DeepStrike, a world-renowned leader in penetration testing and attack surface management, enables organizations to expand their security initiatives confidently
This listing identifies a third-party MCP server. MCPBundles is not affiliated with, sponsored by, or endorsed by the service or its operator unless stated on this page.
This server may ask you to sign in when your AI client connects.
Last probed Nov 3, 2026 · mcp.deepstrike.io
13tools discovered
For AI agents — MCPBundles Directory API
For MCP client apps (human connect):
MCP connect URL: https://mcp.deepstrike.io/mcp
Skill page: https://www.mcpbundles.com/skills/deepstrike-mcp-d7641e84b7
Explore capabilities (13)
read 10
write 3
List
8
Create
2
Other capabilities
3
List workspaces
read
list_workspaces
List all DeepStrike workspaces the calling API token can access.
Use this FIRST when the user's request mentions a workspace by name or asks
"which workspaces do I have access to". The returned `slug` is what every
other tool requires as the `workspace_slug` parameter.
Returns an array of `{id, slug, name}` — sorted alphabetically by name.
Never returns workspaces the token's user is not an active member of, so
you can safely show the full result to the user.
List workspaces — List all DeepStrike workspaces the calling API token can access.
Use this FIRST when the user's request mentions a workspace by name or asks
"which workspaces do I have access to". The returned `slug` is what every
other tool requires as the `workspace_slug` parameter.
Returns an array of `{id, slug, name}` — sorted alphabetically by name.
Never returns workspaces the token's user is not an active member of, so
you can safely show the full result to the user.
List projects — List all projects (pentest engagements) in a workspace.
Each pentest engagement is one "project" — e.g. a Q2 web-app pentest,
an external network assessment, a phishing campaign. The returned
`id` is the `project_id` every finding-related tool requires.
Returns an array of `{id, name, identifier, description, network}`.
`identifier` is the human-readable prefix used in finding IDs (e.g. "WEB" → "WEB-42").
List findings — List findings (pentest work items) in a project, ordered by most-recently updated.
Returns a COMPACT summary per finding (id, sequence_id, name, priority, state_id,
assignee_ids, label_ids, timestamps). The full description, comments, and
attachments are deliberately omitted to keep responses small — call
`get_finding(finding_id)` for full detail on each item the user asks about.
Typical triage flow:
list_findings(severity="urgent") → review titles → get_finding(id) on the
ones that matter
Get finding — Fetch a single finding with its full description and metadata.
Use this after `list_findings` returned a summary and the user wants the
full description, remediation notes, dates, parent linkage, etc.
The description_html is trimmed to MAX_DESCRIPTION_CHARS (default 20k) and
base64-embedded images are replaced with placeholders to protect the
context window. If the finding's description was trimmed, the truncation
marker appears at the end — recommend the user open the finding in the
portal fo
Search findings — Cross-project search for findings in a workspace.
Use when the user knows roughly what they're looking for ("the SQLi finding
Marc filed last week") but not which project it's in. Returns summary rows
in the same shape as `list_findings`. The search is server-side and
typically returns up to 100 results — narrow the query if results feel
truncated.
Get your MCP into directories
A working endpoint is step one. Directory coverage is the coordinated launch across ChatGPT, Claude, Cursor, the MCP Registry, and community indexes.
DeepStrike, a world-renowned leader in penetration testing and attack surface management, enables organizations to expand their security initiatives confidently
How do I connect DeepStrike to my AI agent?
Use the MCP endpoint listed on this page in your MCP client configuration. One-click install pills support Claude, Cursor, VS Code, and other hosts. Copy the remote MCP URL if your client needs a manual entry.
How many tools does DeepStrike provide?
Operate this server?
Request removal if you do not want DeepStrike listed here, or claim the listing if you want to manage it on MCPBundles.
Operate DeepStrike?
This server appears in the MCPBundles directory. Verify you operate it to take over the listing — name, description, logo, contact email, and skill content. We email a 6-digit code to a maintainer address your server publishes in /.well-known/security.txt or /.well-known/mcpbundles.json. Free, takes about a minute.
MCPBundles publishes this directory for MCP discovery. Except where we host or operate an offering, third-party services run under their own terms. Product and company names on this page are used in a descriptive, identifying way (including under nominative fair use where applicable); they remain the property of their owners. Nothing here grants you rights in those marks, and nothing here is an offer to sell a third party's services. Terms · Request removal
More in security
Other MCP servers in this category from the directory index
Create finding — Create a new finding (work item) in the given project.
Requires ADMIN or MEMBER role on the project — GUEST tokens will receive
a permission error. Most fields are optional; only `title` is required.
Returns the full created finding (same shape as get_finding). The new
finding's `sequence_id` is auto-assigned by the backend.
Best practice: list_states + list_labels + list_members first so the LLM
can pass meaningful state_id / label_ids / assignee_ids instead of guessing.
Update finding — Partial update of a finding — pass only the fields you want to change.
The one tool covers stage transitions, severity changes, assignment, and
label edits. Anything you DON'T pass is left untouched (PATCH semantics).
Requires ADMIN or MEMBER role on the project. Returns the full updated
finding so the model can confirm the change applied.
For typical workflows:
- "Mark this as fixed": list_states → update_finding(state_id=<Fixed UUID>)
- "Bump priority": update_finding(priority="urgent")
List comments on a finding — List all comments on a single finding, oldest-first.
Useful for catching up on back-and-forth between the pentester and the
client team — typical context the user wants alongside `get_finding`.
Each comment includes `comment_html` (trimmed, embedded images stripped),
`actor_id` (the user who wrote it), and timestamps. Use `list_members` if
you need to translate actor IDs to names.
Create comment on a finding — Post a comment on a finding.
Requires ADMIN or MEMBER role on the project. The comment is attributed
to the API token's owning user (visible as `actor_id` in list_comments).
Returns the created comment so the model can confirm posting.
Best practice: before commenting, get_finding to confirm the right target
and avoid duplicating points already raised in earlier comments
(call list_comments first).
List finding audit trail — List the audit trail (every change) for a single finding, oldest-first.
Each row is one mutation: state transitions, priority changes, assignee
swaps, label adds/removes, etc. Fields: `verb`, `field`, `old_value`,
`new_value`, `actor_id`, `created_at`, optional `comment`.
Use when the user asks "what changed", "who moved this to fixed", or
"when was this re-tested". For free-text discussion see `list_comments`.
List project states — List the available stages (states) a finding can be in for this project.
DeepStrike's default stages: Open, Re-testing, Fixed, Risk Accepted,
False Positive, Triage. Each has an `id` (UUID), `name`, `group` (one of
'backlog', 'unstarted', 'started', 'completed', 'risk_accepted',
'cancelled', 'triage'), `color`, and `sequence` (display order).
Use BEFORE calling `update_finding(state_id=...)` — that endpoint needs a
state UUID, and you discover it here. Each project has its own state set.
List project labels — List the labels (tags) defined for this project.
Labels are free-form taxonomy — common DeepStrike examples: "auth",
"xss", "api", "infra", "regression". Each has `id` (UUID), `name`,
`color`, optional `parent_id`.
Use BEFORE `update_finding(label_ids=[...])` or `create_finding` with
labels.
List project members — List the project members (people you can assign findings to).
Each row: `id` (ProjectMember UUID), `member_id` (User UUID — the value
to use in assignee_ids), `role` (Plane role integer: 20=ADMIN, 15=MEMBER,
5=GUEST), `display_name`, `email`.
Use BEFORE assigning findings (`update_finding(assignee_ids=[member_id])`).
Note: assignee_ids takes the User UUID (`member_id` field), not the
ProjectMember row's `id`.
MCPBundles probed 13 tools on the live server. The tool list on this page reflects what was discovered at the last refresh — connect your client to see the full set available to your session.
What authentication does DeepStrike require?
DeepStrike may require signing in to the provider before tools can run. Connect through MCPBundles or your MCP client and complete any provider login when prompted.
Don't want this listed?
Request removal from the MCPBundles directory. We stop publishing this listing on mcpbundles.com.
MCPBundles is an independent platform built on the open Model Context Protocol standard. MCPBundles is not affiliated with, sponsored by, or endorsed by Anthropic PBC.