How to Use the HCL AppScan MCP in LangChain

Q: How do I connect HCL AppScan to LangChain?

Install the langchain-mcp-adapters package. Initialize a MultiServerMCPClient pointing to your Vinkius MCP endpoint, extract the tools with client.gettools(), and pass them directly to your ReAct agent.

Q: Can LangChain trigger HCL AppScan DAST scans automatically?

Yes. Your agent can call startdastscan as part of a scheduled pipeline. It will need the application ID, which it finds first by running listapps.

Build security reasoning pipelines by connecting HCL AppScan directly to your LangChain agents.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect HCL AppScan MCP to LangChain

Create your Vinkius account to connect HCL AppScan to LangChain and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup HCL AppScan with LangChain

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Wire Vulnerability Scans into ReAct Agents

The `start_dast_scan` tool lets your LangChain agent initiate a Dynamic Analysis scan directly from a conversation or automated trigger. You pass the target application ID, and the agent fires off the request. Instead of switching tabs to check progress, the pipeline loops the `get_scan` tool to monitor status until completion. This setup turns manual security testing into an autonomous chain. When the scan finishes, your pipeline automatically pulls the results and feeds them into the next step. Every execution gets logged in LangSmith, so you know exactly how long the scan took and which parameters the agent decided to use.

Chain Issue Triage and Remediation

You fetch raw vulnerabilities using the `list_issues` tool. Your agent pulls the latest findings for a specific application and decides which ones actually matter. If it spots a critical injection flaw, it uses `get_issue` to grab the deep technical details, including the exact payload that triggered the alert. Those details become the input for the next link in your chain. You can route the raw vulnerability data into a Jira ticket creator or a Slack notification node. The agent handles the triage logic, filtering out low-priority noise before a human ever looks at the dashboard.

Audit Application Inventory via MCP Server

Managing scope starts with the `list_apps` tool, giving your agent a complete view of your AppScan inventory. It retrieves metadata for every configured application in the account. If you run local agents, `list_presence` pulls the status of your internal scanning infrastructure. You combine these endpoints to build an autonomous inventory auditor. The agent cross-references active applications with their local presence availability. If an internal app lacks a valid scanning path, the pipeline flags the misconfiguration immediately.

Setup guide

Set up HCL AppScan MCP in LangChain

Prerequisites

Python 3.10+ installed
langchain-mcp-adapters + langgraph packages
Active Vinkius subscription with a valid endpoint token

1

Install dependencies
Run pip install langchain-mcp-adapters langgraph langchain-openai. The MCP adapters package converts MCP tools into native LangChain BaseTool objects.
2

Connect via HTTP transport
Use MultiServerMCPClient with "transport": "http" pointing to your Vinkius endpoint. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com.
3

Create a ReAct agent
Pass the discovered tools to create_react_agent() from LangGraph. The agent automatically routes HCL AppScan tool calls through the MCP protocol.
4

Run with any LLM
Swap ChatOpenAI for ChatAnthropic, ChatGoogleGenerativeAI, or any LangChain-compatible model. The MCP tools work identically across all providers.

agent.py

from langchain_mcp_adapters.client import MultiServerMCPClient
from langgraph.prebuilt import create_react_agent
from langchain_openai import ChatOpenAI

async with MultiServerMCPClient({
    "hcl-appscan-mcp": {
        "transport": "http",
        "url": "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp",
    }
}) as client:
    tools = client.get_tools()

    agent = create_react_agent(
        ChatOpenAI(model="gpt-4o"),
        tools,
    )
    result = await agent.ainvoke({
        "messages": "List recent HCL AppScan transactions"
    })
    print(result["messages"][-1].content)

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by HCL AppScan. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect HCL AppScan now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about HCL AppScan MCP in LangChain

Install the `langchain-mcp-adapters` package. Initialize a `MultiServerMCPClient` pointing to your Vinkius MCP endpoint, extract the tools with `client.get_tools()`, and pass them directly to your ReAct agent.

Yes. Your agent can call `start_dast_scan` as part of a scheduled pipeline. It will need the application ID, which it finds first by running `list_apps`.

It tracks everything. You will see the exact inputs sent to `get_issue` and the raw vulnerability JSON returned. This makes debugging failed scan chains trivial.

You control the exact MCP tool list. If you only want an agent to read data, just provide `list_issues` and `get_issue` while withholding the scan trigger tools.

Vinkius runs the server in an ephemeral V8 Isolate sandbox. When your agent pulls payload details via `get_issue`, the data passes through memory and is immediately destroyed after the request completes. Nothing hits a disk.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript