# Ostorlab MCP server

Source: https://glimind.com/server/mcp-registry%2Fco.ostorlab%2Fmcp
Registry id: `mcp-registry/co.ostorlab/mcp`
Status: live (checked 2026-10-26T23:40:52.629Z)

## Measurements (30 days)

- Uptime: 100%
- Checks: 89
- Outages (90 days): 0

## Install

```json
{
  "mcpServers": {
    "ostorlab-mcp-server": {
      "type": "http",
      "url": "https://api.ostorlab.co/apis/mcp/{api_key}/"
    }
  }
}
```

Claude Code:

```sh
claude mcp add --transport http ostorlab-mcp-server https://api.ostorlab.co/apis/mcp/{api_key}/
```

## Tools (268)

- `accept_autodiscovery_asset`: Accept a single attack-surface discovery candidate into the inventory. Reach for this to promote a reviewed candidate from the discovery queue into the inventor
- `acknowledge_alerts`: Mark many production alerts as seen in one call. Takes the ids of the alerts to acknowledge and returns each id's outcome. Acknowledging is not resolving: it re
- `add_tag`: Create a tag in this organisation. A tag is identified by the ``(name, value)`` pair, so the same name may exist several times with different values — ``env=pro
- `add_user`: Invite a person to join this organisation at a given role. The email address must come from the person operating this tool. You have usually been reading scan o
- `ai_remediation_add_agent_mcp_server`: Give an AI remediation agent an MCP server through the organisation's connection to it, when the agent does not have it yet. Args: agent_id: Id of the agent. ki
- `ai_remediation_add_agent_skill`: Give an AI remediation agent a skill, when it does not have it yet. Args: agent_id: Id of the agent. kind: Kind of the skill. skill_id: Id of an enabled skill o
- `ai_remediation_connect_mcp_server`: Connect an MCP server to the organisation, with a value for each name the server needs. Args: kind: Kind of the MCP server. mcp_server_id: Id of an enabled MCP 
- `ai_remediation_create_agent`: Create an AI remediation agent: its job, the role of its runs and the model key it runs on, or that it is prepaid. Args: name: Name shown in the product. system
- `ai_remediation_create_github_skill`: Create a skill from a folder of a GitHub repository. Args: name: Name of the skill, unique in the organisation: lowercase letters and digits, with single hyphen
- `ai_remediation_create_memory`: Create a memory: a folder of a GitHub repository where agents keep what they learn. Args: name: Name of the memory, unique in the organisation. repo_url: HTTPS 
- `ai_remediation_create_remote_mcp_server`: Create an MCP server that agents reach over HTTPS. Args: name: Name of the server, shown in the product and used as its key in the agent's configuration. Unique
- `ai_remediation_create_scan_rule`: Create a rule that runs an AI remediation agent when a scan is done and all its conditions match the scan. Args: agent_id: Id of the agent the rule runs. name: 
- `ai_remediation_create_schedule_rule`: Create a rule that runs an AI remediation agent on a cron schedule, always on the same ticket. Args: agent_id: Id of the agent the rule runs. name: Name of the 
- `ai_remediation_create_stdio_mcp_server`: Create an MCP server that agents start as a local command inside the run's container. Args: name: Name of the server, shown in the product and used as its key i
- `ai_remediation_create_ticket_rule`: Create a rule that runs an AI remediation agent on a ticket when one of its events happens and all its conditions match the ticket. Args: agent_id: Id of the ag
- `ai_remediation_create_uploaded_skill`: Create a skill from an uploaded zip archive with SKILL.md at its root. Args: name: Name of the skill, unique in the organisation: lowercase letters and digits, 
- `ai_remediation_create_written_skill`: Create a skill from text, without a GitHub repository or an uploaded archive. Args: name: Name of the skill, unique in the organisation: lowercase letters and d
- `ai_remediation_delete_agent`: Delete an AI remediation agent, with its skill and MCP server picks, its rules and its avatar. Args: agent_id: Id of the agent. Returns: The id of the deleted a
- `ai_remediation_delete_mcp_server`: Delete an MCP server of the organisation, with its connections, their credential values and every agent's pick of them. Args: kind: Kind of the MCP server. mcp_
- `ai_remediation_delete_memory`: Delete a memory, leaving the agents that used it with no memory. Args: memory_id: Id of the memory. Returns: The id of the deleted memory, or an error payload. 
- `ai_remediation_delete_scan_rule`: Delete a scan rule of an AI remediation agent. Args: rule_id: Id of the scan rule. Returns: The id of the deleted rule, or an error payload. 
- `ai_remediation_delete_schedule_rule`: Delete a schedule rule of an AI remediation agent. Its ticket stays, with the work of past runs. Args: rule_id: Id of the schedule rule. Returns: The id of the 
- `ai_remediation_delete_skill`: Delete a skill, removing it from the agents that picked it. Args: kind: Kind of the skill. skill_id: Id of the skill. Returns: The id of the deleted skill, or a
- `ai_remediation_delete_ticket_rule`: Delete a ticket rule of an AI remediation agent. Args: rule_id: Id of the ticket rule. Returns: The id of the deleted rule, or an error payload. 
- `ai_remediation_disable_mcp_server`: Turn an MCP server of the organisation off, so no agent calls it, without changing its connections or the agents that picked it. Args: kind: Kind of the MCP ser
- `ai_remediation_disable_memory`: Turn a memory off, so no agent uses it, without changing the agents that point at it. Args: memory_id: Id of the memory. Returns: The memory after the change, o
- `ai_remediation_disable_skill`: Turn a skill off, so no agent loads it, without changing the agents that picked it. Args: kind: Kind of the skill. skill_id: Id of the skill. Returns: The skill
- `ai_remediation_disconnect_mcp_server`: Disconnect an MCP server from the organisation, deleting its credential values and every agent's pick of it. Args: kind: Kind of the connected MCP server. conne
- `ai_remediation_enable_mcp_server`: Turn an MCP server of the organisation on, so agents can pick it and call it. Args: kind: Kind of the MCP server. An organisation only has remote and stdio serv
- `ai_remediation_enable_memory`: Turn a memory on, checking again that the organisation's GitHub App can push to its repository. Args: memory_id: Id of the memory. Returns: The memory after the
- `ai_remediation_enable_skill`: Turn a skill on, checking again that a GitHub skill's repository can be read. Args: kind: Kind of the skill. skill_id: Id of the skill. Returns: The skill after
- `ai_remediation_get_agent`: Get one AI remediation agent of the organisation, with its skills, MCP servers and rules. Args: agent_id: Id of the agent. Returns: The agent, or an error paylo
- `ai_remediation_list_agents`: List the organisation's AI remediation agents, with their skills, MCP servers and rules. Returns: The agents, ordered by name, or an error payload. 
- `ai_remediation_list_mcp_server_connections`: List the organisation's connections of every kind to the MCP servers it sees, without their credential values. Returns: The connections, ordered by the name of 
- `ai_remediation_list_mcp_servers`: List the organisation's MCP servers of every kind, enabled or not, and the enabled catalogue MCP servers. An oxo server's `argument_details` give the type, desc
- `ai_remediation_list_memories`: List the organisation's memories, enabled or not: folders of GitHub repositories where agents keep what they learn. Returns: The memories, ordered by name, or a
- `ai_remediation_list_skills`: List the organisation's skills, enabled or not, and the enabled catalogue skills. Returns: The skills, ordered by name, or an error payload. 
- `ai_remediation_remove_agent_mcp_server`: Take an MCP server away from an AI remediation agent, when the agent has it through this connection. Args: agent_id: Id of the agent. kind: Kind of the connecte
- `ai_remediation_remove_agent_skill`: Take a skill away from an AI remediation agent, when the agent has it. Args: agent_id: Id of the agent. kind: Kind of the skill. skill_id: Id of the skill. Retu
- `ai_remediation_replace_agent`: Replace the fields of an AI remediation agent, keeping its id, skills, MCP servers, rules and avatar. Args: agent_id: Id of the agent. name: Name shown in the p
- `ai_remediation_replace_github_skill`: Replace the name, the description and the repository folder of a GitHub skill, keeping its id, the agents that picked it and whether it is enabled. Args: skill_
- `ai_remediation_replace_mcp_server_credentials`: Replace every credential value of one of the organisation's MCP server connections. Args: kind: Kind of the connected MCP server. connection_id: Id of the conne
- `ai_remediation_replace_memory`: Replace a memory, keeping its id, the agents that point at it and whether it is enabled. Args: memory_id: Id of the memory. name: Name of the memory, unique in 
- `ai_remediation_replace_uploaded_skill`: Replace the name, the description and the zip archive of an uploaded skill, keeping its id, the agents that picked it and whether it is enabled. Args: skill_id:
- `ai_remediation_replace_written_skill`: Replace the name, the description and the text of a written skill, keeping its id, the agents that picked it and whether it is enabled. Args: skill_id: Id of th
- `assign_potential_node_owner`: Assign existing attack-surface discovery candidates to an owner. Reach for this during triage to change which owner reviewed candidates belong to — nothing else
- `compute_potential_assets`: Recompute the organisation's attack-surface discovery candidates now. Forces the discovery pipeline to re-derive the candidate assets it suggests from what the 
- `configure_jira_integration`: Set up or update the Jira integration for the caller's organisation. Reach for this tool to wire up Jira ticket push end to end — workspace URL, credentials, an
- `configure_linear_integration`: Set up or update the Linear integration for the caller's organisation. Reach for this to wire up Linear ticket push end to end — the API key, the team issues ar
- `configure_saml`: Create the SAML single sign-on configuration for this organisation. This wires the organisation to an identity provider for SSO. It is a strict create: when a c
- `configure_servicenow_integration`: Set up or update the ServiceNow connection of the caller's organisation. Reach for this to wire up ServiceNow ticket push — the instance URL and the credentials
- `configure_servicenow_sync_config`: Create or update a ServiceNow table sync configuration and its field mapping. Reach for this when tickets must land in a different ServiceNow table, or when a p
- `configure_slack_integration`: Add a Slack notification webhook for the caller's organisation. Reach for this tool to wire up scan-done notifications end to end — a Slack incoming-webhook URL
- `count_tickets`: Count remediation tickets for the authenticated organisation. Use this to answer "how many tickets ..." questions (for example how many open p0 tickets are assi
- `create_app_center_integration`: Connect an App Center app so its mobile builds are scanned automatically. Every build App Center reports for ``owner_name``/``app_name`` is pulled and scanned. 
- `create_appcircle_integration`: Connect Appcircle (appcircle.io) so its successful builds are scanned. The result carries ``webhook_url`` and ``webhook_secret``: the caller must add a webhook 
- `create_asset`: Register a single attack-surface asset in the authenticated organisation's inventory. Reach for this tool when you have discovered a concrete asset — a domain, 
- `create_asset_location`: Create an asset location for the authenticated organisation. Reach for this to register a new site/region the organisation can group attack-surface assets under
- `create_attack_surface_agent_config`: Create the organisation's attack surface agent configuration. Reach for this to set, for the first time, the prompt that steers what the attack-surface discover
- `create_autodiscovery_scan`: Create (launch) an autodiscovery scan over the organisation's discovery set. Reach for this to **scan what autodiscovery surfaced** — the assets accepted into t
- `create_automation_rule`: Create an automation rule that runs one action when findings match a condition. Reach for this tool to wire up auto-ticketing or notification routing — a condit
- `create_aws_cloud_connector`: Connect an AWS account so its internet-facing resources are imported every twelve hours. Mirrors the 'createAwsCloudConnector' GraphQL mutation. Only the fields
- `create_azure_cloud_connector`: Connect an Azure subscription so its internet-facing resources are imported every twelve hours. Mirrors the 'createAzureCloudConnector' GraphQL mutation. Exactl
- `create_checklist`: Create a new checklist for a ticket. Args: ctx: FastMCP Context holding connection path parameters. title: Title of the checklist. ticket_id: Database ID of the
- `create_checklist_item`: Add a single item to an existing checklist. Args: ctx: FastMCP Context holding connection path parameters. checklist_id: Database ID of the checklist. value: Te
- `create_comment`: Add a new comment to a ticket. Args: ctx: FastMCP Context holding connection path parameters. message: Content of the comment to add. ticket_id: Database ID of 
- `create_gcp_cloud_connector`: Connect a Google Cloud project so its internet-facing resources are imported every twelve hours. Mirrors the 'createGcpCloudConnector' GraphQL mutation. Pass on
- `create_git_pat_integration`: Register a Git personal access token so Ostorlab can reach the caller's repositories. Source-code scans and automated pull requests depend on this integration. 
- `create_jira_ticket`: File a Jira issue for an Ostorlab remediation ticket, now. Reach for this to push a finding to the customer's tracker on demand, rather than waiting for the aut
- `create_jira_ticket_map`: Record that an Ostorlab ticket corresponds to a Jira issue that already exists. Reach for this when adopting Ostorlab against a board that is already populated:
- `create_mobile_file_scan`: Create (launch) a scan against a mobile binary the caller has uploaded. Reach for this tool to start a scan of an app **file** — an Android APK or AAB, an iOS I
- `create_mobile_testflight_scan`: Create (launch) a scan against an iOS build distributed through TestFlight. Reach for this tool to start a scan of a pre-release iOS build that is not in the pu
- `create_multi_asset_scan`: Create (launch) one ``Multi Asset Deep Agentic Scan`` over several targets. Reach for this tool to **start** a single scan that spans web, network, repository, 
- `create_org_github_application`: Create a GitHub App with its first verified installation. The private key is write-only and is never included in any response. The installation is enabled only 
- `create_org_github_application_installation`: Add and verify an installation for a configured GitHub App. The new installation is enabled only after GitHub verifies that it belongs to the configured App. Ar
- `create_owner`: Create an owner (the asset object-level-access boundary) in the organisation. Owners are the unit object-level access is granted on for assets, so a new owner m
- `create_rescan`: Re-run an existing scan with the same configuration by database id. The cheapest way to start a scan: pass an existing scan id and a new scan is created with th
- `create_scan`: Create (launch) a scan against a web, network or mobile-store target. Reaches for this tool when the caller wants to **start** a scan, not read one. To follow a
- `create_scanner`: Register a new on-prem scanner so a scan can be pinned to it. This creates the scanner's record and provisions it in the scanning engine (bus connection and API
- `create_scanner_group`: Create a scanner group. A scanner group lets a scan be pinned to any of several scanners rather than one: the scan is picked up by a scanner in the group instea
- `create_schedule_rule`: Create a scheduled-scan (monitoring) rule that fires recurring, billable scans. Reach for this tool to set up the recurring cadence that keeps coverage current 
- `create_servicenow_ticket`: Create a ServiceNow incident from an Ostorlab remediation ticket. Reach for this tool to push a single Ostorlab ticket to ServiceNow on demand — the counterpart
- `create_servicenow_ticket_map`: Record that an Ostorlab ticket maps to a ServiceNow record that already exists. Reach for this when the record is already in ServiceNow and only the link is mis
- `create_shared_access_token`: Create a shared access token that grants read access to a scan. Use this when a scan needs to be shared with someone outside the organisation. Anyone holding th
- `create_source_code_archive_scan`: Create (launch) a source-code scan over an uploaded archive. Reach for this tool to **start** a scan of source code the caller holds as a file rather than in a 
- `create_source_code_scan`: Create (launch) a source-code scan against a git repository. Reach for this tool when the caller wants to **start** a repository scan, not read one. To follow a
- `create_standard_git_integration`: Register a self-hosted Git instance so Ostorlab can reach its repositories. Source-code scans and automated pull requests against the instance depend on this re
- `create_test_credential`: Create a reusable test credential for the authenticated organisation. Reach for this when an authenticated scan needs a credential the organisation does not hol
- `create_ticket`: Create a new remediation ticket for an organisation. Args: title: The title of the ticket (required, non-empty). description: Description of the ticket. Default
- `create_ticket_stream`: Create a new ticket stream for tracking and managing tickets. Args: ctx: FastMCP Context holding connection path parameters. name: The display name of the ticke
- `create_ui_prompts`: Create UI automation rules for this organisation. A UI automation rule is the natural-language steps a scan follows to get through a login or another UI flow — 
- `create_webhook_integration`: Configure where Ostorlab posts event notifications for the organisation. Use 'list_integrations' to see the webhook integrations already configured. Header valu
- `delete_app_center_integration`: Delete an App Center integration by id. An App Center integration is how new mobile builds get pulled from App Center and scanned. Removing it stops new builds 
- `delete_appcircle_integration`: Delete an Appcircle integration by id. Appcircle keeps posting to the webhook URL until the user removes the webhook on the Appcircle side; after the delete tho
- `delete_asset`: Delete a single attack-surface asset by ``(asset_type, asset_id)``. Reach for this to retire a decommissioned asset from the inventory — it stops the asset bein
- `delete_asset_location`: Delete an asset location (site/region) by database id. Reach for this to retire a location once every asset pinned to it has been reassigned or deleted. Do **no
- `delete_attack_surface_agent_config`: Delete the organisation's attack-surface discovery configuration. Reach for this to permanently remove the prompt that steers attack-surface discovery for the a
- `delete_automation_rule`: Delete an automation rule by database id. Reach for this only when the rule should be gone for good. To temporarily switch a rule off — keeping it around to re-
- `delete_aws_cloud_connector`: Delete one AWS cloud connector so its AWS account or AWS Organization is no longer synced. Mirrors the 'deleteAwsCloudConnector' GraphQL mutation. The connector
- `delete_azure_cloud_connector`: Delete one Azure cloud connector so its Azure subscription or management group is no longer synced. Mirrors the 'deleteAzureCloudConnector' GraphQL mutation. Th

Measured by Glimind (https://glimind.com): MCP handshake + tool list only, no tool is ever called. CC BY 4.0.