# Halo Security MCP > Halo Security MCP automates attack surface management for your organization's digital perimeter. Monitor assets, scan vulnerabilities, and track risk scores—all through natural conversation with your AI agent. Add targets, list open ports, inspect certificates, and trigger new scans without leaving your chat interface. ## Overview - **Category:** cloud-infrastructure - **Price:** Free - **Tags:** attack-surface-management, asset-discovery, security-posture, threat-monitoring, vulnerability-assessment ## Description Managing an entire attack surface used to mean clicking into a dozen different dashboards, downloading massive CSV files, and piecing together fragmented reports. This MCP changes that. It lets you manage security posture conversationally. You connect this tool through Vinkius, giving your AI agent immediate access to critical data about your network assets. Instead of manually exporting vulnerability findings or tracking risk scores across separate tools, you simply ask your client—Claude, Cursor, or any compatible agent—to find out what's wrong. Your agent acts like a dedicated Security Analyst: it can list all discovered issues, check the health of SSL certificates, and even kick off new security assessments on demand. It keeps you focused on risk mitigation, not report generation. ## Tools ### add_target Adds a specific domain or IP address to the list of assets being monitored for security issues. ### get_issue Retrieves full details about one particular security finding, including its severity and impact. ### get_security_risk Pulls the organization's overall risk score and historical trend data for quick comparison. ### list_certificates Displays a list of all SSL/TLS certificates found on monitored targets and their current expiration status. ### list_dns_records Shows the DNS records that were discovered during the initial reconnaissance phase for your assets. ### list_issues Lists all security vulnerabilities and issues found across all monitored targets at once. ### list_open_ports Displays every open network port discovered on the assets, helping map potential entry points. ### list_scans Provides a history log of all security scans that have been run against your targets. ### list_targets Retrieves the full list of assets currently included in the security monitoring perimeter. ### list_technologies Identifies and lists all specific software technologies or libraries running on your monitored targets. ### trigger_scan Initiates a brand new, immediate security assessment scan for a specified target asset. ## Prompt Examples **Prompt:** ``` List all security issues with 'High' severity. ``` **Response:** ``` I've retrieved your issues. You currently have 3 High severity findings: 'Outdated jQuery Library' on example.com, 'Missing Security Headers', and 'SSL Certificate Expiring Soon'. Would you like the details for the SSL issue? ``` **Prompt:** ``` Trigger a security scan for target ID 5592. ``` **Response:** ``` Scan triggered! I've successfully requested a new security assessment for target 5592 (api.example.com). You can check the progress by listing scans in a few minutes. ``` **Prompt:** ``` Show me the risk score summary for our organization. ``` **Response:** ``` Accessing risk scores... Your organization's overall security score is 78/100. The score has improved by 5% since last month. Your primary risk drivers are outdated software on 2 targets. Would you like to see those targets? ``` ## Capabilities ### Inventory Assets List all monitored domains, IPs, and applications to map your entire digital footprint. ### Review Vulnerabilities Access a list of discovered security issues, getting detailed information on severity and remediation status for any specific finding. ### Check Network Components Examine network infrastructure by listing open ports, detecting technologies used, or reviewing SSL/TLS certificates. ### Assess Risk Over Time Retrieve overall security risk scores and trends to measure how your organization's posture is changing month over month. ### Run Scans On Demand Trigger new, immediate security assessments for any target you need to re-validate. ## Use Cases ### Post-Merger Asset Discovery The M&A team needs to know if the newly acquired company's systems are secure. They ask their agent to list targets and then check for open ports, immediately identifying any unexpectedly exposed services or unmonitored IPs. ### Pre-Deployment Security Check A DevSecOps engineer is about to deploy a new API service. They use the agent to trigger_scan on the target and then list_issues, ensuring all known vulnerabilities are patched before going live. ### Compliance Audit Preparation The CISO needs quick proof of certificate compliance. They ask the agent to list_certificates, instantly verifying if every critical service has a current, non-expiring SSL/TLS credential across the board. ### Investigating a Breach Alert The security team gets an alert about unusual traffic. They ask the agent to list_dns_records and then list_technologies for the affected asset, narrowing down the potential entry vector faster than manual research. ## Benefits - Stop digging through manual reports. Instead of exporting vulnerability data, you can ask your agent directly for 'all high-severity issues' using the list_issues tool, getting a clean summary immediately. - Map your full risk exposure by checking security trends with get_security_risk. You instantly see if recent changes have lowered or raised your organization’s overall score. - Eliminate guesswork about network health. Use list_open_ports and list_certificates to check for exposed ports or expiring SSL/TLS credentials without running separate scripts. - Stay ahead of threats by adding new assets using add_target, ensuring that any newly acquired domain or IP address is immediately part of your security perimeter. - Get current status on all monitored systems. List targets and list technologies gives you a complete inventory—knowing what's running where before it becomes a vulnerability. ## How It Works The bottom line is you manage complex security tasks using simple conversation rather than complicated manual workflows. 1. Subscribe to this MCP and enter your Halo Security API Key via Vinkius. 2. Connect your preferred AI client (Claude, Cursor, etc.) to the catalog. 3. Ask your agent a question—like 'What are the high-severity vulnerabilities on example.com?'—and get instant answers based on live security data. ## Frequently Asked Questions **How does the Halo Security MCP help with vulnerability reports?** It moves beyond static reports. Instead of downloading CSV files, you ask your agent to list_issues or get_issue details directly in the chat. This gives you immediate context on severity and remediation steps. **Can I find out if my domain is secure using Halo Security MCP?** Yes, you can check multiple angles. You use list_certificates to verify SSL/TLS status and then run get_security_risk for an overall health score. **What kind of assets can the add_target tool handle?** The add_target function accepts domains, IP addresses, or application identifiers. You just need to tell your agent what needs monitoring. **Does Halo Security MCP show me past scan results?** Absolutely. Use list_scans to review the history of assessments run against your targets, and you can also manually trigger a new one using trigger_scan if needed. **Is this MCP suitable for DevSecOps teams?** Yes. It allows automated workflows where agents can monitor issues in real-time, ensuring that every change or deployment is checked against known vulnerabilities via list_issues.