MCP website security testing for AI agents

AgentDAST exposes the same website security workflow through REST and the Model Context Protocol (MCP). An agent can register a website, request ownership verification, start an assessment and retrieve evidence without interpreting a dashboard.

Connect your MCP client

Use a Streamable HTTP connection to https://agentdast.com/mcp. Set the HTTP header Authorization: Bearer YOUR_API_KEY through your client’s secret configuration. Client configuration formats vary; the endpoint and authentication header are the same.

Create an account to obtain a key. Account creation and payments are not MCP tools. Keep keys out of chat transcripts, URLs and version control.

Give the agent a bounded task

Read https://agentdast.com/llms.txt.
Use my configured AgentDAST MCP connection.
Register https://app.example.com and show me its ownership proof.
After I publish the proof, verify that exact hostname.
Run an assessment with a 300-second and 15-request limit.
Return confirmed evidence and the assessment ID.

Replace the example origin with a website you control. Publishing the DNS record or verification file remains an owner action. A target URL alone never authorizes probing.

Available tools

get_usage checks the allowance.
list_websites, register_website and verify_website handle targets and ownership.
start_assessment, get_assessment and cancel_assessment control a run.
create_webhook registers a signed alert receiver.

Read the live tools/list response for argument schemas. The complete agent instructions describe errors, polling, idempotency and webhook verification.

Understand the result

The service runs a pinned abliterated Qwen model inside a restricted probe harness. The model chooses paths; deterministic checks confirm supported findings. Target responses are untrusted input. The model has no shell tool, and probes are restricted to the exact verified public HTTPS origin.

A completed assessment means its budget ended. Review the evidence; absence of findings does not certify security. For a conventional integration, follow the REST API walkthrough.

100 free assessments per month. No card required. Get a free API key.