Use case · MCP server

Triage security findings from your AI assistant

Every OpenRouting finding already carries a verdict, an explanation and a suggested fix. Connect the MCP server to Claude, ChatGPT or Claude Code and work through them in the chat where you're writing the fix, instead of switching to a dashboard tab.

triage from your assistant
✓ find search_findings · free
✓ read get_finding · verdict, fix, history
✓ decide update_finding_status · free
✓ re-scan start_repository_scan · 20 credits
you approve write access; revoke any time
$

In short: OpenRouting is a remote MCP server at https://openrouting.si/mcp. After you sign in and approve access, your assistant can search findings, read one with its AI verdict and fix, mark it false positive, accepted risk or fixed, and start a re-scan you approve. Reads are free; scans cost the usual credits.

Findings sit in one tab, the fix in another

Triage is mostly reading: which findings are open, is this one real, what does the fix look like, has someone already looked at it. If you're fixing code with an AI assistant, that reading happens in a different window from the one you're working in, and the context gets copied across by hand.

Over MCP, the assistant reads the finding itself, including the flagged lines and the verdict Claude, via Amazon Bedrock, wrote during the scan. You decide what happens next, and the decision is saved back to OpenRouting where the rest of your team sees it.

How it works: the MCP tools

Add the server, sign in with your OpenRouting account and approve read and, optionally, write access on the consent screen. Then ask in plain language; the assistant picks the tool. Read tools:

get_workspace: Show your workspace and credit balance. Free.
list_repositories: List connected repositories with their latest scan. Free.
list_targets: List website targets for passive scanning. Free.
list_api_suites: List imported API suites. Free.
search_findings: Search one repository's, website's or API suite's findings by severity, status or scanner. Free.
get_finding: Read one finding with its AI verdict, explanation, suggested fix and triage history. Free.
list_scans: List recent scans for a repository, target or suite. Free.
get_scan: Read one scan's status and summary. Free.

Write tools, which you can leave off

Write access is ticked on the consent screen and you can untick it; the assistant can then only read. Each write tool's description states its cost, so the assistant should ask you before it uses one.

start_repository_scan: Start a full scan of a connected repository. The assistant should ask you first. Credits: 20 (up to 30 with agent review).
start_website_scan: Start a passive scan of a website target. The assistant should ask you first. Credits: 10.
update_finding_status: Reopen a finding, or ask to mark it false positive, accepted risk or fixed, with an optional note. Hiding it waits for your confirmation in the dashboard. Free.

An example session

A developer checks the open high-severity findings, asks about one, and records a decision, without leaving Claude Code.

$ claude mcp add --transport http openrouting https://openrouting.si/mcp
> What's still open and high in Vulnerable-Flask-App?
⏺ openrouting · search_findings  severity=[high] status=[open]
8 open · CWE-89 app/app.py:265 · CWE-250 Dockerfile:15 · +6 more
> Is the Dockerfile one real?
⏺ openrouting · get_finding  verdict · explanation · fix · history
Real issue: there is no USER line, so the container runs as root.
Fix: create a non-root user and add USER app before CMD.
> That image is only for local dev. Mark it accepted risk, note why.
⏺ openrouting · update_finding_status  accepted_risk · note: local dev image only
Not changed yet: confirm accepted_risk at the dashboard link within 24 hours.

Illustrative session. The install line and tool names are real, and the findings come from a real scan of we45/Vulnerable-Flask-App; the replies and the decision are an example.

Safeguards

Connecting an assistant to security data is itself a security decision. These are the controls, the same ones listed on the security page:

OAuth 2.1 with PKCE and your existing account. The consent screen names the app, the workspace it will see and the host you'll be sent back to. ChatGPT and Claude connect this way.
Tools that only send a header (Cursor, VS Code, Gemini CLI and others) use a per-user API key: stored as a hash; until you first reveal it, it is also kept encrypted so it can be shown once. A new key is read-only until you allow writes, and it can be given an expiry or an IP allowlist, disabled or regenerated. Prefer sign-in where your tool supports it.
Two scopes: read and write. Without write, the assistant cannot start scans or change a status.
The workspace comes from the token, never from a tool argument, so the assistant cannot ask for another workspace's data.
Text from scanned code, websites, API files or model output arrives labelled untrusted_*, with invisible characters stripped and known key and token formats and secret-named values redacted.
Each key or connection is limited to 60 tool calls a minute and 10 write calls an hour.
Disable or regenerate your API key, or revoke a connection, in Dashboard → AI assistants (MCP). Access stops immediately.
The assistant cannot open pull requests, edit your repositories or see your GitHub token.

Set it up

Connect a repository, website or API suite in the dashboard first, so the assistant has findings to read. Then, in your client:

ChatGPT

In ChatGPT's settings, turn on Developer mode.
Add a custom MCP server (connector) with https://openrouting.si/mcp as the server URL and OAuth as the authentication.
Sign in to OpenRouting, review the consent screen and approve read, and optionally write, access.

Developer mode is available on eligible ChatGPT plans only, and ChatGPT's menu names change from time to time.

Claude

Open Customize (or Settings) → Connectors and choose Add custom connector.
Enter https://openrouting.si/mcp as the server URL.
Sign in to OpenRouting, review the consent screen and approve read, and optionally write, access.

Works in Claude on the web and desktop. Custom connectors depend on your Claude plan.

Claude Code

Run: claude mcp add --transport http openrouting https://openrouting.si/mcp
In Claude Code, run /mcp and choose openrouting to sign in.
Approve read, and optionally write, access on the consent screen.

Claude Code opens your browser for the sign-in.

Get started free

Common questions

Which assistants can connect?

Claude (web and desktop) as a custom connector, ChatGPT with Developer mode on eligible plans, and Claude Code with one command: claude mcp add --transport http openrouting https://openrouting.si/mcp. Custom connectors in Claude depend on your plan too.

Is OpenRouting listed in the Claude or ChatGPT connector directory?

No. You add it as a custom connector by URL: https://openrouting.si/mcp.

What does it cost?

Connecting is free, and so are every read tool and update_finding_status. A repository scan the assistant starts costs 20 credits (up to 30 with the agent-setup review) and a passive website scan 10, the same as in the dashboard, and failed scans are refunded.

Can the assistant dismiss findings on its own?

No. It needs write access (an API key is read-only until you allow writes), and marking a finding false positive, accepted risk or fixed only creates a request: nothing changes until you confirm it on a dashboard link, signed in, within 24 hours. Each change is recorded in the finding's history under your account with the app's name, and you can reopen the finding at any time. A finding marked false positive or accepted risk stays that way on later scans unless the issue gets worse.

Does the assistant see my whole repository?

No. It sees the same findings as the dashboard, with known key and token formats and secret-named values redacted: flagged lines, verdicts, explanations, suggested fixes and triage history, plus scan summaries. The clone is deleted after each scan, and GitHub tokens and raw scanner output are never returned.

Can text in my code take over the assistant?

Findings quote your code, websites and API files, so anyone who can change those can put text in front of your assistant. Every such field is labelled untrusted_*, with invisible characters stripped and known key and token formats and secret-named values redacted, and the server tells the assistant to treat it as data. Your assistant still reads it, so check any scan or status change it proposes before you approve it.