MCP Server and Skills

The NightVision MCP server lets AI coding agents - Claude Code, Codex, Cursor, Claude for Desktop, and other Model Context Protocol clients - drive your NightVision workflow directly from a chat: create targets, discover APIs from source code, launch scans, and read results, without leaving the editor.

It runs locally over stdio and wraps the NightVision CLI and API, so it acts with your own NightVision credentials and your own filesystem permissions. Because it runs on your machine, it can reach localhost, private networks, and internal staging environments that a hosted scanner cannot.

Claude Code and Codex install it as a plugin, which also brings the NightVision skills: workflow guides the agent loads on demand so it uses the tools the way NightVision expects.

What you can do

The server provides 50 tools covering the full scanning loop:

Area	Tools
Setup and authentication	authenticate, doctor, auth-status, login-help
Guided app scan	preflight-app, run-app-security-scan, list-managed-scan-processes, get-managed-scan-process, cancel-managed-scan-process
Projects and targets	list-projects, get-project-details, list-targets, get-target-details, create-target, delete-target, find-target, list-additional-paths, add-additional-paths
Scans	start-scan, list-scans, get-scan-status, wait-for-scan, get-scan-checks, get-scan-paths, list-check-categories, summarize-scan-findings
Findings	list-issues, get-issue-details, get-issue-kind-stats, get-issue-occurrences, get-vulnerable-paths
Exports	export-sarif, export-csv, export-report
Target app credentials	save-playwright-script, update-playwright-script, create-header-credential, create-cookie-credential, assign-credential-to-targets, get-auth-credential, list-auth-credentials
Source Intelligence	run-source-intelligence (and discover-api, its former name)
Nuclei templates	list-nuclei-templates, create-nuclei-template, upload-nuclei-template, assign-nuclei-template
HTTP traffic	record-traffic, list-traffic, download-traffic

Findings come back with full HTTP request and response detail, with secrets redacted, so the agent can validate an issue rather than restate a severity label.

Skills

The plugin ships six skills. The agent loads one when the conversation matches it; you do not have to invoke them by name.

Skill	Covers
source-intelligence	Extracting an OpenAPI spec from source with nightvision openapi extract: framework support, unresolved variables, spec comparison, and Code Traceback. Its former name, api-discovery, still loads it
scan-configuration	Everything before a scan: targets, authentication (Playwright scripts, headers, cookies), traffic recordings, projects, scope control, private network scans
app-security-scan	The guided DAST run for a local, private, staging, or internal app you just built or changed
scan-triage	Reading SARIF and CSV findings, locating the vulnerable code, validating with curl, prioritizing by severity, and suggesting remediations
scan-report	A shareable PDF security report for one scan, a scan compared with the previous one, or a whole project: an executive summary plus a findings appendix
ci-cd-integration	Adding NightVision to GitHub Actions, GitLab CI, Azure DevOps, Jenkins, BitBucket, or JFrog pipelines, including token setup and SARIF or CSV export

Prerequisites

• Node.js 22 or later
• NightVision CLI 0.18.0 or later, installed and on your PATH. See Installing the CLI. The server checks the CLI at startup and logs a warning if it is older than the supported minimum.
• A NightVision account and a token. Run nightvision login once (see Creating a NightVision Token for token options).

Install

Claude Code

Install the plugin, which carries the server and the skills:

claude plugin marketplace add https://github.com/nvsecurity/nightvision-mcp
claude plugin install nightvision@nightvision

Restart Claude Code so the server starts, then verify with claude mcp list and claude plugin list.

Codex

Install the plugin, which carries the server and the skills:

codex plugin marketplace add https://github.com/nvsecurity/nightvision-mcp
codex plugin add nightvision@nightvision

Restart Codex, then verify with codex mcp list.

Cursor

Cursor has no plugin installer, so build the server from source:

git clone https://github.com/nvsecurity/nightvision-mcp.git
cd nightvision-mcp
npm install
npm run build

This produces build/index.js. Add the server to .cursor/mcp.json in your project (or ~/.cursor/mcp.json to use it everywhere), pointing at the absolute path:

{
  "mcpServers": {
    "nightvision": {
      "command": "node",
      "args": ["/absolute/path/to/nightvision-mcp/build/index.js"]
    }
  }
}

Reload the window so Cursor picks up the server. You get the 50 tools; the skills are packaged for Claude Code and Codex only.

Claude for Desktop

Claude for Desktop has no plugin installer, so build the server from source:

git clone https://github.com/nvsecurity/nightvision-mcp.git
cd nightvision-mcp
npm install
npm run build

Then edit your configuration file:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "nightvision": {
      "command": "node",
      "args": ["/absolute/path/to/nightvision-mcp/build/index.js"],
      "env": {
        "NIGHTVISION_CLI_PATH": "/absolute/path/to/nightvision"
      }
    }
  }
}

Restart Claude for Desktop. You get the 50 tools; the skills are packaged for Claude Code and Codex only.

Use absolute paths in a manual install

Point args at the absolute path to build/index.js. If your client reports spawn node ENOENT, node is not on the launcher’s PATH; use the absolute path to your Node binary as command (find it with which node). Desktop clients launched outside a login shell often cannot find the nightvision CLI either, which is what NIGHTVISION_CLI_PATH is for.

Authentication

The server reuses the credential established by nightvision login, which is stored at ~/.nightvision/token. When that token is present, the server picks it up automatically, and no separate configuration is needed. If the token is missing or expired, run nightvision login again, or use the authenticate tool to supply or create a token.

To check where you stand, ask the agent to run doctor (CLI availability, CLI version, token presence, optional token validation) or auth-status (whether this server process has usable authentication right now).

Environment variables

Set these in your MCP client’s server config, in the env block.

Variable	Purpose
NIGHTVISION_CLI_PATH	Absolute path to the nightvision CLI. Optional when the CLI is on PATH; recommended for desktop clients launched outside a login shell.
NIGHTVISION_DEFAULT_PROJECT	Default NightVision project for the guided scan when no project is passed.
NIGHTVISION_CREDS_ID	Default target app credential UUID applied by run-app-security-scan when the caller passes no credential. Leave unset to scan unauthenticated by default.
NIGHTVISION_API_URL	Overrides the API base URL (default https://api.nightvision.net/api/v1/). It redirects all API traffic, including where your token is sent, so point it only at a NightVision endpoint you trust.

Guided app security scan

For a local, private, staging, or internal app, use the guided harness instead of asking the agent to pick every primitive itself. Ask in plain language:

Run a NightVision app security scan for this local API at http://127.0.0.1:8080.

run-app-security-scan inspects the repository, runs Source Intelligence when the backend language is supported, creates or reuses a target, starts the DAST scan, and writes .nightvision/manifest.json with the scan ID and any blockers. When you do not pass a target name, it derives a stable one of the form <app>-local-<your OS username> so repeated runs reuse the same target.

To check readiness without creating a target or starting a scan:

Check whether this app is ready for a NightVision scan, but do not create targets or start DAST yet.

preflight-app writes its findings to .nightvision/manifest.json, creating the .nightvision directory when needed and replacing any existing manifest.

A few behaviors worth knowing:

• The scan keeps running after the tool returns. The harness returns the scan ID rather than blocking, so poll with get-scan-status, list-scans, or wait-for-scan. For local and private apps, leave the MCP server running: the NightVision CLI process it manages is the relay that reaches your app. Inspect or clean up those processes with list-managed-scan-processes and cancel-managed-scan-process.
• A terminal FAILED status can still carry real findings. Check the issue count and export before treating a run as unusable. export-sarif and export-csv refuse to write a misleading empty file for a scan that has not finished.
• Target app login uses Playwright script authentication. Username and password flows, browser login, OAuth, MFA, and any expiring session go through save-playwright-script or the harness’s own auth planning. Header and cookie credentials are accepted only for stable, non expiring credentials such as a durable service API key; this path blocks the alternatives rather than letting a scan quietly run logged out.
• Findings from an API scan informed by Source Intelligence carry Code Traceback, so a vulnerability points back to the file and line that produced the endpoint.

Try it out

After connecting, start a chat and ask the agent to use NightVision. For example:

• “List my NightVision targets.”
• “Discover the API in this repository and save the OpenAPI spec as a JSON file.”
• “Start a scan of my staging-api target and tell me when it finishes.”
• “Show the high and critical vulnerabilities from the latest scan of staging-api.”
• “Summarize the findings from that scan and show me the request and response for the top one.”

The agent picks the right tools, runs them with your credentials, and reports the results inline.

Keeping it up to date

Plugin install

# Claude Code
claude plugin marketplace update nightvision
claude plugin update nightvision

# Codex
codex plugin marketplace upgrade
codex plugin add nightvision@nightvision

Restart the agent afterwards so it reloads the server.

Manual install

cd nightvision-mcp
git pull
npm install
npm run rebuild

Then restart your MCP client so it reloads the server.

Your saved token keeps working, so no re-authentication or config change is needed. Because the server drives the nightvision CLI it finds on your PATH, keep the CLI reasonably current (0.18.0 or later) as well.