Model Context Protocol (MCP)¶

Overview¶

The Escape platform supports the Model Context Protocol (MCP), enabling seamless integration between AI assistants and Escape's security platform. MCP provides standardized access to application management, security scanning, and vulnerability analysis directly from your development environment or AI interface.

What is the Model Context Protocol?¶

The Model Context Protocol (MCP) is an open standard developed by Anthropic to facilitate seamless integration between large language models (LLMs) and external tools, services, and data sources. Often likened to the "USB-C of AI applications," MCP provides a universal interface that allows AI systems to interact with various resources in a standardized manner.

MCP enables AI assistants to:

• Access real-time data from external systems
• Execute operations through standardized APIs
• Provide context-aware responses based on your specific data
• Automate complex workflows across multiple services

Escape MCP Server¶

The Escape MCP server is hosted at https://mcp.escape.tech/mcp and provides authenticated access to the Escape platform through the Public API.

Two authentication flows are supported, both backed by the same User.apiKey. Pick the one that matches your client:

• OAuth 2.1 (recommended for AI assistants and IDEs) — your client opens a browser, you click Allow on a consent page hosted on app.escape.tech, and the client receives a bearer token transparently. Spec-compliant with the MCP 2025-06-18 Authorization spec and RFC 9728 Protected Resource Metadata. No copy-pasting of API keys.
• Authorization: Key <api-key> (for CLI, CI, scripts, custom integrations) — pass your API key as a static HTTP header. Same path used since day one of the MCP server; unchanged for backward compatibility.

Key Features:

• Application Management: Create, update, and manage security scan profiles
• Scan Operations: Initiate scans, monitor status, and retrieve results
• Domain Management: Manage monitored domains and FQDNs
• Vulnerability Analysis: Access detailed security findings and recommendations
• Archive Access: Retrieve scan exchange archives for deep analysis

Authentication flows¶

{
  "mcpServers": {
    "escape": {
      "type": "http",
      "url": "https://mcp.escape.tech/mcp"
    }
  }
}

Authorization: Key <your-api-key>

X-ESCAPE-API-KEY: <your-api-key>

{
  "mcpServers": {
    "escape": {
      "type": "http",
      "url": "https://mcp.escape.tech/mcp",
      "headers": {
        "Authorization": "Key <your-api-key>"
      }
    }
  }
}

Use Cases¶

IDE Integration¶

Integrate the Escape MCP server directly into your development environment to access security capabilities alongside your coding workflow.

Supported IDEs:

• Visual Studio Code
• Cursor
• Any MCP-compatible editor

Capabilities:

• Query application security status without leaving your IDE
• Initiate security scans from your editor
• Review vulnerability findings in context
• Manage scan configurations programmatically

Learn how to configure IDE integration →

Escape Copilot¶

Interact with the Escape platform through natural language using the Escape Copilot, an AI assistant specialized in cybersecurity workflows.

Capabilities:

• Natural language application management
• Conversational scan initiation and monitoring
• Intelligent vulnerability analysis and recommendations
• Automated security workflow orchestration

Explore Escape Copilot capabilities →

Getting Started¶

1. Choose your auth flow (see Authentication flows above):
   • OAuth 2.1 if your client is Claude (Desktop / Code / web), Cursor, ChatGPT, Continue.dev, Zed, Windsurf, Codeium, or any other MCP-2025-06-18-compliant client.
   • Authorization: Key if you're scripting against MCP from CI, a custom integration, or any headless context.
2. Generate an API key (only required for the legacy header flow — OAuth handles this for you): User Settings → API Key.
3. Configure your client:
   • For IDE integration, follow the IDE Integration Guide.
   • For Copilot access, explore Escape Copilot.
4. Start using MCP — your client will discover the available tools automatically.

Security Considerations¶

• API key protection: The API key inherits your full Escape account permissions. Store it in a secrets manager and never commit it to version control. The OAuth flow avoids this risk entirely — no API key ever leaves the dashboard.
• OAuth scope: The hosted MCP server publishes a single scope (mcp) covering full Public API access. There is no per-tool scoping today.
• Scoped access: API keys inherit your user permissions. Ensure your account has only the necessary access level.
• Key rotation as panic button: Rotating the API key from the dashboard immediately invalidates every cached bearer token (OAuth and legacy alike). On the next call, OAuth clients will redo the consent flow with the new key.
• Network security: All MCP communication (and the OAuth handshake) is HTTPS-only. Loopback (http://127.0.0.1, http://localhost, http://[::1]) is permitted only for the OAuth callback step, which is what local MCP clients need for their redirect_uri.

Technical Details¶

Related Documentation¶

• Public API Documentation
• Application Management
• Business Logic Aware DAST Scanning
• Model Context Protocol Specification

Support¶

For questions or issues with MCP integration:

• Review the IDE Integration Guide for configuration troubleshooting
• Consult the Public API documentation for API-level details
• Contact Escape support for assistance with authentication or connectivity issues