Vortex MCP — pre-commit pentesting

Vortex MCP puts the BestDefense AI pentester inside your coding agent. Install a Claude Code plugin (or wire the MCP server into any MCP client), point it at the app you’re running locally, and ask it to pentest — a real DAST/pentest runs against your app on your machine, before you commit. Your app never leaves your machine; only the findings come back.

It’s a standard Model Context Protocol server, so it isn’t Claude-only — Cursor, Cline, Zed, or a CI runner can use the same container with the same configuration.

Which Vortex is this?

BestDefense ships the same Vortex engine two ways, and this section documents the local one:

• Vortex MCP (this section) — a local, developer-run, pre-commit pentest you drive from your coding agent. You run your app locally, the pentest runs from your machine against it, and findings surface inline in your editor. Use it to catch issues before you push.
• Vortex AI pen-test — the same engine run from the BestDefense cloud against a verified, deployed site, launched and reviewed in the web app. Use it for scheduled and post-deploy assurance.

Same engine and detection quality; different delivery. Reach for Vortex MCP pre-commit and the in-app pentester for deployed environments.

How it works

Vortex MCP splits into a local executor and a cloud brain:

• The container that runs on your machine is the MCP server, a non-privileged executor, and a curated suite of industry-standard dynamic application security testing (DAST) tools.
• The AI brain (BestDefense intellectual property) stays server-side. It reasons about your app and streams tool commands back to the local executor, which runs them against your app.

Because the executor runs locally, all scan traffic originates on your machine and reaches your app directly. The brain never sees your application — it only receives the results the executor sends back. The client itself is brain-free: there is no BestDefense checkout or model to install.

Prerequisites

• Docker on your machine (the executor runs as a container).
• A coding agent or MCP client — Claude Code with the plugin is the smoothest path.
• A BestDefense pentest endpoint, e.g. https://pentest.app.bestdefense.io, or your dedicated-stack URL.
• Authentication — a scoped organization API token (the default) or the optional OAuth device-flow secure mode. See Authentication.
• Vortex MCP must be enabled for your organization — it comes with the Vortex MCP add-on ($39/user/month). The add-on is a standalone subscription: no Vortex plan is required. Deep scans are the one exception — they reserve a pre-commit credit, and that credit pool comes from a Vortex plan.

Start with Installation.

Where to go next

• Installation — plugin and direct-MCP setup.
• Authentication — API token and secure mode.
• Configuration — env vars, modes, and profiles.
• Running a pre-commit pentest — the end-to-end flow.
• CI integration — headless scans and build gates.
• Troubleshooting — the common footguns.
• Tools reference — the MCP tools and slash commands.