Quickstart for agents

Use Claude Code, Codex, Cursor, or another MCP client to set up MindFort and run your first assessment. You need a MindFort account, an application you are authorized to test, and access to its domain’s DNS settings. If you are an AI agent, follow the steps in the prompt below directly. Copy this prompt into your agent. Complete browser sign-in and domain verification when it asks.

Help me set up MindFort for my organization through the MindFort MCP server. MindFort runs a swarm of AI agents that red-team web apps and APIs to find and confirm vulnerabilities.

1. Connect the MindFort MCP server at https://api.mindfort.app/mcp.
   - Claude Code: claude mcp add --transport http MindFort 'https://api.mindfort.app/mcp', then run /mcp to sign in.
   - Codex: codex mcp add MindFort --url 'https://api.mindfort.app/mcp'
   - Cursor or another client: add it as a remote HTTP MCP server.
   Sign in with my MindFort account in the browser (no API key) and pick my organization.
2. Read the server resource mindfort://guides/start-here. For anything else, open only the pages you need from https://docs.mindfort.ai/llms.txt.
3. Call get_current_context and confirm my organization and role with me. Adding targets needs an owner or admin role.
4. Call list_targets. If my app is already there, reuse it. Otherwise ask me for its URL and whether it is a web app or an API, then add it with create_target. Only add apps I own or am authorized to test.
5. Recommended: ask me for a dedicated test account and add it with create_target_credential. Pick the credential_type that matches how the app signs in (password, magic link, or email, SMS, or authenticator MFA), and put the login URL and any extra steps in login_instructions. For an API target, set api_auth_instructions first. Never use a real customer's account.
6. Call verify_target_domain. It returns a DNS TXT record (record_name and record_value). Ask me to publish it at my DNS provider, or to use Auto setup on the target in the MindFort dashboard. When I confirm, call verify_target_domain again until verified is true. DNS changes can take a few minutes, so do not poll.
7. Confirm with me before you start: an assessment begins active testing and uses credits. Call run_assessment with the target_id and, if we added a login, its target_credential_id. Without it, the agents only test what is reachable without signing in. If it returns assessment_credits_insufficient, tell me to add credits under Billing in the dashboard.
8. An assessment runs for hours. Give me its ID and the stage_progress from get_assessment, then stop. When I ask later, check get_assessment and summarize list_findings with status=ACTIVE and exclude_secured=true.

Review tool warnings before any active testing, and ask me before destructive actions. Live tool schemas override this prompt.

For connection help and tool details, see the MCP guide.

Getting Started

Core Workflows

Advanced Features

Integrations

Help & Support