Vortex MCP tools reference

Vortex MCP exposes five tools over MCP. The Claude Code plugin also ships slash commands that drive them. For the end-to-end flow, see Running a pre-commit pentest.

MCP tools

Tool	Parameters	Returns
health_check	target_url (optional)	{ ok, checks: [{ check, ok, detail, remedy? }] } — a readiness preflight; starts no scan.
start_pentest	target_url (required); mode = smoke | standard | deep (default standard); test_profile = blackbox | greybox (default blackbox); workdir (optional, greybox derivation root — defaults to CWD)	{ session_id, target, mode, test_profile, … } — use session_id for every later call.
get_pentest_status	session_id (required)	The current scan status. Poll about every 20–30s until terminal. The only safe way to monitor.
get_findings	session_id (required); output_format = json | sarif (default json)	json: { session_id, format, findings }. sarif: { session_id, format, sarif } (SARIF 2.1.0).
cancel_pentest	session_id (required)	Cancels the scan and tears down the local executor.

Parameter notes

• target_url — use host.docker.internal, not localhost, to reach your local app (see Configuration).
• mode — smoke is a fast, diff-scoped pre-commit pass; standard is the balanced default; deep is the most thorough and reserves a pre-commit credit.
• test_profile — greybox derives routes/OpenAPI/tech-stack locally from workdir and sends only that derived context to the brain; your source stays on your machine.
• output_format="sarif" — SARIF 2.1.0 for GitHub code scanning, IDEs, and CI (see CI integration).

Slash commands

Command	What it does
/bestdefense-pentest:bd-pentest-setup	One-time setup — configure auth and verify connectivity.
/bestdefense-pentest:doctor [url]	Readiness preflight (host chain + health_check).
/bestdefense-pentest:scan <url> [mode]	Start a scan — drives start_pentest.
/bestdefense-pentest:findings <session-id>	Fetch and summarize findings — drives get_findings.
/bestdefense-pentest:login	Secure mode only — OAuth device-flow login.
/bestdefense-pentest:status	Secure mode only — org, tier, seats, and remaining deep-scan credits.

login and status apply only to the optional device-flow secure mode; the default API-token path doesn’t use them. See Authentication.