Your coding agent already lives in the repository. Give it a token and it can ask what is open, start a deep scan, read the verified attack path and pull the fix prompt, all without opening a dashboard.
Same data, same scope, same verified findings.
List repositories, open findings by severity, advisories that are actually imported in code, and the last scan on each repository. Your agent gets the answer, not a PDF.
Kick off a deep scan or a quick recon on any branch, then poll the scan and tail its event log: threat model, hunters, skeptic, validation, cost and lines read.
Every finding carries its attack path with code excerpts, a proof of concept, what the fix must guarantee, what it must not break, a regression test and a ready-to-run fix prompt. Your agent reads it and gets to work.
Switch PR reviews to “when asked”, move a repository to weekly deep scans, raise the check-run fail threshold, mark a finding fixed or dismissed with a reason.
A hosted MCP server over Streamable HTTP. No install, no local process: paste the config, add your token, start asking.
https://agentcernis-api.dean-964.workers.dev/mcp
AuthAuthorization: Bearer ac_live_…
claude mcp add --transport http agentcernis https://agentcernis-api.dean-964.workers.dev/mcp \
--header "Authorization: Bearer YOUR_TOKEN"
.cursor/mcp.json in your project, or ~/.cursor/mcp.json for every project{
"mcpServers": {
"agentcernis": {
"url": "https://agentcernis-api.dean-964.workers.dev/mcp",
"headers": { "Authorization": "Bearer YOUR_TOKEN" }
}
}
}
~/.codex/config.toml[mcp_servers.agentcernis] url = "https://agentcernis-api.dean-964.workers.dev/mcp" http_headers = { Authorization = "Bearer YOUR_TOKEN" }
Any other MCP client: point it at the URL above as a Streamable HTTP server and send the bearer header. The server is stateless, answers each JSON-RPC request with a single JSON response, and supports initialize, ping, tools/list and tools/call. Every tool returns a short text summary plus structured JSON.
The same token works on the JSON API behind the dashboard. Scripts, CI jobs and home-grown agents welcome.
curl -s https://agentcernis-api.dean-964.workers.dev/api/repos \ -H "Authorization: Bearer $AGENTCERNIS_TOKEN" # → { "repos": [ { "id": "…", "full_name": "acme/api", "open": { "critical": 1, "high": 2, … }, … } ] }
curl -s -X POST https://agentcernis-api.dean-964.workers.dev/api/repos/REPO_ID/scan \ -H "Authorization: Bearer $AGENTCERNIS_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "kind": "deep", "ref": "main" }' # → { "scanId": "…", "status": "running" } then poll GET /api/scans/SCAN_ID and /api/scans/SCAN_ID/events
curl -s https://agentcernis-api.dean-964.workers.dev/api/findings/FINDING_ID \ -H "Authorization: Bearer $AGENTCERNIS_TOKEN" | jq -r '.finding.detail.fixPrompt' # FINDING_ID comes from GET /api/findings?status=open (ids look like REPO_ID:fingerprint)
A personal token acts as you: it sees exactly the organizations you see in the dashboard, nothing more. Revoke it in one click and everything using it stops immediately.
ac_live_, is shown once, and only a hash is stored on our side.Tokens cannot create or revoke other tokens and cannot buy credits; both stay with a signed-in person. Scans started from an agent are metered exactly like scans started from the dashboard.
Generated from the server's own tool list. * marks required inputs.
| Tool | What it does | Inputs |
|---|---|---|
list_repos | Repositories connected to Agent Cernis, with open findings by severity, PR review mode, deep scan schedule, fail threshold and last scan. Start here to get repo ids. | owner |
get_repo | One repository's settings plus its remembered threat model summary (stack, entry points, auth model) from the last deep scan. | repo* |
update_repo_settings | Change a repository's PR review mode (every_push | when_asked | off), deep scan schedule (off | daily | weekly | monthly) or check-run fail threshold (critical | high | medium | any). | repo* prReviewMode deepScanSchedule failThreshold |
start_deep_scan | Queue a deep scan (threat model, hunters, skeptic, validation) of a repository's default branch or a given ref. Returns the scan id to poll with get_scan. Rejected if a scan of that kind is already running. | repo* kind ref |
list_scans | Recent scans (PR reviews, deep scans, recon, fix checks) with status, findings count, cost and duration. Filter by repo, kind or status. | repo kind status limit |
get_scan | One scan's status, stage, findings by severity, lines read, cost, duration, error and threat model summary. | scanId* |
get_scan_events | The tail of a scan's progress log (stage changes, hunter and skeptic messages, stats). Use it to follow a running scan. | scanId* limit |
list_findings | Findings across your repositories. Filter by repo, owner, severity (comma-separated), status (open | fixed | dismissed) or a text query. Open includes findings not re-seen by the latest scan. | repo owner severity status q includeLowConfidence limit |
get_finding | The full finding: impact, preconditions, attack path with code excerpts, proof of concept, validation result, fix guidance, the ready-to-run fix prompt, regression test and patch when one was drafted. | findingId* |
set_finding_status | Mark a finding open, fixed or dismissed, with an optional reason. | findingId* status* reason |
list_cves | Known advisories (CVE/GHSA) affecting your repositories' dependencies, with reachability: in_code (imported where it matters), installed (present, not imported) or resolved. | repo owner tab q |
get_settings | Organization defaults: PR review mode, check-run fail threshold and email notifications. | owner* |
update_settings | Change organization defaults. Set applyToAll to push PR review mode and fail threshold onto every connected repository. | owner* prReviewMode failThreshold emailNotifications applyToAll |
get_account | Who this token acts as, which organizations it can see, the billing mode and remaining credits, and what each scan kind costs. | none |
Connect the repositories, create a token, and ask your agent what is open.