# Contrast Security MCP > Contrast Security MCP connects your AI agent directly to AppSec monitoring data. Instantly audit application security posture and pinpoint critical vulnerabilities across your entire software portfolio, all from a chat window. It eliminates dashboard digging by giving you direct access to vulnerability traces, server status, and application details. ## Overview - **Category:** security-compliance - **Price:** Free - **Tags:** appsec, runtime-security, vulnerability-management, security-monitoring, devsecops ## Description This MCP brings powerful Application Security (AppSec) insights right into your conversation flow. Instead of logging into the complex Contrast UI just to check if your apps are secure, your AI agent handles it. You can query specific security risks, list every app monitored by your sensors, or pull detailed reports on vulnerabilities without ever leaving your chat interface. It's like having a dedicated security analyst sitting next to you who knows exactly where to look. Whether you need to prioritize remediation efforts or just verify that all your production environments are covered, this MCP delivers the data instantly. The Vinkius catalog makes connecting these specialized tools simple; you authorize it once and get access to complex monitoring capabilities across any compatible client. ## Tools ### get_application_details Retrieves detailed information about a specific application monitored by Contrast Security. ### get_organization_info Gets general metadata and details about your current Contrast organization setup. ### get_vulnerability_details Pulls the complete technical breakdown for a single, specified vulnerability trace UUID. ### list_applications Provides a comprehensive list of all applications that Contrast Security is monitoring. ### list_critical_vulnerabilities Quickly generates a filtered list containing only vulnerabilities classified as CRITICAL severity. ### list_monitored_servers Lists all servers where Contrast agents are currently deployed and active in the system. ### list_vulnerability_traces Generates a list of security vulnerability traces found across your application portfolio. ### list_organization_users Lists all user accounts within the Contrast Security organization. ### search_applications_by_name Filters and searches for monitored applications using a specific name or keyword. ### search_vulnerabilities Allows filtering and searching of vulnerabilities using complex criteria like severity or type. ## Prompt Examples **Prompt:** ``` List all applications monitored in my Contrast Security organization. ``` **Response:** ``` I've fetched 3 active applications monitored under your umbrella: `Frontend-API`, `Backend-Payment-Engine`, and `Legacy-Staging-App`. Would you like to dig into the security score of a specific one? ``` **Prompt:** ``` List all CRITICAL vulnerabilities found across my entire Contrast fleet. ``` **Response:** ``` I found 2 traces classified as CRITICAL priority. 1) SQL Injection mapping to UUID `1xx-bbxx-11x` on application 'Backend-API'. 2) Deserialization exploit UUID `4yxx-bbx-22` on 'Legacy-Staging-App'. ``` **Prompt:** ``` Retrieve the full technical details for the vulnerability trace UUID '1xx-bbxx-11x'. ``` **Response:** ``` Decompressing trace `1xx-bbxx-11x`... It's flagged as an untrusted SQL Injection caused by vulnerable code in controller `AuthRoute.js` line 45. The status is open and currently untriaged. ``` ## Capabilities ### Assess overall application coverage List all applications currently monitored by Contrast Security sensors. ### Identify immediate critical risks Filter and list only the highest-severity (CRITICAL) vulnerabilities across your entire codebase. ### Deep dive into specific flaws Pull complete technical details on any single vulnerability trace using its unique UUID. ### Check system operational status View which servers have active Contrast agents deployed and running. ## Use Cases ### Initial Security Audit A new SecOps Engineer needs to know if all staging environments are protected. Instead of clicking through three separate dashboards, they ask their agent to list_applications, getting a comprehensive, single view of every monitored system. ### Incident Triage A developer is working on a fix and needs to know the exact nature of a flaw. They use get_vulnerability_details with the UUID, pulling the precise technical context—like which controller file and line number is vulnerable—without leaving their IDE. ### Compliance Check A DevOps Lead needs proof that only critical flaws are addressed first. They use list_critical_vulnerabilities to immediately pull a filtered list of the highest-risk items, streamlining compliance reporting. ### System Verification The team lead suspects an old application might not be monitored. They run search_applications_by_name for 'Legacy' and get confirmation or find new targets they need to add immediately. ## Benefits - Instantly audit application security by listing all monitored apps using the list_applications tool, ensuring you never miss a production environment. - Prioritize remediation efforts immediately. Use list_critical_vulnerabilities to pull only high-severity flaws, cutting through noise and focusing on what matters. - Go deep into specific issues. Calling get_vulnerability_details gives you the full technical breakdown of any vulnerability trace UUID, pinpointing vulnerable code lines. - Stay aware of your infrastructure health by running list_monitored_servers to confirm where agents are deployed across your entire fleet. - Quickly check coverage or search for specific systems using search_applications_by_name without navigating complex web forms. ## How It Works The bottom line is, you get immediate security answers by talking to your AI client, instead of clicking through dashboards. 1. First, subscribe to this MCP and authorize it using your specific Contrast Application API keys and Organization ID. 2. Next, ask your AI agent a natural language question, like 'List all critical vulnerabilities on the payment engine.' 3. The agent calls the appropriate tool, pulls the precise vulnerability data, and summarizes the findings for you in plain English. ## Frequently Asked Questions **How do I list applications using Contrast Security MCP?** You call the list_applications tool. This provides a comprehensive list of every app monitored by your sensors in one shot. **Can I filter for only critical vulnerabilities with list_critical_vulnerabilities?** Yes, that's exactly what list_critical_vulnerabilities does. It filters out all the lower-severity noise so you focus only on the highest risks. **What is get_vulnerability_details for in Contrast Security MCP?** get_vulnerability_details lets you pull the full, technical breakdown of any single vulnerability trace UUID. It's your deep-dive tool. **Does this MCP show me which servers are monitored?** Yes, running list_monitored_servers shows you all the physical or virtual servers where Contrast agents are currently deployed and active in your organization.