Give coding agents runtime security evidence.
The public MCP server and open-source Agent Skills connect coding agents to DAST: launch scans, inspect evidence, propose changes, and rescan before human review.
Works with any MCP-capable coding agentClaude Code · Cursor · GitHub Copilot · Windsurf
Agents need evidence, not another dashboard
Anyone's agent can fix a finding; the scanner underneath is what matters. NightVision tests the running application and exposes the results through structured MCP tools: HTTP evidence on request-level findings, file and line on supported source-intelligence API scans. The pattern is laid out in our source-linked DAST essay and the AI-assisted development use case.
Start a scan from your pipeline on every pull request or deploy, or from the coding agent you already use (Claude Code, Codex) through the NightVision MCP server and skills. Testing what agents build? See AI-assisted development.
Run NightVision from your coding agent with the public MCP server
The NightVision MCP server runs locally next to the coding assistant, makes outbound calls to the NightVision API, and never listens on a public port. Through it, an agent can:
Run scans
Create and manage targets, select an authentication profile, start DAST scans, and monitor status from the agent's session.
Read findings with evidence
Retrieve checks and runtime evidence, export results, and use Code Traceback on supported source-intelligence API scans.
Map routes with source intelligence
Generate an OpenAPI spec from source with API eNVy in under 20 seconds. It runs locally and deterministically; no LLM reads your code.
Setting it up? Follow the guide to connect DAST to Claude Code and Codex.
Reusable skills, built on open standards
The NightVision Agent Skills guide scan configuration, API discovery, triage, and CI/CD integration; installation commands live in the repository.
Not locked to one agent
MCP is an open protocol and the skills are plain instruction files in the open skills format, so they travel across MCP-capable assistants and Codex- and Cursor-style environments alike.
Security where the code already lives
A developer can configure a scan, triage SARIF findings against the actual source, and wire NightVision into GitHub Actions, GitLab CI, Jenkins, Azure DevOps, or Bitbucket without leaving their session.
What the agent consumes, and what it decides
The deterministic finding
The scan result, observed runtime evidence, the source-derived OpenAPI spec, and file and line on supported source-intelligence API findings.
The fix, then the merge
The agent reads the evidence, locates the code, and drafts the fix. A human reviews the pull request and approves the merge.
NightVision is not an AI pentester roaming your estate; it is the evidence layer under whatever agents you run, with a human holding the merge. More on securing MCP itself: how to inventory MCP servers and test the APIs they front and the NightVision MCP server announcement. For the bigger picture, see our guide to application security testing in the age of coding agents.
Agent questions, answered.
What is the NightVision MCP server?
A public Model Context Protocol server that gives AI assistants structured access to NightVision: manage targets, start DAST scans, monitor status, read findings with evidence, and generate OpenAPI specs from source. It runs locally and never sits on a public port.
What can a coding agent actually do with NightVision?
Launch dynamic scans against a running web application or API, retrieve checks and runtime evidence, discover API routes from source, export results, propose a code or configuration change, and rescan. Code Traceback adds file and line on supported source-intelligence API scans.
How do I install the NightVision skills for Claude Code?
From your terminal: claude plugin marketplace add nvsecurity/claude-marketplace, then claude plugin install nightvision@nvsecurity. Or run the same commands with a leading slash inside Claude Code. You may need to restart Claude Code after installation.
Do the skills and MCP server work with agents other than Claude Code?
Yes. MCP is an open protocol that works with MCP-capable assistants such as Claude, Cursor, and Windsurf, and the skills are plain instruction files in the open skills format that other agent environments can read too.
Is NightVision an AI pentester?
No. NightVision is agent-ready: the deterministic, source-linked runtime-evidence layer that coding agents consume. The agent drafts the fix from that evidence, and a human reviews and merges it. Determinism on the finding, agents on the fix, humans on the merge.
Give your agents ground truth.
See the MCP server and skills against your own application, or install the plugin in Claude Code: claude plugin marketplace add nvsecurity/claude-marketplace