MCP Server

Maintained by: Aether365 Team Audience: Security engineers, DevOps teams, and AI-assisted workflow users Scope: Connecting AI assistants to Aether365 scan data via the Model Context Protocol

Aether365 includes a built-in MCP (Model Context Protocol) server that lets AI assistants query your scan results, compliance posture, security findings, and External Attack Surface data, and start read-only scans directly. Available on every plan. MCP is a read-only surface and never drives AI Pilot.

What is MCP?

The Model Context Protocol is an open standard that allows AI assistants to connect to external data sources. Instead of copy-pasting scan results into a chat window, your AI assistant reads them directly from Aether365.

Supported Clients

Client	Setup
Claude Desktop	One-click config snippet from Settings
Cursor	One-click config snippet from Settings
Any MCP-compatible client	Standard MCP endpoint URL + token

Getting Started

1. Open MCP Settings

Navigate to Settings > MCP in your Aether365 dashboard. You will see your MCP server URL and configuration options.

2. Generate a Headless Token

Click Generate token to create an authentication token. Give it a descriptive label (e.g. "Claude Desktop" or "CI pipeline").

WARNING

Tokens are shown only once after creation. Copy and store them securely. Each token grants read access to your scan data and the ability to start scans (but never to apply a fix).

3. Configure Your AI Client

Claude Desktop

Copy the config snippet from the MCP settings page and paste it into your Claude Desktop configuration file:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "aether365": {
      "command": "npx",
      "args": ["-y", "@anthropic-ai/mcp-remote", "https://mcp.aether365.io/sse"],
      "env": {
        "MCP_HEADERS": "authorization:Bearer YOUR_TOKEN_HERE"
      }
    }
  }
}

Restart Claude Desktop after saving the file.

Cursor

Copy the Cursor config snippet from the MCP settings page and add it to your Cursor MCP configuration. The format is the same as Claude Desktop.

Other MCP Clients

Point your client at the MCP server URL shown in Settings and authenticate with the Authorization: Bearer <token> header.

What Can AI Assistants Do?

Once connected, your AI assistant can:

• Query scan results - Ask about your latest compliance score, failing checks, or trends over time
• Explore findings - Drill into specific security findings by framework, severity, or service
• Read remediation guidance - Pull the documented fix and reference docs for any check
• Read your attack surface - Review your External Attack Surface posture, scan targets, and TLS/DNS/endpoint findings per domain
• Start a read-only scan - Kick off a compliance scan on demand, then come back for the results when it finishes
• Compare scans - Analyse changes between scan runs to track progress
• Generate reports - Create custom summaries for stakeholders or audit preparation

Available tools

The server advertises these read-only tools (plus start_scan):

Tool	What it returns
list_scans	Recent scans (compliance, attack surface)
get_scan	A single scan with status and pass/fail counts
get_scan_findings	A scan's findings, filterable by result and severity, paginated
get_tenant_posture	Your latest completed scan posture (pass percentage)
get_remediation	Remediation steps and docs for a check id
get_check_doc	Documentation markdown and URL for a check id
get_attack_surface_posture	Latest External Attack Surface posture, open issues by severity
list_attack_surface_targets	Attack surface scan targets (auto + custom) with verification status
get_attack_surface_findings	Attack surface findings grouped by domain (TLS, DNS, endpoints)
start_scan	Starts a read-only compliance scan (never AI Pilot)

Example Prompts

Reading your posture

• "What are my critical findings from the latest scan?"
• "Show me all CIS checks that are failing for my Exchange Online configuration"
• "How has my compliance score changed over the last month?"
• "Summarise my security posture for a board report"

Drilling into findings and fixes

• "List my failing L1 checks and group them by service."
• "What does check AE.1001 mean and how do I fix it?"
• "Show me the remediation steps for my top three failing checks."
• "Pull the documentation for the SharePoint external sharing check."

External Attack Surface

• "What is my external attack surface posture right now?"
• "Which of my domains have the most open issues?"
• "List my attack surface scan targets and tell me which ones are unverified."
• "Show me the failing TLS and DNS findings for contoso.com."

Starting and comparing scans

• "Start a compliance scan and tell me when it finishes."
• "Kick off a scan, then walk me through the new failing checks."
• "Compare my two most recent compliance scans and tell me what changed."

Security

• Read-only, no AI Pilot over MCP - An assistant can read your data and start read-only scans, but it can never apply a remediation or drive AI Pilot through MCP. AI Pilot connections are refused for MCP-started scans, so a scan started over MCP never runs in AI Pilot mode and never auto-remediates. Applying a fix always stays an explicit, human-approved action in the dashboard.
• Tenant-scoped - Every tool call is scoped to your own tenant. An assistant can never reach another tenant's data, whatever it asks for.
• Scoped tokens - Each token is independently revocable from the MCP settings page.
• Expiry options - Tokens can be set to expire after 90 days, 1 year, or never.
• Audit logged - All MCP access, including scans you start, is recorded in your audit trail.

Token Management

Action	How
Create token	Settings > MCP > Generate token
View active tokens	Settings > MCP (shows label, created date, last used, expiry)
Revoke token	Click "Revoke" next to any active token

Revoking a token takes effect immediately. Any client using that token will lose access.

Troubleshooting

AI assistant cannot connect

1. Verify the MCP server URL in Settings > MCP
2. Check that your token has not been revoked or expired
3. Ensure your client configuration includes the correct Authorization header
4. Restart the AI client after configuration changes

"Not available" shown for server URL

Your account may not have completed onboarding. Connect at least one Microsoft 365 tenant and run a scan first.

Token shown as "Never used"

The "Last used" timestamp updates when the AI client successfully authenticates. If it stays at "Never used", the client is not connecting. Double-check the URL and token in your client configuration.