---
name: orbitx-vapt
description: "Use Astra OrbitX MCP to manage pentest targets, scans, vulnerabilities, findings, comments, rescans, schedules, and reports. Activate when the user asks about Astra dashboard VAPT data. All tools require an OAuth access token on Streamable HTTP POST /mcp; none are anonymous."
---

# orbitx-vapt

This file is discovery only. Every tool requires a Bearer access token from Astra MCP OAuth. There are no unauthenticated tools.

## Connect

- Transport: `POST https://mcp.getastra.com/mcp` (Streamable HTTP).
- Registration: `https://mcp.getastra.com/auth.md`.
- After connect, treat `tools/list`, server instructions, and `astra://docs/*` as canonical. Do not guess dash-api nouns.

## When to use

The user wants to inspect or change Astra pentest data on the dashboard — targets, scans, vulnerabilities, findings, comments, rescans, schedules, or reports.

## How to operate

- Say **target**, **scan**, **vulnerability**, **finding**, **rescan** — not project, audit, issue, or reaudit.
- Validate before mutating: `scan_validate_start` before `scan_start`; `report_validate_generate` before `report_generate`; `schedule_validate_frequency` when frequency is plain language.
- Do not start an automated scan without the user choosing scan type (and inventory coverage for Full). Do not default to full inventory.
- `schedule_delete` is two-step: preview without `confirm`, then `confirm=true` only after the user agrees to that preview.
- Remediation: `vulnerability_remediation_brief`, then tools with that canonical id. Do not PATCH vulnerability `status`.
- Reports: share `dashboardUrl`. MCP does not return file download links.

## Tools

Ids and titles only. Schemas and full descriptions are on `tools/list` after OAuth.

### Targets

- `target_list` — List targets
- `target_get` — Get target

### Scans

- `scan_list` — List scans
- `scan_get` — Get scan
- `scan_get_stats` — Get scan stats
- `scan_validate_start` — Validate scan start
- `scan_start` — Start scan
- `scan_cancel` — Cancel scan

### Vulnerabilities

- `vulnerability_list` — List vulnerabilities
- `vulnerability_get` — Get vulnerability
- `vulnerability_get_findings_summary` — Get vulnerability findings summary
- `vulnerability_get_transitions` — Get vulnerability transitions
- `vulnerability_apply_transition` — Apply vulnerability transition
- `vulnerability_remediation_brief` — Get vulnerability remediation brief

### Findings

- `finding_list` — List findings
- `finding_get` — Get finding

### Comments

- `comment_list` — List comments
- `comment_get` — Get comment
- `comment_add` — Add comment
- `comment_update` — Update comment
- `comment_delete` — Delete comment

### Rescans

- `rescan_get_eligibility` — Get rescan eligibility
- `rescan_request` — Request rescan
- `rescan_list` — List rescans
- `rescan_get` — Get rescan
- `rescan_vulnerability_list` — List rescan vulnerabilities
- `rescan_vulnerability_get` — Get rescan vulnerability

### Schedules

- `schedule_list` — List schedules
- `schedule_get` — Get schedule
- `schedule_validate_frequency` — Validate schedule frequency
- `schedule_create` — Create schedule
- `schedule_update` — Update schedule
- `schedule_delete` — Delete schedule

### Reports

- `report_validate_generate` — Validate report generation
- `report_generate` — Generate report
- `report_list` — List reports
- `report_get` — Get report

### har

- `har_validator_intake` — HAR validator intake
- `har_validator_get_guide` — Get HAR validator guide

### login

- `login_recording_intake` — Login recording intake
- `login_recording_get_guide` — Get login recording guide

### activity

- `activity_log` — Query activity log