Connect AI coding agents using the Model Context Protocol (MCP Server)

  "mcpServers": {
    "cyver": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://<domain>/mcp",
        "--header",
        "X-API-Key: <token>",
        "--transport",
        "http-only"
      ],
      "env": {
        "NODE_TLS_REJECT_UNAUTHORIZED": "0"
      }
    }
  }

Connect to ChatGPT

To connect the MCP server to ChatGPT, you need to enable developer features and configure a custom plugin using your server credentials.

1. Open ChatGPT and navigate to Settings > Security and login.

2. Toggle on Developer mode.
   

3. Go to Plugins, and click Browse plugins.
   

4. Click the "+" icon at the top right to create a new custom plugin.
   

5. In the configuration window, fill out the connection details as follows:

   • Name: Enter a recognizable name (e.g., cyver).

   • Connection: Select the Server URL toggle and paste your Cyver MCP Server URL (https://<domain>/mcp).

   • Authentication: Select Access token / API key from the dropdown menu.

   • Header scheme: Select Custom Header from the dropdown menu, and type X-API-Key into the text field directly below it.

   • Check the box next to "I understand and want to continue" to acknowledge the custom server connection.
     

6. Submit the configuration. A secondary authentication window will appear.
   

7. Paste your generated Cyver API key into the Enter access token or API key field.

8. Click the Connect button to finalize the integration.

What you can do

Once connected, your AI assistant can access and manage data using natural-language requests. Available actions depend on the tools enabled and the permissions associated with your API key.

Projects

• List and search projects.
• Retrieve project details, including status, client, dates, assigned users, teams, assets, and findings.
• Create new projects from an existing project template.
• Update a project’s status.
• Assign or replace the assets, users, and teams linked to a project.
• View available report versions and retrieve project reports.
• Delete a project when explicitly requested.

Continuous projects

• List and search continuous projects.
• Retrieve continuous project details.
• Create continuous projects from an existing project template.
• Change a continuous project’s status to Active, Stopped, or Requested.
• Assign assets, users, and teams.
• List project runs and close the currently active run.
• View report versions and retrieve continuous project reports.
• Delete a continuous project when explicitly requested.

Findings

• List and filter findings by project, severity, status, type, asset, or vulnerability type.
• Retrieve a finding and its supporting evidence.
• Count findings and summarize them by severity or status.
• Create, update, or delete findings.
• Add or update finding evidence.
• Delete finding evidence when explicitly requested.
• Import findings from supported scanner export files.

Finding updates may replace the complete finding record. The assistant should read the existing finding first and preserve its current data when changing individual fields such as status or severity.

Clients and assets

• List, search, and retrieve clients.
• Create or update client records.
• List assets belonging to a client.
• Create or update assets such as web applications, APIs, networks, mobile applications, source-code repositories, cloud resources, and hardware devices.
• Delete clients when explicitly requested.

Deleting a client also deletes its associated projects, assets, and findings and cannot be undone.

Users and teams

• List and search users across the pentester and client portals.
• Retrieve, create, and update users.
• List, retrieve, create, and update teams.
• Manage team membership.
• Delete users or teams when explicitly requested.

Templates and reference data

Your assistant can list the configuration data required when creating or updating records, including:

• Project templates
• Report templates
• Checklist templates
• Compliance norm templates
• Labels
• Vulnerability types
• Project checklists
• Project compliance norms

Files and finding imports

Your assistant can upload files to standard or continuous pentest projects. Uploaded scanner results can be imported as findings using supported formats such as Cyver, Burp Suite, Nessus, Nmap, Qualys, Invicti, OpenVAS, OWASP ZAP, Acunetix, Snyk, Checkmarx, Prowler, Nexpose, and others.

Safe use of write actions

Ask the assistant to show or confirm the target record before performing destructive actions. Deleting clients, projects, findings, evidence, users, or teams is permanent and cannot be undone.

For updates that replace a complete record, the assistant should retrieve the current record first and preserve fields that are not intended to change.

Suggested prompts

Copy any of these prompts into your AI assistant to get started. Replace the text in brackets with your own values.

Projects and portfolio

• “List the 10 most recently created projects.”
• “Show all projects currently in the TESTING status.”
• “Which project has the highest number of findings?”
• “Show the details of project [project name or ID].”
• “Summarize the client, status, dates, assets, and finding count for project [project ID].”
• “List the users and teams assigned to project [project ID].”
• “Change project [project ID] to status [status].”
• “Create a project called [project name] for [client] using the [project template] template.”

Findings

• “How many findings are in project [project ID]?”
• “Summarize the findings in project [project ID] by severity and status.”
• “List all Critical and High findings in project [project ID].”
• “Show all findings waiting for remediation.”
• “Get the complete details and evidence for finding [finding ID].”
• “Create a Medium-severity finding called [finding name] in project [project ID].”
• “Keep all existing data unchanged and update finding [finding ID] to Fixed.”
• “Add the following evidence to finding [finding ID]: [evidence details].”

Continuous projects

• “List all active continuous projects.”
• “Show the current run for continuous project [project ID].”
• “List the run history for continuous project [project ID].”
• “Stop continuous project [project ID].”
• “Close the currently open run for continuous project [project ID].”
• “Retrieve the latest report for continuous project [project ID].”

Reports

• “List all report versions for project [project ID].”
• “Retrieve the latest report for project [project ID].”
• “Show which projects currently have published reports.”

Clients and assets

• “List all active clients.”
• “Show the projects and assets belonging to client [client name or ID].”
• “List all external-facing assets for client [client ID].”
• “Create a web application asset called [asset name] for client [client ID] with URL [URL].”
• “Create a new client called [client name].”

Users and teams

• “List all active pentester users.”
• “Show the members of team [team name or ID].”
• “List all teams assigned to project [project ID].”
• “Assign team [team ID] to project [project ID] while preserving its other team assignments.”

Templates and configuration

• “List all available project templates.”
• “List the available continuous project templates.”
• “Show all report templates.”
• “List the available vulnerability types.”
• “List the checklist and compliance norm templates available for new projects.”

Finding imports

• “Upload [scanner export file] to project [project ID] and import its findings.”
• “Import the attached Nessus file into project [project ID].”
• “Import the attached Burp Suite results and match them against the client’s existing assets.”