How to Use the HCL AppScan MCP in OpenAI Agents SDK

Q: How does OpenAI Agents SDK handle multi-agent handoffs for HCL AppScan tasks?

You can set up a security triager agent that calls listapps to find targets. Once it detects a problem, it hands off the specific issue details from getissue to a developer agent tasked with fixing that codebase.

Q: Do I need to manually define the tool schemas for the AppScan endpoints in my OpenAI Agents SDK system?

No. The MCP Server exposes all ten tools, including getaccountcheck and listscans. Your agent automatically discovers them at runtime with zero manual configuration.

Run secure, autonomous security audits with OpenAI Agents SDK checking your HCL AppScan inventory for vulnerabilities.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect HCL AppScan MCP to OpenAI Agents SDK

Create your Vinkius account to connect HCL AppScan to OpenAI Agents SDK and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup HCL AppScan with OpenAI Agents SDK

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Run dynamic security scans on demand

Let your agent fire up real-time vulnerability tests with `start_dast_scan` without leaving the OpenAI Agents SDK chat. The agent checks your configuration, starts a live test, and monitors the execution state through `get_scan` until the run finishes. Your OpenAI Agents SDK pipeline doesn't require you to write custom polling loops to wait for HCL AppScan results. The agent handles the asynchronous wait, logs the progress directly to your terminal, and lets you know the second the scan is ready.

Audit your application inventory

Keep a tight grip on your attack surface by letting your agent query the active HCL AppScan inventory using `list_apps`. Your OpenAI Agents SDK setup calls this tool to fetch every registered target, then drills down into specific configurations with `get_app` to verify scope. If you have local scan agents running behind your firewall, your OpenAI Agents SDK agent checks their availability using `list_presence`. This ensures your automated security pipeline never triggers an AppScan test on an offline target.

Track and triage security findings

Stop digging through PDF reports to find out what broke your OpenAI Agents SDK build by fetching raw findings with `list_issues`. The agent pulls raw AppScan vulnerability data directly into the agent context, letting it analyze the threat level immediately. For critical bugs, your OpenAI Agents SDK agent calls `get_issue` to extract the exact AppScan HTTP payload and remediation advice. This MCP integration lets it hand off this detailed context to a developer agent to write a patch.

Setup guide

Set up HCL AppScan MCP in OpenAI Agents SDK

Prerequisites

Python 3.10+ installed
openai-agents package (pip install openai-agents)
Active Vinkius subscription with a valid endpoint token

1

Install the SDK

Run pip install openai-agents to install the OpenAI Agents SDK. The MCP integration is built-in — no extra dependencies needed.
2

Connect via SSE transport

Use MCPServerSse with your Vinkius endpoint URL. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com. The SDK auto-discovers all HCL AppScan tools at runtime.
3

Create your Agent

Pass the MCP to Agent(mcp_servers=[server]). The agent receives HCL AppScan tools as native definitions — JSON schemas resolve automatically.
4

Run the agent

Call Runner.run(agent, prompt) to execute. The agent invokes the appropriate HCL AppScan tools and returns structured results. Copy the full example on the right to get started.

agent.py

import asyncio
from agents import Agent, Runner
from agents.mcp import MCPServerSse

async def main():
    async with MCPServerSse(
        url="https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    ) as server:
        agent = Agent(
            name="HCL AppScan Agent",
            instructions="You have access to HCL AppScan tools.",
            mcp_servers=[server],
        )
        result = await Runner.run(agent, "List recent transactions")
        print(result.final_output)

asyncio.run(main())

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by HCL AppScan. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect HCL AppScan now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about HCL AppScan MCP in OpenAI Agents SDK

Pass the MCP server to your agent constructor and let it call `start_dast_scan`. The agent will automatically poll `get_scan` to track progress and notify you when the run completes.

Yes. Your agent can fetch the active vulnerability list with `list_issues` and then inspect individual findings using `get_issue`. This lets the agent analyze the raw HTTP traffic and suggest specific code fixes.

You can set up a security triager agent that calls `list_apps` to find targets. Once it detects a problem, it hands off the specific issue details from `get_issue` to a developer agent tasked with fixing that codebase.

No. The MCP Server exposes all ten tools, including `get_account_check` and `list_scans`. Your agent automatically discovers them at runtime with zero manual configuration.

Your vulnerability details, app metadata, and API tokens never touch public servers. Vinkius runs this MCP Server in an isolated, single-use sandbox, ensuring your sensitive `get_issue` payloads stay secure.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript