McpServer

This MCP server provides a bridge between AI assistants and the Cervantes platform, exposing MCP tools for managing projects, clients, vulnerabilities, tasks, reports, documents, vaults, notes, and user/role access. It enables natural-language style interactions with Cervantes data by offering categorized MCP tools such as ClientTool, ProjectTool, VulnerabilityTool, TaskTool, ReportTool, DocumentTool, VaultTool, NoteTool, UserTool, and RoleTool. After starting the server, you can query and manipulate Cervantes data through standardized MCP tool commands and templates, allowing an AI assistant to drive penetration testing program management, vulnerability workflows, and documentation generation inside Cervantes.

Typical use involves configuring the server to point at your Cervantes instance, then invoking the desired tool via MCP client requests to perform CRUD operations, generate reports, manage users/roles, or manage vault data. Examples include listing high-risk vulnerabilities, creating a new client, or generating a project report, all routed through the MCP protocol to the underlying Cervantes API.

Prerequisites:

• .NET 9.0 Runtime or newer installed on your system
• Access to a Cervantes instance (API endpoint) with appropriate credentials
• Git for cloning the repository

Install steps:

1. Clone the repository git clone https://github.com/CervantesSec/McpServer.git cd mcpserver-cervantes

2. Build the project dotnet build --configuration Release

3. Run the MCP server dotnet run --project McpServer

4. Configure MCP client integration

   • Add a server entry in your MCP client configuration mirroring: { "servers": { "cervantes": { "command": "dotnet", "args": ["run", "--project", "/path/to/McpServer"], "env": { "CERVANTES_API_BASE_URL": "https://your-cervantes-instance.com" } } } }

5. Ensure environment variables and base URL are correctly set for the Cervantes API access.

Tips and considerations:

• Ensure the Cervantes API base URL is reachable from the MCP server host and that network/firewall settings allow access.
• Security: store credentials securely and use appropriate authentication methods (the sample uses BasicAuth in the app settings).
• If using environment variables, follow the naming conventions shown (CERVANTES__BASEURL, CERVANTES__USERNAME, etc.).
• Monitor logs under Logging:LogLevel to diagnose issues with MCP tool availability or Cervantes API interactions.
• The server exposes a broad set of tools; enable only necessary tools in production to reduce surface area and improve performance.