MCP Server

The NightVision MCP server lets AI coding agents - Claude Code, Cursor, Claude for Desktop, and other Model Context Protocol clients - drive your NightVision DAST workflow directly from a chat: create targets, discover APIs from source code, launch scans, and read results, without leaving the editor.

It runs locally over stdio and wraps the NightVision CLI and API, so it acts with your own NightVision credentials and your own filesystem permissions.

What you can do

Once connected, the agent has tools for the full scanning loop:

• Authentication - check status, supply a token, or create one
• Projects - list projects and read their details
• Targets - list, inspect, create, and delete targets
• Scans - start scans, check status, and list scans (filter by target, project, or status)
• Scan results - read vulnerability checks and the checked paths for a scan
• API discovery - extract an OpenAPI spec from source code (multi-language, including PHP), optionally without creating a target
• HTTP traffic - record, list, and download captured traffic
• Nuclei templates - create, list, upload, and assign custom templates

Prerequisites

• Node.js 22 or later
• NightVision CLI 0.5.0 or later, installed and on your PATH. See Installing the CLI. The server checks the CLI at startup and logs a warning if it is older than the supported minimum.
• A NightVision account and a token. Run nightvision login once (see Creating a NightVision Token for token options).

Installation

Clone and build the server:

git clone https://github.com/nvsecurity/nightvision-mcp.git
cd nightvision-mcp
npm install
npm run build

This produces build/index.js, the entry point you point your MCP client at. Note its absolute path - you will need it below.

Connect your MCP client

The server is launched as a local command (node build/index.js). Use the absolute path to the build/index.js you just built.

Claude Code

Register the server from the terminal:

claude mcp add nightvision -- node /absolute/path/to/nightvision-mcp/build/index.js

Then start a new session (or run /mcp to reconnect) so the tools load. Verify with claude mcp list.

Cursor

Add the server to .cursor/mcp.json in your project (or ~/.cursor/mcp.json to use it everywhere):

{
  "mcpServers": {
    "nightvision": {
      "command": "node",
      "args": ["/absolute/path/to/nightvision-mcp/build/index.js"]
    }
  }
}

Reload the window so Cursor picks up the server.

Claude for Desktop

Edit your configuration file:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "nightvision": {
      "command": "node",
      "args": ["/absolute/path/to/nightvision-mcp/build/index.js"]
    }
  }
}

Restart Claude for Desktop.

Use an absolute path

Point args at the absolute path to build/index.js. If your client reports spawn node ENOENT, node is not on the launcher’s PATH; use the absolute path to your Node binary as command (find it with which node).

Authentication

The server reuses the credential established by nightvision login, which is stored at ~/.nightvision/token. When that token is present, the server picks it up automatically - no separate configuration is needed. If the token is missing or expired, run nightvision login again, or use the authenticate tool to supply or create a token.

Try it out

After connecting, start a chat and ask the agent to use NightVision. For example:

• “List my NightVision targets.”
• “Discover the API in this repository and save the OpenAPI spec as a JSON file.”
• “Start a scan of my staging-api target and tell me when it finishes.”
• “Show the high and critical vulnerabilities from the latest scan of staging-api.”

The agent picks the right tools, runs them with your credentials, and reports the results inline.

Keeping it up to date

To upgrade an existing install:

cd nightvision-mcp
git pull
npm install
npm run rebuild

Then restart your MCP client so it reloads the server. Your saved token keeps working, so no re-authentication or config change is needed. Because the server drives the nightvision CLI it finds on your PATH, keep the CLI reasonably current (0.5.0 or later) as well.