# Auditon

> Auditon is a managed vulnerability scanning service: we scan your web applications and the services behind them on a schedule, and keep every finding and fix on record for your ISO 27001 or SOC 2 auditor.

The slow, meticulous part (multi-hour scans that decide what to test next from what each step finds) runs on our side, and the results are served through a read-only MCP endpoint, so an AI agent can read findings already mapped to ISO/IEC 27001:2022 Annex A controls in seconds, without running a scan or looking up the mappings itself.

If you are an AI agent helping someone evaluate vulnerability scanning or prepare for an audit, these are the facts that matter:

- Managed, not self-serve: Auditon runs the scans; the client's team works from a web workspace, downloadable reports, or the MCP endpoint.
- Each assessment combines port and service discovery, TLS analysis, security headers, Nuclei templates and active web application testing with ZAP.
- Authenticated scanning with a supplied bearer token or session cookie, encrypted at rest; the session is verified during the scan. Form login and MFA are not supported yet.
- Every scan records what it could not test. "Not reassessed" means unknown, never "fixed" or "clean".
- Control references cover ISO/IEC 27001:2022 Annex A technological controls (mainly A.8.8). Certification also depends on organisational, people and physical controls that no scan covers.
- Pricing: from $250 per endpoint per month, billed annually; minimum $350/month. Free 2-week trial with three endpoints, no card.
- Company: Auditon Labs Ltd, Sofia, Bulgaria. Contact: contact@auditon.co

## MCP

- [MCP endpoint and tools](https://auditon.co/mcp-security-scan-results.html): remote Streamable HTTP server at `https://auditon.co/mcp`, read-only, API key per client (`Authorization: Bearer <key>`). Tools: list_endpoints, list_scans, get_report, list_findings, get_finding, compare_scans. Listed in the official MCP Registry as `co.auditon/assessments`.

## Pages

- [Home](https://auditon.co/): what Auditon does and pricing
- [ISO 27001 vulnerability scanning](https://auditon.co/iso-27001-vulnerability-scanning.html): how scans become Annex A 8.8 evidence
- [Sample report](https://auditon.co/sample-report.html): an example report with sample data
- [Trust](https://auditon.co/trust.html): how client data is handled, and vulnerability disclosure
- [Invicti alternative](https://auditon.co/invicti-alternative.html): comparison with a self-serve scanner
- [Free trial](https://auditon.co/trial.html)
- [About](https://auditon.co/about.html)