Skip to content
Request beta access

MCP & CLI

One evidence chain. Two ways to use it.

Use MCP when a compatible coding agent should call Vybentis. Use the CLI for your terminal and CI. Both return the same versioned evidence.

Open the setup guide Watch an example

Choose your path

MCP or CLI?

You do not need both. Start with the path that matches the work you are doing now.

For coding agents

Connect Vybentis to the agent you already use.

MCP gives a compatible coding agent a small, typed tool set. The agent can read evidence, prepare one fix and ask to check the same rule again.

Best for guided agent work

Setup guide

Connect MCP in three clear steps.

The local stdio server keeps credentials in the process environment and exposes a small tool catalog.

Create access

Issue one scoped token.

Create an API token for the organization and keep the token in a local secret manager. MCP needs the API URL, token and organization ID.

Scoped token API origin Organization ID
Connect the server

Choose your local client.

Local stdio
codex setup
codex mcp add vybentis \
  --env VYBENTIS_API_URL=https://api.vybentis.dev \
  --env VYBENTIS_ACCESS_TOKEN=your_scoped_token \
  --env VYBENTIS_ORGANIZATION_ID=your_organization_id \
  -- npx --yes @vybentis/cli@0.1.0 mcp serve

Keep the token private. Do not commit it to a shared MCP file or pass it as a normal process argument.

Test the connection

Ask for evidence, not a vague review.

“List my Vybentis projects. Open the latest finding and prepare one fix prompt with its rule and verification step.”

The agent should discover the Vybentis tools before it answers.

Live example

Watch one release task move without losing its evidence.

Every state change keeps the same finding, rule and scope. Verification runs the documented rule again.

Vybentis release sessionlive
MCP tool sessionAgent keeps the evidence attached
Connected8 tools discovered
Scan approvedPublic target confirmed
Evidence readSEC_HEADER_002
Fix preparedOne scoped task
VerifiedSame rule passed
8 tools discovered1 of 5
BoundedOnly the selected project and target.
TraceableThe rule and evidence stay attached.
VerifiableThe same rule closes the finding.

MCP tool set

Eight tools. Each one has one clear job.

A small catalog helps the agent choose correctly and keeps write actions easy to recognize.

vybentis_projects_list

See projects and their current release gate.

Read only
vybentis_scan_start

Start one approved, bounded scan.

Needs confirmation
vybentis_scan_get

Read scan status and the final summary.

Read only
vybentis_findings_list

Filter the findings returned by a scan.

Read only
vybentis_finding_get

Read evidence, scope and remediation.

Read only
vybentis_fix_prompt_get

Prepare one agent ready fix task.

Read only
vybentis_verification_start

Run the documented check again.

Needs confirmation
vybentis_report_get

Get a report link or Markdown output.

Read only

One evidence contract

Web, MCP and CLI describe the same finding.

A report, agent and CI job can all refer to the same stable rule and verification target.

ruleSEC_HEADER_002
evidenceHeader absent on two public routes
severitymedium
confidencehigh
stateobserved
verificationrun the same rule again

Clear limits

Know what is ready today.

Local CLI is implemented.

It scans supported repository evidence on your machine. Source and result uploads are not part of local mode.

Local MCP stdio is implemented.

It connects through the CLI process and requires a scoped token, organization ID and API origin.

Remote CLI URL commands come later.

Use the web scan or MCP for live targets. The MVP CLI requires --local and a repository path.

Common questions

Simple answers before you connect.