MCP Server

Connect your AI client to the SCV product through the Picus MCP server (a connector that makes supported customer API operations available to AI clients). This MCP server is available only for SCV.

Prerequisites

1. Get your customer API URL and customer API token.
2. Install Node.js and npm so your AI client can run npx.
3. Locate your AI client's MCP server configuration. The location depends on your client.

Connect your AI client

1. Add the following entry to your AI client's MCP configuration. If your configuration already has an mcpServers object, add only the picus-scv entry inside it.

   JSON

   {
     "mcpServers": {
       "picus-scv": {
         "type": "stdio",
         "command": "npx",
         "args": ["-y", "@picusnext/scv-mcp"],
         "env": {
           "PICUS_API_TOKEN": "<customer-api-token>",
           "PICUS_PLATFORM_URL": "<customer-api-url>"
         }
       }
     }
   }

2. Replace <customer-api-token> with your customer API token and <customer-api-url> with your customer API URL. Keep both values in quotes so the configuration remains valid JSON. Treat the token as a secret; don't commit it to a repository or share your configuration file.

3. Save the configuration and restart your AI client. Confirm that picus-scv connects and its tools appear in the client. If it does not connect, check that npx is available to the client and that both environment values are set correctly.

4. Optional: If your customer API uses a self-signed certificate and you trust the server, disable certificate verification by updating args:

   JSON

   "args": ["-y", "@picusnext/scv-mcp", "--allow-self-signed-cert"]

The MCP server uses the customer API, but it does not expose every customer API operation. If a task requires an excluded operation, use the customer API directly instead.

Customer API operations not available through MCP

The following customer API operations are intentionally not exposed as MCP tools:

• Authentication: The MCP server handles authentication internally.

  • POST /v1/auth/token
  • POST /v1/auth/refresh

• User management: User management is outside the MCP server's scope.

  • GET /v1/users
  • GET /v1/users/roles
  • POST /v1/users/invite
  • DELETE /v1/users/USERID
  • PUT /v1/users/USERID/role

• Agent installation: These operations expose installation credentials or installation material.

  • GET /v1/agents/install-token
  • GET /v1/agents/reinstall-token
  • GET /v1/agents/download-link
  • GET /v1/agents/kubernetes/download-yaml

• Raw logs: Raw content is not made available to AI clients.

  Text

  GET /v1/simulations/{SimulationId}/run/{RunId}/threats/{ThreatId}/peers/{PeerId}/integrations/{IntegrationId}/raw-logs

• Action logs and alerts: Raw log and alert content is not made available to AI clients.

  Text

  GET /v1/simulations/{Id}/run/{RunId}/threats/{ThreatId}/actions/{ActionId}/integrations/{IntegrationId}/logs
  GET /v1/simulations/{Id}/run/{RunId}/threats/{ThreatId}/actions/{ActionId}/integrations/{IntegrationId}/alerts
  GET /v1/simulations/{Id}/run/latest/threats/{ThreatId}/actions/{ActionId}/integrations/{IntegrationId}/logs
  GET /v1/simulations/{Id}/run/latest/threats/{ThreatId}/actions/{ActionId}/integrations/{IntegrationId}/alerts

• Exposure Validation: This operation belongs to a different product.

  • POST /v1/exposures/instances/scores

• Threat and file transfer: File transfers are not available through the MCP server.

  • GET /v1/threat-library/threats/{ThreatId}/export
  • POST /v1/threat-library/threats/import
  • POST /v1/threat-library/files

• Report download: Use the report download URL operation instead; the MCP server does not return report file bytes.

  • GET /v2/simulations/{Id}/results/reports/{ReportId}/download