> For the complete documentation index, see [llms.txt](https://docs.konvu.com/konvu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.konvu.com/konvu/reference/mcp-integration.md). # MCP Integration Connect your AI assistant to Konvu's triage insights using the Model Context Protocol (MCP). The Konvu MCP server lets MCP-enabled AI assistants query your Konvu organization directly: check if you're affected by a CVE, get exploitability details, list Konvu's recommendations for a repository, or dismiss a finding from your chat interface. It covers SCA (open-source dependency) findings. The MCP server reads findings. It does not import them. To bring findings into Konvu, connect a [scanner](/konvu/get-started/bring-in-findings.md), use the [API](/konvu/get-started/bring-in-findings.md#import-scanner-findings-with-the-api), upload a [CSV file](/konvu/get-started/bring-in-findings/csv-import.md), or submit an [external report](/konvu/get-started/bring-in-findings/external-reports.md). ## Available tools | Tool | Description | | ----------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | | `konvu_am_i_affected` | Check if a vulnerability affects your repositories. Returns up to 10 open findings with Konvu's recommendation for each. | | `konvu_get_cve_details` | Get vulnerability details from Konvu's vulnerability database, including vulnerable functions and exploitability conditions. | | `konvu_get_recommendations` | Get Konvu's fix and dismiss recommendations for the SCA findings in one repository. | | `konvu_get_repositories` | List your repositories in Konvu with their number of SCA findings. | | `konvu_dismiss_vulnerability` | Dismiss an SCA finding, given its scanner identifier, repository URL, source, and a reason. The dismissal is written back to the scanner. | | `konvu_random_cve` | Get a random vulnerability from Konvu's vulnerability database (useful for exploration). | | `konvu_who_am_i` | Get the name of the organization you're connected to. | ## Setup Open **Integrations** in Konvu and select **Claude** or **Cursor** under **AI Assistants** for the same steps in the dashboard. You sign in with your Konvu account the first time your assistant connects. API keys are not accepted. Every user of your organization gets every tool, including dismiss. ### Claude (Integration method) {% hint style="info" %} Available on Claude Max, Team, and Enterprise plans via [custom integrations](https://support.anthropic.com/en/articles/11175166-about-custom-integrations-using-remote-mcp). {% endhint %} 1. Add a custom integration in Claude with server URL: `https://mcp.konvu.com/sse` 2. Enable the Konvu integration from the search and tools menu 3. Complete the authentication flow ### Claude Desktop (manual config) Requires Node.js >= 24. Add to your `claude_desktop_config.json`: ```json { "mcpServers": { "Konvu": { "command": "npx", "args": [ "-y", "mcp-remote", "https://mcp.konvu.com/sse" ] } } } ``` ### Cursor 1. Go to **Cursor Settings** > **MCP** 2. Click **Add new global MCP server** 3. Add the same config as above to your `mcp.json` 4. Set your chat to **Agent mode** {% hint style="info" %} If you added Konvu with an older config that ends with `"3334"`, remove that argument. A fixed callback port can cause a sign-in loop when the port is busy. {% endhint %} ## What you can do Once connected, ask your assistant questions like: * "Am I affected by CVE-2021-23337?" * "What are the exploitability conditions for CVE-2021-44228?" * "Which findings in github.com/acme/web-app does Konvu recommend fixing?" The assistant will call the Konvu MCP tools to get real-time data from your Konvu organization. ## Limitations * SCA findings only. SAST, container, and secret findings and vulnerability reports are not available through MCP. * No import. The MCP server cannot create findings or submit reports. * Dismiss works one finding at a time and needs the scanner's identifier for that finding. It only works for scanners that support write-back. * The server uses the SSE transport at `https://mcp.konvu.com/sse`. Clients that only support streamable HTTP need `mcp-remote`, as in the config above. Need a tool the MCP server doesn't have yet? Tell us what you want your assistant to do at [support@konvu.com](mailto:support@konvu.com?subject=MCP%20Feature%20Request). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.konvu.com/konvu/reference/mcp-integration.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.