Get Started - Hacktron Docs

Claude Code (CLI)
Claude Desktop
Cursor
Codex
Antigravity

Run in terminal:

claude mcp add --transport http hacktron https://mcp.hacktron.ai/mcp

Then authenticate the connection:

Start Claude Code in your project.
Type /mcp, select hacktron, and choose Authenticate.
Complete the Hacktron browser sign-in.

Prefer using an API key?

Create an organization API key using the Authentication guide. Grant read and write access if you want your assistant to triage findings.Run in terminal:

claude mcp add --transport http hacktron https://mcp.hacktron.ai/mcp --header "Authorization: Bearer hacktron_your_key_here"

An API key is a long-lived secret. Store it in your client’s secret settings, never commit it to source control, and grant the narrowest scope your workflow needs.

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "hacktron": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://mcp.hacktron.ai/mcp"]
    }
  }
}

Restart Claude Desktop to apply changes.When Claude Desktop connects to Hacktron for the first time, complete the Hacktron browser sign-in. If the prompt does not appear, open Claude Desktop’s MCP server settings and reconnect hacktron.

Prefer using an API key?

Create an organization API key using the Authentication guide. Grant read and write access if you want your assistant to triage findings.

{
  "mcpServers": {
    "hacktron": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://mcp.hacktron.ai/mcp", "--header", "Authorization: Bearer hacktron_your_key_here"]
    }
  }
}

An API key is a long-lived secret. Store it in your client’s secret settings, never commit it to source control, and grant the narrowest scope your workflow needs.

Add to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "hacktron": {
      "url": "https://mcp.hacktron.ai/mcp"
    }
  }
}

Reload Cursor after saving (Cmd+Shift+P → Reload Window).When Cursor prompts you to authenticate hacktron, complete the Hacktron browser sign-in. You can also open Cursor’s MCP settings, select hacktron, and start authentication from there.

Prefer using an API key?

Create an organization API key using the Authentication guide. Grant read and write access if you want your assistant to triage findings.

{
  "mcpServers": {
    "hacktron": {
      "url": "https://mcp.hacktron.ai/mcp",
      "headers": {
        "Authorization": "Bearer hacktron_your_key_here"
      }
    }
  }
}

An API key is a long-lived secret. Store it in your client’s secret settings, never commit it to source control, and grant the narrowest scope your workflow needs.

Run in terminal:

codex mcp add hacktron --url https://mcp.hacktron.ai/mcp

Then authenticate the connection:

codex mcp login hacktron

Complete the Hacktron browser sign-in. In an interactive Codex session, type /mcp to check the server’s connection and authentication status.

Prefer using an API key?

Create an organization API key using the Authentication guide. Grant read and write access if you want your assistant to triage findings.1. Add your API key to your shell profile (~/.zshrc or ~/.bashrc):

export HACKTRON_API_KEY=hacktron_your_key_here

2. Register the server:

codex mcp add hacktron --url https://mcp.hacktron.ai/mcp --bearer-token-env-var HACKTRON_API_KEY

An API key is a long-lived secret. Store it in your client’s secret settings, never commit it to source control, and grant the narrowest scope your workflow needs.

Add to ~/.gemini/config/mcp_config.json:

{
  "mcpServers": {
    "hacktron": {
      "serverUrl": "https://mcp.hacktron.ai/mcp"
    }
  }
}

Click Refresh in the MCP Servers panel to apply changes.Select hacktron in the MCP Servers panel and complete the Hacktron browser sign-in when prompted.

Tools

Use these tools to work with Hacktron from your AI assistant. The linked REST API endpoints provide the same operations and permission requirements. Viewers can read scans and findings. Members can update findings and prepare pentests. Starting a pentest or changing PR review settings requires an organization admin.

Scans and findings

Name	Description	REST endpoint
`list_scans`	List scans with finding counts by severity	`GET /scans`
`get_scan`	Get details about a scan	`GET /scans/{id}`
`export_findings`	Export a scan’s findings as JSON, CSV, or SARIF	`GET /scans/{id}/findings/export`
`stop_scan`	Stop a running scan or pentest	`POST /scans/{id}/stop`
`list_findings`	List findings across your organization	`GET /findings`
`count_findings`	Count findings by severity, state and repository	`GET /findings/counts`
`get_finding`	Get details about a finding	`GET /findings/{id}`
`update_finding`	Update a finding’s state or severity	`PATCH /findings/{id}`
`add_finding_comment`	Post a comment on a finding	`POST /findings/{id}/comments`

Pentests

Name	Description	REST endpoint
`list_repositories`	List connected repositories	`GET /repos`
`request_archive_upload`	Get a URL to upload a code archive	`POST /archives/uploads`
`create_pentest_draft`	Create a draft with code and optional live sites	`POST /pentests`
`update_pentest_draft`	Change a pentest that hasn’t started	`PATCH /pentests/{id}`
`verify_pentest_login`	Check that Hacktron can sign in to each site	`POST /pentests/{id}/login-checks`
`estimate_pentest`	Estimate a draft pentest’s credit cost	`POST /pentests/{id}/estimate`
`get_cost_estimation`	Get a pentest cost estimate	`GET /cost-estimations/{id}`
`get_credit_balance`	Read your organization’s pentest credit balance	`GET /credits`
`start_pentest`	Start a pentest and spend its credits (admins only)	`POST /pentests/{id}/start`
`discard_pentest_draft`	Delete a pentest that hasn’t started	`DELETE /pentests/{id}`

PR reviews

Name	Description	REST endpoint
`get_pr_review_settings`	Read your organization’s PR review settings	`GET /pr-review-settings`
`update_pr_review_settings`	Update review comments, the check’s severity threshold and filters (admins only)	`PATCH /pr-review-settings`
`set_pr_reviews`	Turn PR reviews on or off for repositories (admins only)	`POST /repos/pr-reviews`

For signed-in testing, your assistant sends login details to Hacktron for encrypted storage. Anything you type in the conversation also goes to your assistant’s model provider. Use dedicated test credentials.

Authentication & API keys

Create an API key and choose its access scopes.

API reference

Use the same operations from your own scripts and applications.

⌘I

​Tools

​Scans and findings

​Pentests

​PR reviews

​Related

Authentication & API keys

API reference

Tools

Scans and findings

Pentests

PR reviews

Related