Vinkius

HCL AppScan MCP. Audit entire app security posture instantly.

HCL AppScan MCP connects application security testing directly to your AI client. It lets you manage complex security scans across multiple applications, track vulnerabilities, and audit an entire software inventory using natural conversation. Quickly check scan statuses, list apps, or even start new dynamic analysis (DAST) tests without ever leaving your chat window.

HCL AppScan MCP is compatible with Claude Claude
HCL AppScan MCP is compatible with ChatGPT ChatGPT
HCL AppScan MCP is compatible with Cursor Cursor
HCL AppScan MCP is compatible with Gemini Gemini
HCL AppScan MCP is compatible with Windsurf Windsurf
HCL AppScan MCP is compatible with VS Code VS Code
HCL AppScan MCP is compatible with JetBrains JetBrains
HCL AppScan MCP is compatible with Vercel Vercel
See Vinkius in Action

Give Claude and any AI agent real-world access

Audit Application Inventory

You list all applications in your security inventory to get their unique IDs and names.

Check Scan Statuses

You monitor all performed scans, checking the current status of any active security tests.

Identify Vulnerabilities

You get detailed lists and specific information about security issues found during a scan.

Initiate Security Scans

You start new Dynamic Analysis (DAST) scans for your web applications directly from the chat.

Manage Internal Agents

You list available local agents used to scan internal, non-web applications.

Waiting for input…

AI Agent
HCL AppScan

What AI agents can do with HCL AppScan MCP: 10 Tools for Security Auditing

These tools let you automate complex security tasks, from listing every application in your inventory to initiating a full dynamic analysis scan.

Make your AI actually useful.

Add this MCP to Claude, Cursor, or Windsurf and your AI stops guessing. It gets real tools to look things up, take action, and handle the stuff you keep doing by hand.

Start using HCL AppScan MCP

Get Account Check

Verifies that your AppScan account connection is active and ready to use.

Get Account Info

Retrieves specific information about the user who authenticated to the service.

Get App

Pulls detailed data for one specific application within your inventory.

Get Issue

Gathers granular information about a single, identified vulnerability or security...

Get Scan

Retrieves the status and details for one specific scan job.

List Apps

Shows a comprehensive list of every application registered in your AppScan inventory.

List Issues

Generates a full listing of all vulnerabilities found for a given application ID.

List Presence

Lists the local agents, or Presences, that are available to scan internal...

List Scans

Provides a complete record of all scans that have ever been run in your account...

Start Dast Scan

Begins a new Dynamic Analysis (DAST) scan for a specified web application URL.

Security and governance baked right in.

Pick your AI client below to get set up. Just create a Vinkius account, subscribe, and you're instantly up and running. We handle the entire backend infrastructure, delivering out-of-the-box support for HTTPS Streamable, SSE, and OAuth2—zero messy routing required.

HCL AppScan MCP is compatible with Claude

Claude AI

1

Open Claude Settings

Go to claude.ai, click your profile icon, then navigate to Customize → Connectors.

2

Add Custom Connector

Click the "+" button and select Add custom connector. Paste your Vinkius endpoint URL:

https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp

Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com. For OAuth-protected servers, expand Advanced settings to add credentials.

3

Start a conversation

Open a new chat. The HCL AppScan integration is available immediately — no restart needed.

Choose How to Get Started

Build a custom MCP for your own tools, or connect a ready-made integration from our catalog.

Build Your Own

Turn any API into an MCP. Import a spec, define Agent Skills, or deploy with MCPFusion.

  • Import from OpenAPI, Swagger, or YAML specs
  • Create Agent Skills with progressive disclosure
  • Deploy to edge with MCPFusion framework
  • Built in DLP, auth, and compliance on each call
  • Real time usage dashboard and cost metering
  • Publish to catalog or keep private
Start building

Make Your AI Do More

Start with HCL AppScan, then connect any of our 5,200+ other servers whenever your AI needs more. One click, no limits.

  • Use this MCP plus 5,200+ others, all in one place
  • Add new capabilities to your AI anytime you want
  • Connections are secured and governed automatically
  • Track usage and costs across all your servers
  • Works with Claude, ChatGPT, Cursor, and more
  • New servers added to the catalog weekly
HCL AppScan MCP server cover

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by HCL AppScan. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

VINKIUS CLOUD

Cloud Hosted

Managed infra

V8 Isolated

Sandboxed per request

Zero-Trust Proxy

No stored credentials

DLP Enforced

Policy on each call

GDPR Compliant

EU data residency

Token Compression

~60% cost reduction

Your data is protected. See how we built it.

Security Audits Used to Be a Dashboard Nightmare

Right now, if you want to audit an application's security status, you open the AppScan dashboard. You manually select the app. Then you check the scan history. If things look good, great; if they don't, you have to export the vulnerability list into a spreadsheet. Then you copy that data into your compliance report. That cycle takes time and introduces manual error at every step.

With this MCP, you just talk to your agent. You ask it to audit the application inventory, and it runs `list_apps` and immediately gives you all the IDs. When you need flaw details, it uses `list_issues` and presents a clean list—no exporting needed. The whole process stays within conversation.

Get Vulnerability Data with HCL AppScan MCP

You ditch the constant clicking between tabs, the copy/paste routine of moving findings from one sheet to another, and the headache of cross-referencing different scan reports.

Now, when you ask your agent to get detailed vulnerability information using `get_issue`, the data comes back structured, actionable, and ready for immediate decision-making. It's a massive shift in workflow.

What HCL AppScan MCP does for your AI

This MCP brings powerful application security testing straight to your agent. Instead of logging into separate dashboards, you can monitor vulnerabilities and audit your entire application inventory using natural conversation. Your AI client talks directly to the tools here, giving you instant insight into your security posture across HCL AppScan on Cloud (ASoC).

You can list all applications in your inventory to find their unique IDs or check the real-time status of any active scan. Need more detail? You can retrieve detailed lists of security issues found during scans, including severity and current status. If you're ready for a new audit, you can start DAST scans right from the chat interface.

All this capability is available through Vinkius, giving your agent access to industry-leading tools without needing multiple subscriptions or logins.

Built · Hosted · Managed by Vinkius HCL AppScan - Manage Security Scans and Vulnerabilities
Server ID 019d7551-001d-7171-b864-790c4c6e5e79
Vinkius Inspector
Compliance Grade A+
Score 100/100
Vinkius Inspector Badge — Score 100/100

Frequently asked questions about HCL AppScan MCP

How do I list all applications with HCL AppScan MCP? +

You simply ask your agent to list the apps using list_apps. This tool immediately shows you every application ID currently tracked in your security inventory.

Can I start a scan without knowing the URL? (HCL AppScan MCP) +

No. The start_dast_scan tool requires a specific URL to run the dynamic analysis test. You must first find the target URL and pass it to the agent.

What if I need details on one vulnerability? (HCL AppScan MCP) +

You use get_issue and provide the specific ID of the issue you care about. The tool returns detailed context, including severity and how to fix it.

Does HCL AppScan MCP track old scans? (HCL AppScan MCP) +

Yes. You can use list_scans or list_issues to view historical data, helping you audit past performance and ensure compliance over time.

What is the difference between listing apps and getting app details? (HCL AppScan MCP) +

Using list_apps gives a simple roster of all IDs. Using get_app retrieves deep, detailed information for one specific app ID you've already identified.

How do I get my AppScan API Key ID and Secret? +

Log in to the AppScan on Cloud console, go to your User Profile (top right), and select API Keys. You can generate a new Key ID and Key Secret there.

Does this server support the EU region? +

Yes, you can configure the APPSCAN_REGION environment variable to eu to connect to the European data center (eu.cloud.appscan.com).

Can I start a scan for an internal application? +

Yes, provided you have an AppScan Presence (local agent) configured. You can use the list_presence tool to check their availability before starting a scan.