MCP Findings Export & Service Keys: SnapScan Results for SOAR and AI Agents

Findings only become useful once they reach the place where people act on them. That might be the ticket system, the SOAR playbook, the GRC platform or the analyst's chat. So SecTepe SnapScan ships a read-only Model Context Protocol (MCP) server. It gives outside agentic systems structured access to a tenant's findings. We built it on purpose as an open alternative to the closed MCP servers of commercial pentest platforms.

What the MCP Server Provides

The server serves one tenant and is strictly read-only. It offers a small, clearly limited set of tools:

• list_findings and get_finding: list findings and fetch their details,
• list_scans and get_scan: view scans and their status,
• tenant_summary: a short overview of the tenant.

Each finding comes with extra data:

• the CISA KEV signal: is the flaw known to be exploited right now?
• the EPSS score: how likely is an exploit?
• the proof-of-exploit artifacts from active exploitation.

So an agent gets more than "here is a CVE". It gets the signals that really matter when you set priorities.

Security: Tenant-Bound, Hashed Service Keys

Machine access needs clean key management. SnapScan uses tenant-scoped, hashed API keys (snap_mcp_…) for this:

• The key is stored only as a SHA-256 hash.
• It is shown in clear text exactly once.
• It has a role and an expiry date.
• It can be soft-revoked.

You create keys in the console (POST /api/admin/console/mcp-keys, RBAC permission tenant:manage). There is also a REST endpoint, protected by a service key, that returns a findings summary.

Delivery Over stdio

The MCP server runs over stdio (npm run mcp). That way you can connect it straight to MCP-capable clients. Examples are a SOAR, a ticket system, SecTepe.Core as a GRC target or a desktop agent. The data flow stays read-only and governed. The client can query findings but can't change anything.

The Path Into the GRC World

This closes the loop of the new SnapScan features:

• The AI agent and the runners produce findings.
• The CTEM loops keep them up to date.
• The MCP export adds KEV/EPSS data and passes them in a governed way to the systems that turn them into measures and evidence.

Conclusion

With the MCP findings export, SnapScan works with agentic tools without giving up control. It is read-only and bound to one tenant. It uses hashed keys and adds useful context to each finding. This turns pentest results into a data source that automation can really work with.