription tier. This is useful for high-level account auditing. ### get_scan_alerts Download individual security alerts found during a specific scan. This lets you see every vulnerability in detail. ### get_scan_results Pull detailed metadata and results for a specific DAST scan. This provides the granular data needed for deep audits. ### list_applications Pull a list of all registered DAST applications in your organization. This helps you see your entire software footprint. ### list_environments See all configured environments like staging or production for an app. Use this to target specific deployment stages. ### list_api_keys List all configured API keys for auditing and security hygiene. Use this to ensure no keys are left exposed or unused. ### triage_alert Update a security alert status to risk accepted, false positive, or in progress. This helps clean up your alert queue. ## Prompt Examples **Prompt:** ``` Log in and show me all the applications we have in our production environment. ``` **Response:** ``` Authentication successful. I found the following applications: | Application Name | Status | Environment | | :--- | :--- | :--- | | Payment-Gateway-Core | Active | Production | | Internal-Admin-Dashboard | Active | Production | All applications are currently active in the Production environment. ``` **Prompt:** ``` Run a new security scan on our payment gateway app. ``` **Response:** ``` I've started a new DAST scan for the 'Payment-Gateway-Core' application. **Scan Status:** Initiated **Tracking ID:** `8f2d-4491-b21c` The DAST audit is running asynchronously. Would you like me to check the status for you in a few minutes? ``` **Prompt:** ``` Give me a summary of the critical alerts from the last scan. ``` **Response:** ``` Here are the critical issues found in the latest scan for your Production application: * **SQL Injection** - Risk: High - Endpoint: `/api/auth` * **Cross-Site Scripting** - Risk: Medium - Endpoint: `/user/profile` * **Insecure Headers** - Risk: Low - Endpoint: `/` Would you like me to triage any of these as false positives? ``` ## Capabilities ### Run automated security scans Initiate and stop DAST evaluations across your specified environments. ### Triage security alerts Classify risks as false positives or accepted risks using natural language. ### Audit scan results Retrieve detailed vulnerability metadata for any specific scan execution. ### Manage app environments List and inspect active software deployments and configurations. ### Securely authenticate Obtain a bearer token to authorize all subsequent StackHawk actions. ## Use Cases ### Checking for regressions after a push A developer just pushed a new microservice and wants to check for regressions. They ask the agent to run a scan and list the alerts using run_scan and get_scan_alerts. ### Summarizing ongoing security scans A security lead needs to know the status of all ongoing scans. They ask the agent to list all scans and summarize the alert counts using list_scans. ### Cleaning up a high volume of alerts A DevSecOps engineer is overwhelmed by a high volume of alerts. They ask the agent to triage all High alerts from the last scan using triage_alert. ### Auditing organizational API keys An admin needs to audit API keys for a specific department. They ask the agent to list all API keys in the organization using list_api_keys. ## Benefits - Stop manual dashboard hopping by using list_applications and list_environments to see your full footprint in one chat. - Speed up risk remediation by using triage_alert to quickly mark false positives without clicking through multiple pages. - Get instant visibility into security debt by pulling deep reports with get_scan_alerts for any specific scan. - Automate your security checks by using run_scan to initiate evaluations as part of your regular deployment flow. - Improve security hygiene by using list_api_keys to audit your organization's credentials through natural language. ## How It Works The bottom line is you get to manage your DAST security lifecycle through a chat interface instead of a complex dashboard. 1. Connect the StackHawk MCP to your AI client and provide your StackHawk API Token. 2. Ask your agent to perform a specific action, like listing your production environments. 3. Receive a summarized report of vulnerabilities or scan statuses in your chat window. ## Frequently Asked Questions **How does the StackHawk MCP help with security triage?** It lets you use natural language to update the status of security alerts. You can tell your AI to mark items as false positives or accepted risks without having to manually click through the StackHawk dashboard. **Can I use StackHawk MCP to run automated scans?** Yes. You can instruct your AI client to initiate new DAST scans across your different environments, like staging or production, directly from your chat interface. **Does StackHawk MCP support multiple environments?** It does. You can list and inspect different environments for your applications, allowing your agent to target specific ones for security testing. **Is it safe to use my API token with StackHawk MCP?** Yes, the Connector handles your StackHawk API token securely to authenticate your requests. You provide the token in your configuration, and it's used to perform actions on your behalf. **Can I audit my API keys using this Connector?** You can. The Connector includes a tool to list all configured API keys in your organization, which makes it easy to check for security hygiene and audit your credentials. **How do I see the results of a specific security scan?** Just ask your AI client to pull the results for a specific scan. It will retrieve the detailed metadata and vulnerability information from StackHawk and summarize it for you. **Are scans executed locally or in the cloud?** Scans run on the StackHawk cloud infrastructure. The Connector integration only triggers and monitors them — no heavy processing happens in your AI context. **Why is the `login` step required?** The StackHawk API uses short-lived Bearer tokens. The `login` tool exchanges your API key for a session token that authenticates all subsequent requests. **Can the agent triage alerts automatically?** Yes. Use `triage_alert` to mark specific vulnerabilities as false positives, accepted risks, or confirmed issues. Each triage action targets a single alert by ID.