How to Use the HCL AppScan MCP in Google ADK

Q: Can I run a DAST scan in HCL AppScan using Google ADK?

Yes. Your Gemini agent can connect to the MCP server, call startdastscan to kick off a dynamic analysis, and then use getscan to monitor its progress.

Q: How does Google ADK analyze HCL AppScan vulnerability data?

The agent uses listissues to gather findings and getissue to extract deep technical details. It then leverages Gemini's long context to analyze the root cause of the vulnerabilities.

Q: Can I export HCL AppScan inventory to BigQuery using Google ADK?

Yes. You can instruct your agent to call listapps and getapp to collect your asset inventory, then format and write that data directly into your BigQuery datasets.

Q: How does the Google ADK agent know if the local AppScan scan agents are online?

The agent runs listpresence to check the status of your local AppScan Presences through the MCP Server. This prevents the agent from attempting to start scans on offline targets.

Connect Google ADK to HCL AppScan to analyze security findings and trigger scans directly from your Gemini workflows.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect HCL AppScan MCP to Google ADK

Create your Vinkius account to connect HCL AppScan to Google ADK and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup HCL AppScan with Google ADK

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Run dynamic scans from enterprise pipelines

Let your Gemini agent trigger live security assessments with `start_dast_scan` directly within your Google ADK pipelines. The agent initiates an AppScan test run and tracks its live execution status with `get_scan` using our MCP Server. Because Gemini handles massive context windows, your Google ADK agent can ingest the complete AppScan configuration, compare it against historical runs, and adjust parameters on the fly.

Map your security posture in BigQuery

Your Google ADK agent can pull your entire AppScan application list using `list_apps` to map your security posture. It fetches deep details with `get_app` and can then write this structured data directly into BigQuery for long-term tracking. By combining AppScan `list_scans` with your Google Cloud data warehouses, you can build custom dashboards that track remediation times and overall security health across your entire organization.

Analyze complex vulnerability details

Stop copy-pasting raw vulnerability payloads into Gemini chat windows by retrieving them directly via `list_issues`. Your Google ADK agent uses this MCP integration to pull the active AppScan bug list and calls `get_issue` to extract the precise proof-of-concept payload. With the long-context capabilities of Google ADK, your agent can analyze hundreds of AppScan security issues simultaneously, finding patterns in your code vulnerabilities that simple regex scanners miss.

Setup guide

Set up HCL AppScan MCP in Google ADK

Prerequisites

Python 3.10+ installed
google-adk package (pip install google-adk)
Active Vinkius subscription with a valid endpoint token

1

Install Google ADK

Run pip install google-adk to install the Agent Development Kit. MCP support is included via the McpToolset class.
2

Connect via SSE transport

Use McpToolset.from_server() with SseServerParams pointing to your Vinkius endpoint. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com.
3

Create an LlmAgent

Pass the returned mcp_tools list directly to LlmAgent(tools=mcp_tools). The ADK maps each MCP tool to a native Gemini function call — no manual schema definitions required.
4

Run with any Gemini model

The agent works with any Gemini model (gemini-2.0-flash, gemini-2.5-pro, etc.). Copy the full example on the right to get started with HCL AppScan tools in your ADK agent.

agent.py

from google.adk.agents import LlmAgent
from google.adk.tools.mcp_tool.mcp_toolset import McpToolset
from google.adk.tools.mcp_tool.mcp_session_manager import SseServerParams

# Connect to the MCP via SSE
mcp_tools, exit_stack = await McpToolset.from_server(
    connection_params=SseServerParams(
        url="https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    )
)

# Create your agent with auto-discovered tools
agent = LlmAgent(
    name="HCL AppScan_agent",
    model="gemini-2.0-flash",
    instruction="You have access to HCL AppScan tools via MCP.",
    tools=mcp_tools,
)

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by HCL AppScan. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect HCL AppScan now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about HCL AppScan MCP in Google ADK

Yes. Your Gemini agent can connect to the MCP server, call `start_dast_scan` to kick off a dynamic analysis, and then use `get_scan` to monitor its progress.

The agent uses `list_issues` to gather findings and `get_issue` to extract deep technical details. It then leverages Gemini's long context to analyze the root cause of the vulnerabilities.

Yes. You can instruct your agent to call `list_apps` and `get_app` to collect your asset inventory, then format and write that data directly into your BigQuery datasets.

The agent runs `list_presence` to check the status of your local AppScan Presences through the MCP Server. This prevents the agent from attempting to start scans on offline targets.

Your application lists and vulnerability payloads remain strictly within your Google Cloud boundary. Vinkius hosts the MCP Server in a zero-trust sandbox, preventing any exposure of your `get_issue` details.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript