Skip to main content
ZeroPath hosts an MCP server at https://zeropath.com/mcp. Point your AI tool at that URL, sign in through your browser, and it can talk to your security findings — no install, no API keys to copy around.
Prefer to run the server yourself with API tokens? Use the local MCP server. Both expose the same tools.

​
Connect

A browser window opens the first time so you can sign in and approve access.

​
Then just ask

Once connected, talk to your findings in plain language:
  • “Show me the critical issues in the payments repo.”
  • “Which of last week’s findings are false positives? Archive them.”
  • “Open a pull request with the fix for this SQL injection.”
See the full tool list for everything the assistant can do.

​
What it can and can’t do

Acts as you

A connection sees exactly what you see — your role, your teams, one organization you pick when you sign in. Connect again to add another organization.

Read-only by default

Approval asks separately before an app may change anything (retriage findings, generate patches, open PRs, start scans). Skip it and the connection can only read.

Findings only

These connections reach the security tools only — never org, team, or billing administration, and never authoring new agent automation. Running automation an admin already set up (triggering a schedule, activating a playbook) still works. Use an API token for the rest of the API.

Fully audited

Every tool call, approval, and revocation lands in your organization’s audit log.
App names on the approval screen are self-declared — anyone can register an app using a familiar name. The screen shows where your approval would actually be delivered, including the scheme (https://claude.ai, or cursor://anysphere.cursor-mcp for a native app). Check it’s one you expect before approving.

​
Managing connections

Everything lives under Settings → Integrations: Revoking is instant: the next request from that app fails and the user has to reconnect.

​
Troubleshooting

The connection expired or was revoked. Most tools re-authorize on their own; if yours doesn’t, remove the server and add it again. If it keeps failing, check with an admin that remote MCP is still enabled for your organization.
The connection was approved read-only. Remove the server, add it again, and tick the option allowing changes when approving.
Each connection is tied to one organization. Add the server a second time and pick the other organization when you sign in.
Use your own domain instead — for example https://your-company.zeropath.com/mcp. Everything else is identical.
The server implements the MCP authorization spec: it is an OAuth 2.0 protected resource and ZeroPath is the authorization server.
  • Clients are public (no client secret); PKCE with S256 is mandatory.
  • Scopes are mcp:read and mcp:write; access tokens last one hour and refresh tokens are single-use, so replaying a rotated one revokes the whole connection.
  • Access tokens work only against the MCP tool surface, not the wider REST API.
  • Transport is Streamable HTTP in stateless mode: POST /mcp with a bearer token returns application/json. GET /mcp returns 405 — no server-initiated streams. Protocol versions 2025-06-18 and 2025-03-26 are supported.