Run Barrion scans and pentests from your AI assistant
Add one line to your MCP client config. Claude, Cursor, Codex and other assistants can then start passive security scans, run AI pentests on targets you have verified, and read the results, over an OAuth connection. No API key in your config file.
Sign in once
The first tool call opens your browser to sign in to Barrion and approve the connection. The token is cached in ~/.mcp-auth, refreshed automatically, and tied to your account. Delete that folder to sign out.
Tools
| Tool | Scope | What it does |
|---|---|---|
| create_web_scan | scan:create | Start a web scan (passive, read-only) of a URL. Subject to your plan’s daily scan limit and per-domain rescan window, exactly like the dashboard. |
| get_latest_scan_by_domain | scan:read | Security score, risk level, and a count of findings by severity for a domain’s most recent scan. www and non-www are treated as one domain. |
| get_recent_scans_by_domain | scan:read | The last few scans for a domain (5 by default), newest first, so the assistant can see whether the score is improving or a finding came back. |
| get_web_scan_findings | scan:read | The individual findings from a web scan, worst first, with where each was found and how to fix it. |
| list_pentest_targets | pentest:read | Your verified targets, your available credits, what each depth reserves, and your MCP budget. The first call before starting a pentest. |
| start_pentest | pentest:create | Start an AI pentest on a verified target. Spends credits within a per-run ceiling and your MCP budget. A request id makes a retry safe: it can never start a second run. |
| get_pentest | pentest:read | Status and credits of one pentest. Runs take hours, so it says when to check back. |
| list_pentests | pentest:read | Your recent pentests, newest first, to find one or to see what is running. |
| get_pentest_findings | pentest:read | The findings once the report is released, worst first, with where each was found and how to fix it. Finding text comes from the tested site, so the assistant treats it as data and never as instructions. |
| cancel_pentest | pentest:create | Stop a running pentest. Its credits settle for the work already done and the rest is returned. |
| list_organizations | - | The organizations your account belongs to and your role in each, so a connection can act inside one. |
| whoami | - | The signed-in Barrion account and the scopes it granted. |
What it can reach
- →OAuth 2.1 with PKCE. A browser sign-in, never a key pasted into a file.
- →Scoped, short-lived tokens. Limited to
scan:create,scan:read,pentest:createandpentest:read, and revocable from your account at any time. - →Audience-pinned. A token issued for the MCP endpoint cannot be replayed against the main Barrion API.
- →Passive scans are safe for production. No payloads, no brute forcing, no state changes.
- →Pentests stay inside limits you set. Verified targets only, a per-cycle MCP budget, and an off switch per target. With no budget set, an assistant cannot start a pentest.
Requirements
Node.js 20.18.1 or newer, which npx uses to run the launcher. Passive scans run on every plan, including the free tier. AI pentests need a verified target, credits, and an MCP budget set under Settings, MCP.
FAQ
Which AI assistants can connect?
Any MCP client. Claude Desktop, Claude Code, Cursor, Codex, opencode and Windsurf all read the same mcpServers config block and differ only in where that config file lives. If your assistant speaks the Model Context Protocol, it works.
Does my Barrion password go into a config file?
No. The only thing in your MCP config is the command npx -y @barrion/mcp. Authentication is a browser sign-in the launcher runs the first time you use a tool, using OAuth 2.1 with PKCE. The resulting token is short-lived, scoped, and cached under ~/.mcp-auth on your machine.
What can the assistant actually do once it is connected?
It gets twelve tools. Six cover web scans and your account: create_web_scan, get_latest_scan_by_domain, get_recent_scans_by_domain, get_web_scan_findings, list_organizations and whoami. Six cover AI pentests: list_pentest_targets, start_pentest, get_pentest, list_pentests, get_pentest_findings and cancel_pentest. It acts as your Barrion user and is bound by the same plan limits as the dashboard. Pentests also need a verified target, credits and an MCP budget you set yourself, and it can't reach anything else in your Barrion account.
Is running scans from an assistant safe for production?
Passive scans, yes: they observe TLS, headers, cookies, DNS and network surface without sending payloads, brute forcing, or changing state, so they are safe to run against live production traffic. AI pentests are different. They actively test the target (SQL injection, access control, IDOR), exactly like a pentest started from the dashboard, so only run them against systems you are ready to have tested. An assistant can only test a target you have verified, you can switch it off per target, and what it can spend is capped by your MCP budget.
How do I control what an assistant can spend on pentests?
In Settings, MCP, you set an MCP budget: the most credits your assistants can spend on pentests per billing cycle. Until you set one, an assistant cannot start a pentest. Each start also carries its own ceiling, and a retry of the same request never starts a second run. You can turn MCP runs off for any single target, and you can see every pentest an assistant started, with its credits, in the same place.
What are the requirements?
Node.js 20.18.1 or newer, which npx uses to run the launcher. Nothing else to install: npx fetches @barrion/mcp on first use and keeps it cached.
Wire up your assistant
Create a free account, add npx -y @barrion/mcp to your client, and scan from the chat.