Skip to main content
Plans: Every plan and the free trial. Who: any member can connect an agent once an owner or admin has allowed agents. Owners and admins create read tokens.
The Pharus MCP server lets an AI agent work with your workspace over the Model Context Protocol. It reads your data and, when a person connects it with OAuth, registers vulnerabilities and drafts reports for that person to review. It can’t file, approve or send. See work with an agent for what that means day to day. The address is https://mcp.pharussecurity.com/mcp (Streamable HTTP).

Connect a client

Clients that support OAuth sign you in by themselves: add the address, and your browser opens Pharus. You choose the workspace and what the agent may do.
Add https://mcp.pharussecurity.com/mcp as a custom connector, then select Connect.

With a read token

A client that can’t sign in can read with a read token instead, by sending Authorization: Bearer phr_.... A read token gets the read tools only, on every plan. Writing always needs a person’s OAuth connection, so that every action names someone. That means an agent can’t write on a schedule with nobody behind it.

Tools

Read

Register and draft

These need a connection given incidents:draft. See the HTTP endpoints behind them. No tool starts a clock, records or approves a decision, marks a report as submitted, sets a VEX status, closes an incident, publishes an advisory or sends anything.

Scopes

You choose at sign-in. To change what an agent may do, disconnect it and connect it again. On every request Pharus checks the token, that its person is still a confirmed member of the workspace (with two-step verification where required), that the workspace allows agents, and for a write that the workspace isn’t read-only. What the agent may do follows from that person’s rights, read at the time, never from when it connected.

Tokens

  • Access tokens start with pho_ and last 1 hour. Refresh tokens start with phor_ and last 30 days. Each refresh replaces the refresh token, and using an old one ends them all for that agent and person.
  • Tokens are issued for this server alone, and belong to one person in one workspace.
  • Pharus stores only a hash of each.
  • Signing out ends the access token, and the client gets a new one with its refresh token. A password reset disconnects the agent.
For client authors: Pharus publishes protected resource metadata at https://mcp.pharussecurity.com/.well-known/oauth-protected-resource/mcp and authorization server metadata at https://app.pharussecurity.com/.well-known/oauth-authorization-server/api/auth. Clients register with a Client ID Metadata Document or dynamically, with all their redirect URIs on one host. PKCE with S256 is required, and clients must send resource. Only public clients and the authorization code and refresh token grants are offered to agents.

Limits

Errors

The agent gets a tool error it can read and pass on. If its connection has ended, the client gets 401 and asks you to sign in again. If the workspace doesn’t allow agents, it gets 403.

Work with an agent

Register and draft

Read workspace data

Audit trail