Give coding agents runtime security evidence.
The open-source MCP server and Agent Skills connect coding agents to DAST: launch scans, inspect evidence, propose changes, and rescan before human review.
Works with any MCP-capable coding agentClaude Code · Cursor · GitHub Copilot · Windsurf
Agents need evidence, not another dashboard
Anyone's agent can fix a finding; the scanner underneath is what matters. NightVision tests the running application and exposes the results through structured MCP tools: HTTP evidence on request-level findings, file and line on supported source-discovered API scans. The pattern is laid out in our source-linked DAST essay and the AI and agentic development use case.
MCP security testing with the open-source NightVision server
The NightVision MCP server runs locally next to the coding assistant, makes outbound calls to the NightVision API, and never listens on a public port. Through it, an agent can:
Run scans
Create and manage targets, select an authentication profile, start DAST scans, and monitor status from the agent's session.
Read findings with evidence
Retrieve checks and runtime evidence, export results, and use Code Traceback on supported source-discovered API scans.
Discover APIs from source
Generate OpenAPI specs with API eNVy: local, deterministic static analysis, results in under 20 seconds.
Reusable skills, built on open standards
The NightVision Agent Skills guide scan configuration, API discovery, triage, and CI/CD integration; installation commands live in the repository.
Not locked to one agent
MCP is an open protocol and the skills are plain instruction files in the open skills format, so they travel across MCP-capable assistants and Codex- and Cursor-style environments alike.
Security where the code already lives
A developer can configure a scan, triage SARIF findings against the actual source, and wire NightVision into GitHub Actions, GitLab CI, Jenkins, Azure DevOps, or Bitbucket without leaving their session.
What the agent consumes, and what it decides
The deterministic finding
The scan result, observed runtime evidence, the source-derived OpenAPI spec, and file and line on supported source-discovered API findings.
The fix, then the merge
The agent reads the evidence, locates the code, and drafts the fix. A human reviews the pull request and approves the merge.
NightVision is not an AI pentester roaming your estate; it is the evidence layer under whatever agents you run, with a human holding the merge. More on securing MCP itself: MCP server security testing and the NightVision MCP server announcement.
Agent questions, answered.
What is the NightVision MCP server?
An open-source Model Context Protocol server that gives AI assistants structured access to NightVision: manage targets, start DAST scans, monitor status, read findings with evidence, and generate OpenAPI specs from source. It runs locally and never sits on a public port.
What can a coding agent actually do with NightVision?
Launch dynamic scans against a running web application or API, retrieve checks and runtime evidence, discover API routes from source, export results, propose a code or configuration change, and rescan. Code Traceback adds file and line on supported source-discovered API scans.
How do I install the NightVision skills for Claude Code?
From your terminal: claude plugin marketplace add nvsecurity/claude-marketplace, then claude plugin install nightvision@nvsecurity. Or run the same commands with a leading slash inside Claude Code. You may need to restart Claude Code after installation.
Do the skills and MCP server work with agents other than Claude Code?
Yes. MCP is an open protocol that works with MCP-capable assistants such as Claude, Cursor, and Windsurf, and the skills are plain instruction files in the open skills format that other agent environments can read too.
Is NightVision an autonomous pentester?
No. NightVision is agent-ready: the deterministic, source-linked runtime-evidence layer that coding agents consume. The agent drafts the fix from that evidence, and a human reviews and merges it. Determinism on the finding, agents on the fix, humans on the merge.
Give your agents ground truth.
See the MCP server and skills against your own application, or install the plugin in Claude Code: claude plugin marketplace add nvsecurity/claude-marketplace