Skip to content

Auditon security assessments

by auditon.co · remote · no sign-in to list tools · v1.0.0 · published by co.auditon

Read-only access to your Auditon vulnerability scans: findings, endpoints, reports and changes.

Read only
CompareRegistry entry

6 tools: 6 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http assessments https://auditon.co/mcp --header 'Authorization: <your-authorization>'

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

6 tools

Only reads 6Claude Code: allow
  • compare_scansWhat changed on an endpoint between two scans: appeared, resolved, not reassessed (the check did not complete, so status is unknown) and severity changes.No findings

    Why it is in this group

    • The name "compare_scans" says "compare": a word for reading.
    Description, as the server wrote it
    What changed on an endpoint between two scans: appeared, resolved, not reassessed (the check did not complete, so status is unknown) and severity changes. Without scan ids, compares the endpoint's two most recent scans.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_findingFull detail for one finding: description, impact, remediation, references, evidence, analyst decision and its history across scans.No findings

    Why it is in this group

    • The name "get_finding" says "get": a word for reading.
    Description, as the server wrote it
    Full detail for one finding: description, impact, remediation, references, evidence, analyst decision and its history across scans.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_reportOne scan as structured data: rating, coverage gaps, findings, items requiring verification, accepted risks, dismissed false positives and passed controls.No findings

    Why it is in this group

    • The name "get_report" says "get": a word for reading.
    Description, as the server wrote it
    One scan as structured data: rating, coverage gaps, findings, items requiring verification, accepted risks, dismissed false positives and passed controls. Read "interpretation" before drawing conclusions. Set detail=true for descriptions and remediation.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_endpointsHosts assessed in this workspace, with open findings by severity and the most recent scan.No findings

    Why it is in this group

    • The name "list_endpoints" says "list": a word for reading.
    Description, as the server wrote it
    Hosts assessed in this workspace, with open findings by severity and the most recent scan. Start here.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_findingsCurrent findings across all scans, most severe first.No findings

    Why it is in this group

    • The name "list_findings" says "list": a word for reading.
    Description, as the server wrote it
    Current findings across all scans, most severe first. Defaults to open findings; potential (unconfirmed) matches are included and marked by assurance.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_scansScans, newest first: type, status, rating and coverage.No findings

    Why it is in this group

    • The name "list_scans" says "list": a word for reading.
    Description, as the server wrote it
    Scans, newest first: type, status, rating and coverage. With an endpoint, rating, findings and coverage are for that endpoint only.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http assessments https://auditon.co/mcp --header 'Authorization: <your-authorization>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__assessments__list_endpoints",
      "mcp__assessments__list_scans",
      "mcp__assessments__get_report",
      "mcp__assessments__list_findings",
      "mcp__assessments__get_finding",
      "mcp__assessments__compare_scans"
    ],
    "ask": [],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as assessments. Review it before you use it.