Developer API and MCP

Panoptic Scans provides a REST API and a Model Context Protocol (MCP) server for programmatic access to scans, results, targets, webhooks, and more. Both use the same API key and bearer token. MCP is included on every plan.

Authentication

The API and the MCP server use JWT authentication. Create an API key in the app and exchange it at /api/token. The response includes an access_token, a refresh_token, and expires_in in seconds. Send Authorization: Bearer <token> on each request. When a request returns 401 with error="invalid_token", call /api/token again with grant_type=refresh_token. Agents can follow /auth.md.

Base URL

Production base URL: https://panopticscans.com/api

Capabilities

The API and MCP tools let you manage scans (create, list, update, delete, rerun), view and triage vulnerabilities, manage targets, manage webhooks, and download reports.

MCP

The MCP server is Streamable HTTP at https://panopticscans.com/mcp. Clients discover it from the server card. Send Accept: application/json, text/event-stream and the bearer token. The initialize response sets Mcp-Session-Id; send that header on later requests.

OAuth clients, including Cursor, register at /oauth/register and sign in at /oauth/authorize. The account holder signs in and chooses Allow. The client stores the refresh token and exchanges it when the access token expires. That sign-in creates an API key for the client. Deleting the key in Settings revokes it.

A 401 from the REST API or from /mcp includes WWW-Authenticate. error="invalid_token" means the access token is expired or malformed. error="insufficient_scope" means the token is valid and refreshing it will not help.

Tools cover scans, reports, vulnerabilities, targets, and webhooks. Read-only tools set readOnlyHint. Deletes and vulnerability status changes set destructiveHint. Status values are Unresolved, Resolved, Accepted, and False Positive. The review-findings prompt summarizes what to fix first. Tool calls use the same plan limits as the REST API.

After a trial ends, or after a plan is cancelled, the account cannot create scans, rerun scans, or exchange an API key or refresh token. Those token requests return 402 with error set to payment_required. Creating or rerunning a scan returns 402 as well. /mcp allows 60 requests a minute per account. create_scan, rerun_scan, and test_webhook allow 5 a minute. Over the limit, the response is 429 with a Retry-After header.

Documentation and specification

• Interactive docs - /api (the API developer portal with links to the interactive reference).
• OpenAPI spec - /openapi.yaml
• MCP server card - /.well-known/mcp/server-card.json
• Agent authentication - /auth.md

Quick example: authentication with curl

Obtain a token with your API key, then call a protected endpoint:

curl -X POST "https://panopticscans.com/api/token?key=YOUR_API_KEY"

curl "https://panopticscans.com/api/scans" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Replace YOUR_API_KEY with your API key from Settings → API Keys, and YOUR_ACCESS_TOKEN with the access_token from the login response.

Webhooks

For outbound events when scans finish or fail, configure webhooks under Settings → Webhooks. See also Webhooks in this documentation for behavior, signing, and testing.