Detectify MCP server

What the model can do

Detectify (external attack surface and web application scanning): vulnerabilities by status, severity, source, asset and host, with CVSS, CWE and OWASP class and when each was first and last seen, one finding in full, root assets and their subdomains, Application Scan Profiles with their latest scan, scan status and schedule; can start, stop and schedule scans, mark findings fixed, accepted risk or false positive (or clear that), add and remove assets, and invite members.

Reads

• detectify_list_vulnerabilitiesDetectify findings: title, status, CVSS severity and score, host and location, asset, source (application scanning, surface monitoring…
• detectify_get_vulnerabilityOne Detectify finding in full: what it is, the risk, references, CVSS, where it was found and its status.
• detectify_list_assetsRoot assets (domains and IPs) on the Detectify team: status, whether Surface Monitoring is on, how each was added and when it was last seen.
• detectify_list_subdomainsSubdomains of one Detectify root asset, added by hand or discovered by Detectify's scanners, with when each was discovered and last seen.
• detectify_list_scan_profilesApplication Scan Profiles on the Detectify team: name, endpoint scanned, and the latest scan's status, start, end and any error.
• detectify_get_scanThe current or latest Application Scan on one scan profile, and its schedule (frequency, first and next scan).

Acts, when you ask

These change something in Detectify. The model is told to use them only when you ask for exactly that, and each one is granted by name: per team on a shared connection, by the owner on a personal one.

• detectify_start_scanStarts an Application Scan on a Detectify scan profile within a few minutes.
• detectify_stop_scanStops the scan running on a Detectify scan profile within seconds; it cannot be resumed, only started again.
• detectify_schedule_scanSets the scan schedule of a Detectify scan profile (once, daily, weekly, biweekly or monthly), replacing any schedule it had.
• detectify_remove_scan_scheduleRemoves the scan schedule from a Detectify scan profile, so no further scans run on their own.
• detectify_set_vulnerability_statusMarks a Detectify finding fixed, accepted risk or false positive, which everyone on the team sees and which takes it out of the open findings.
• detectify_clear_vulnerability_statusClears a fixed, accepted risk or false positive mark from a Detectify finding, so it counts as open again.
• detectify_add_assetAdds a domain, subdomain or IP address to the Detectify team as an asset, to be verified and monitored; it may count against the subscription.
• detectify_delete_assetPermanently deletes an asset from the Detectify team; it stops being monitored and its findings go with it.
• detectify_invite_membersInvites people to the Detectify team by email, each with a role (Admin manages users, assets and billing…

Connect it

First connect Detectify on Dashboard → Connections, then add Memtro to your client once. The Detectify tools appear alongside the tools of everything else you have connected; nothing is configured per connector.

claude plugin marketplace add memtro-org/claude-memtro
claude plugin install memtro@memtro --config api_key=sk-memtro-...

{
  "mcpServers": {
    "memtro": {
      "url": "https://platform.memtro.com/api/mcp",
      "headers": {
        "Authorization": "Bearer sk-memtro-..."
      }
    }
  }
}

{
  "mcp": {
    "memtro": {
      "type": "remote",
      "url": "https://platform.memtro.com/api/mcp",
      "headers": {
        "Authorization": "Bearer sk-memtro-..."
      }
    }
  }
}

Who may use it

The key identifies the person, and the server offers that person the tools they may use everywhere else in Memtro. A shared Detectify connection is used by the teams an administrator granted it to, tool by tool, on the Permissions page; a personal connection is used by its owner alone, and its tools that act stay off until the owner allows them. See Teams and permissions and Connectors.

Ask it like this

• › Which high-severity findings are still active on our main site?
• › What new findings has surface monitoring raised since Monday?
• › Which subdomains of acme.com were discovered this month?
• › When did the last scan of the checkout profile run, and did it finish?
• › Start a scan on the checkout profile.

Questions

Is this an official Detectify MCP server?

No. It is Memtro's MCP server with Memtro's Detectify connector behind it: the connector reads Detectify through its API with the credentials you connect on Dashboard → Connections, and Detectify publishes nothing here. The same endpoint carries every other system you connect and Memtro's memory tools.

What does it cost?

Nothing on top of Memtro. One price per organisation by its number of users, from $50 a month for up to 10 users after a 7-day free trial, with every connector, the MCP server, jobs and memory included. You bring your own model keys.

Can it change anything in Detectify?

Only when you ask, and only what it has been granted: start an Application Scan on a scan profile (scans the company's own site); stop a running scan; schedule scans on a scan profile; remove a scan profile's schedule; mark a finding fixed, accepted risk or false positive; clear a finding's fixed, accepted risk or false positive status; add an asset (domain or IP) to the team; delete an asset from the team (permanent); invite people to the Detectify team. Every other tool reads, searches or lists. An administrator grants each acting tool by name per team, and a personal connection acts only after its owner allows it.

Which clients work?

Any MCP client that speaks Streamable HTTP: Claude Code, Cursor, Claude Desktop, OpenCode, Codex, Zed, Windsurf, Cline and the Anthropic and OpenAI SDKs. There is no local process to run; the server is remote and authenticated with your key.

Other MCP servers · Engineering and operations

• GitHub MCP server
• AWS CloudWatch MCP server
• Sentry MCP server
• ServiceNow MCP server
• Okta MCP server
• Twilio MCP server