Auditon’s MCP endpoint lets Claude Code and other MCP-compatible agents read your security assessments: your endpoints, open findings, scan history, and what changed between scans. It is read-only, scoped to your workspace, and gives your assistant the same caveats your auditor sees, including what a scan did not test.
Your assistant calls Auditon’s tools and answers from your actual results. When a check didn’t complete, it says so.
The same data as your client portal, as structured results with a published format.
| TOOL | WHAT IT ANSWERS |
|---|---|
| list_endpoints | Which hosts you have, their open findings by severity, and when each was last scanned. |
| list_scans | Scan history, overall or per endpoint: type, status, rating, and how much of each scan completed. |
| get_report | One scan in full: rating and what drives it, coverage gaps, findings, items that need verification, accepted risks, and checks that passed. |
| list_findings | Current findings across all scans, filtered by state, severity, endpoint, or date. |
| get_finding | One finding in depth: impact, remediation, references, evidence, the analyst’s decision, and its history. |
| compare_scans | What appeared, what was resolved, and what wasn’t reassessed between two scans of an endpoint. |
In the client portal, open API keys and create one for this assistant. It is shown once; keep it somewhere safe. Keys expire after 90 days by default, and you can revoke any key at any time.
Store the key in an environment variable, then register the endpoint:
Commit this to .mcp.json. The key stays out of the repository; each person sets their own variable.
Claude Code and other MCP clients that let you add a request header for authentication. The endpoint supports MCP protocol revision 2026-07-28 and earlier revisions back to 2025-03-26. Connectors added through a chat app’s settings screen usually require OAuth sign-in, which is not available yet.
No. Every tool is read-only. The endpoint cannot start scans, edit findings, record decisions, or reach another client’s data. Your key decides whose workspace it reads, and no tool argument can change that.
Auditon does not send your data anywhere. When your assistant calls a tool, the result goes to that assistant, and on to whichever model it uses, under your own agreement with that provider. Review that agreement before connecting.
Revoke it in the portal and it stops working immediately, without affecting your sign-in or other keys. Keys expire after 30 days, 90 days or a year unless you choose otherwise, and every call is logged with the key that made it.
Each key can make up to 120 requests a minute, and a workspace can have up to 10 active keys. That is far more than an assistant working through your results needs.
Create a key in the portal and connect in a minute. New to Auditon? Start with a scan.
Open the client portal ↗Request a demo ↗Model Context Protocol (MCP) is an open protocol. Claude and Claude Code are products of Anthropic; Auditon is not affiliated with or endorsed by Anthropic. Example conversations on this page are illustrative and use sample data.