Overview

The Fluid Attacks MCP server is a small integration layer that exposes utilities for interacting with the Fluid Attacks API from Model Context Protocol (MCP) clients and other automation tooling. It provides programmatic access to run GraphQL queries against Fluid’s backend, retrieve organization insights, enumerate vulnerabilities/findings, and incorporate those results into automated workflows (triage, reporting, CI gates, etc.).

Because the server speaks the MCP pattern, it can be plugged into model-driven assistants, security automations, or CI systems to let tools query Fluid’s data without embedding raw API calls in every consumer. Authentication is handled via an API token, and the server is intended as a lightweight bridge for developer workflows that require vulnerability data and organizational metrics from Fluid Attacks.

Features

Run arbitrary GraphQL queries against the Fluid Attacks API via MCP tools.
Retrieve vulnerabilities, findings, and metadata for triage and reporting.
Access organization-level insights and metrics.
Simple environment-variable based configuration (API_TOKEN).
Start with npx (no global install) or embed in an MCP server list.
Designed to be used inside model-driven automations, chatops, or CI pipelines.

Installation / Configuration

Quick start using npx (no install required):

# Run interactively (example: starts the MCP server process)
API_TOKEN="your_api_token_here" npx -y @fluidattacks/mcp

Example MCP server entry (for a client that uses an mcpServers configuration):

{
  "mcpServers": {
    "fluidattacks-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@fluidattacks/mcp"
      ],
      "env": {
        "API_TOKEN": "your_api_token_here"
      }
    }
  }
}

How to get an API token

Generate or retrieve your API_TOKEN according to Fluid Attacks documentation: https://dev.fluidattacks.com/components/interacts/#setup
Treat the token as a secret: store it in a secrets manager, environment variable, or CI secret store and rotate periodically.

Configuration notes

The only required configuration is the API_TOKEN environment variable. Additional configuration (log level, timeouts) may be provided in the project repo or docs; check the repository for advanced options.
Running via npx spawns the MCP server process locally; for production or shared deployments, run it in a container or as a managed process with the API token loaded securely.

Repository

Source: https://github.com/fluidattacks/mcp

Available Tools / Resources

Conceptual tools exposed by the MCP server (names may vary depending on the client integration):

GraphQL query runner — execute arbitrary GraphQL queries against the Fluid Attacks API and return structured results.
Vulnerability / Findings explorer — list vulnerabilities, filter by severity, status, asset, or target.
Organization insights — fetch org-level metrics (counts, trends, coverage).
Export/reporting hooks — retrieve data to build CSV/JSON reports.

Useful links

API docs and component guide: https://dev.fluidattacks.com/components/interacts/
Server repository: https://github.com/fluidattacks/mcp

Sample GraphQL query (example)

query ListVulnerabilities($first: Int) {
  vulnerabilities(first: $first) {
    nodes {
      id
      title
      severity
      status
      createdAt
      target {
        id
        name
      }
    }
  }
}

Example usage pattern

Send the GraphQL query through the MCP tool with variables: { "first": 10 }
The MCP server forwards the query to Fluid’s API, returning the JSON result to the client.

Use Cases

Automated triage: query new findings, enrich with context, and auto-assign or tag issues for human review.
- Example: run a GraphQL query every hour for “new” findings, then create tickets for critical/high severity items.
CI / PR gating: fail a build or block a PR if a specified threshold of new critical findings is detected against the target component being changed.
- Example: before merging, the CI job queries recent vulnerabilities for the target service and fails if any critical open findings exist.
Reporting and dashboards: aggregate organization insights (counts by severity, remediation time) to feed into internal dashboards or security reports.
- Example: weekly job queries organization metrics and emits a formatted CSV for the security team.
ChatOps and assistant integrations: allow a model-driven assistant to answer questions like “Show me the top 5 critical findings this week” by executing GraphQL requests via the MCP server.

Best Practices

Keep the API_TOKEN secret and restrict its scope to the minimal required permissions.
Limit query frequency and paginate results to avoid rate limits.
Use structured queries (GraphQL variables, limits) to minimize payload sizes.
Rotate tokens and audit usage periodically.

Troubleshooting

Authentication errors: verify API_TOKEN, check for typos, and confirm token validity in the Fluid Attacks portal.
Slow responses: paginate queries and filter fields to request only what you need.
Integration problems: consult the component documentation (link above) and check the MCP server logs for request/response traces.

For full reference and implementation details, see the project repository: https://github.com/fluidattacks/mcp and the Fluid Attacks interacts documentation: https://dev.fluidattacks.com/components/interacts/

Fluid Attacks MCP Server for Vulnerability Management