• FALSE POSITIVE
  • IN PROGRESS
  • NEEDS HUMAN
  • OPEN

How to triage security scan alerts with your AI

Connect StackHawk to your AI client to automate the heavy lifting of vulnerability review. Once connected, your agent handles the scanning data so you can focus on fixing real bugs.

Ask AI about this page

Short answer

How do I triage StackHawk alerts using AI?

Your AI pulls scan data directly from StackHawk and compares findings against your security context. It then marks alerts as false positives or in progress based on your instructions. You get a cleaned-up list of actionable vulnerabilities.

Where every issue lands.

Triage outcomes

The AI categorizes every alert it finds into one of these four states.

FALSE POSITIVE

Dismissed noise

The AI identifies alerts that don't pose a real threat. It marks these so they stop cluttering your dashboard.

IN PROGRESS

Active investigation

The AI flags vulnerabilities that are currently being looked at. This prevents duplicate work on the same issue.

NEEDS HUMAN

Manual review required

If the AI finds a high-confidence vulnerability or an ambiguous finding, it leaves it alone for you to decide.

OPEN

New vulnerabilities

Unreviewed alerts stay in their original state. These are the raw findings waiting for your agent to process them.

The workflow

What your AI does when the scan arrives.

Your agent acts as a first responder for your security pipeline.

  1. Access the environment

    Your agent logs into your StackHawk account to establish a secure connection.

    login

  2. Locate the data

    The agent finds the specific application and the most recent scan results you want to review.

    list_applicationslist_scans

  3. Analyze findings

    The agent pulls the specific list of alerts from the scan to begin the triage process.

    get_scan_alerts

  4. Update alert status

    The agent applies your decision to each alert, marking them as false positives or in progress.

    triage_alert

Try it

Copy these to start.

Use these prompts to kick off the triage process.

Starting points

Swap out the application names and scan IDs with your actual StackHawk data.

StackHawk Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_jum2d82i9iEL2aHAYqrgxEwcXG8hsTWADiZhQ3ew/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — StackHawk capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "stackhawk-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_jum2d82i9iEL2aHAYqrgxEwcXG8hsTWADiZhQ3ew/mcp"
    }
  }
}
Copy into chat04

  • List all my StackHawk applications so I can pick one to triage.

  • Get the alerts from the latest scan for the 'Payment-API' application.

  • Review the alerts from the last scan and mark any false positives as such.

  • Find the scan for 'Frontend-App' and mark the SQL injection alert as in progress.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect StackHawk once, then ask.

You only need to link your account once. Your credentials stay encrypted, and you can immediately start asking your agent to manage your scans.

Connect StackHawk to your AI

FAQ

How this task behaves.

  • 01

    Can the AI delete scan results?

    No. The AI can only update the status of alerts using the triage tool.

  • 02

    Will the AI automatically fix the code?

    No. The AI only manages the status of the alerts within StackHawk.

  • 03

    Does the AI need my password?

    No. You connect via a secure link, and your login remains encrypted.

  • 04

    Can I see which alerts the AI marked as false positives?

    Yes. The AI updates the status in StackHawk, so you see those changes in your dashboard immediately.

  • 05

    Can the AI create new scans?

    No. This MCP is designed for reviewing and triaging existing scan data.

  • More questions about StackHawk? See everything the StackHawk Connector can do

Connect StackHawk to Claude, Cursor, ChatGPT & more