Website Security Scanner with MCP Support

A scan report is most useful when it becomes a clear next step. You might need to understand a missing security header, prepare a developer handoff, or check a website again after a release. BlackSight's new MCP integration brings those tasks into the AI assistant you already use, with access you control from your dashboard.

What does MCP add to a website security scanner?

Model Context Protocol, or MCP, gives an AI application a standard way to discover and call tools exposed by another service. BlackSight provides tools for retrieving real scan results and working with existing scan configurations. Your assistant can use that evidence to explain a finding and help you decide what to address first.

BlackSight runs the scanners; your AI client requests results through the connection. The platform covers web vulnerabilities, SSL/TLS, DNS, security headers, API security, and more. The integration uses the MCP Streamable HTTP transport . Your client needs support for a remote server and bearer-token authentication.

What can your assistant do?

Every MCP token starts with permission to read reports and non-secret settings. Scan execution and settings changes are separate choices when you create the token.

For a report review, ask: “Summarize the highest-priority findings in my latest website security report. Include the report ID and recommended next steps.” The assistant can retrieve the report, explain its evidence, and help draft a fix list.

After a deployment, a token with scan permission can handle: “Find my verified website target and ask me before starting a new headers scan.” The scan returns a report ID so the assistant can check progress and read the results when it finishes. A scan still consumes your normal plan allowance.

For recurring checks, ask: “Show my current weekly SSL scan schedule and preview moving it to Tuesday at 09:00 UTC. Wait for my approval before applying it.” This requires settings-write permission and an existing recurring scan. Available frequencies and options depend on the plan and scanner.

How to connect BlackSight through MCP

1. Choose a plan with MCP access. Light is $9/month on monthly billing. Plus, Pro, and Enterprise also include MCP. See the plan comparison for scan allowances. Cancel anytime.
2. Open the MCP tab in your dashboard. An organization owner or admin can create a named token, choose an expiry, and enable the optional permissions needed for that connection. Start with the default read access if you only want report summaries.
3. Add a remote server to your MCP client. Copy the server URL from the dashboard and select Streamable HTTP. Save the token in the client's protected connection settings using bearer authentication or an Authorization: Bearer YOUR_MCP_TOKEN header. Copy the token when it is created; BlackSight shows its secret value only once.
4. Start with an existing report. Ask your assistant to summarize your latest scan. To launch a new scan, first verify the target in BlackSight and enable the token's scan permission.

Keep tokens in your client's protected settings instead of prompts or source code. Your Reports API key is a separate credential and cannot substitute for an MCP token. You can revoke an MCP token from the dashboard to stop its access.

Keep control of changes and customer data

Each token belongs to one organization. BlackSight checks access when tools run, including the token's permissions, current membership, and eligible plan. Requests for another organization's targets or reports are outside that access.

Settings writes use a stored before-and-after preview. Your client should show it and ask for approval before applying it. BlackSight enforces the exact stored change, checks that the settings have not changed since the preview, and rejects expired previews after ten minutes. Granting write permission authorizes the client to make those supported changes; use a client whose approval behavior you trust.

Billing, members, credentials, tokens, alert destinations, target management, and deletions stay in the dashboard. Scan output is evidence to review, including content from scanned websites; your assistant should treat it as data, never as instructions.

MCP makes findings easier to use, but it does not automatically patch your website. Review the remediation guidance, implement the fix, and scan again to check the result. For broader coverage, explore BlackSight's security scanners and our API security checklist.

Frequently asked questions

Does BlackSight offer a website security scanner with MCP support?

Yes. BlackSight connects a compatible AI assistant to your organization's website security reports and non-secret scan settings through Model Context Protocol (MCP). Optional permissions allow scans on verified targets and previewed changes to existing scan schedules or supported scanner options.

Which plans include MCP access?

MCP access is included with Light, Plus, Pro, and Enterprise. Light costs $9/month on monthly billing. The Free plan does not include MCP access. Existing scan quotas and plan restrictions still apply.

Do I need a token to connect?

Yes. An organization owner or admin creates an MCP token in the dashboard's MCP tab. Add it to your client's protected connection settings as a bearer token. MCP tokens are separate from Reports API keys and can be revoked in the dashboard.

Which MCP clients can connect?

Use a client that supports remote MCP servers over Streamable HTTP and bearer-token authentication or a custom Authorization header. Clients that only support local servers, legacy SSE, or OAuth-only connections need additional compatible integration support.

Can MCP change my account settings or access another customer's reports?

Each token is restricted to one organization. MCP can read reports and non-secret scan settings by default. A separate write permission enables exact previews of supported scan-setting changes. Billing, members, credentials, tokens, target management, and deletions stay in the dashboard. Other organizations' data is outside the token's access.

Does the MCP integration automatically fix vulnerabilities?

No. It provides scan findings and remediation guidance to your AI assistant. Your team reviews and implements fixes, then runs a new scan to check the result.