Findings only become valuable once they arrive where action happens: in the ticketing system, the SOAR playbook, the GRC platform, the analyst's chat. SecTepe SnapScan therefore ships a read-only Model Context Protocol (MCP) server that opens a tenant's findings in a structured way to external, agentic systems – deliberately positioned as the direct answer to NodeZero's MCP server.
What the MCP Server Provides
The server is single-tenant and strictly read-only. It provides a compact, clearly bounded set of tools:
list_findingsandget_finding– list findings and retrieve them in detail,list_scansandget_scan– view scans and their status,tenant_summary– a condensed overview of the tenant.
Each finding is enriched: with the CISA KEV signal (is the vulnerability demonstrably being actively exploited?), with the EPSS score (how likely is exploitation?), and with the proof-of-exploit artifacts from active exploitation. An agent thus receives not just "here is a CVE" but the signals that truly matter for prioritization.
Security: Tenant-Bound, Hashed Service Keys
Machine access needs clean key governance. SnapScan uses tenant-scoped, hashed API keys (snap_mcp_…) for this: the key is stored only as a SHA-256 hash, shown in clear text exactly once, carries a role and expiry, and can be soft-revoked. Keys are created via the console (POST /api/admin/console/mcp-keys, RBAC permission tenant:manage). Additionally, there is a service-key-gated REST endpoint for a findings summary.
Delivery Over stdio
The MCP server is delivered over stdio (npm run mcp) and can thus be connected directly to MCP-capable clients – for example a SOAR, a ticketing system, SecTepe.Core as a GRC target, or a desktop agent. The data flow stays read-only and governed: the client can query findings but change nothing.
The Path Into the GRC World
This closes the loop of SnapScan's additions: the AI agent and the runners produce findings, the CTEM loops keep them current, and the MCP export carries them – enriched with KEV/EPSS – in a governed way into the systems that turn them into measures and evidence.
Conclusion
The MCP findings export makes SnapScan interoperable with the agentic tool world without giving up control: read-only, tenant-bound, with hashed keys and meaningful enrichment. This turns pentest results into a data source that automation can actually do something with.