cystene

Cystene CLI + MCP — scan your infrastructure from your terminal or your AI assistant.

One pip install ships three entry points over a single shared core:

• cystene — the CLI. cystene scan <url> runs the engines and prints ranked findings.
• cystene-mcp — the MCP server over stdio (Claude Desktop / Claude Code / Cursor).
• cystene-mcp-http — the MCP server over HTTP + OAuth (remote, mcp.cystene.com).

Install

pip install cystene
# or:  uv tool install cystene
cystene --help

Login

cystene login            # browser (OAuth device flow)
cystene login --basic    # email/password in the terminal (headless / CI)
cystene status           # show current auth status

Credentials are stored locally in ~/.cystene/credentials.json (chmod 600). Your password never reaches the AI — login happens in your browser or terminal.

Scan from the terminal

cystene scan https://app.example.com
cystene scan https://app.example.com --engines web_scan,baas_scan,secret_scan
cystene scan https://app.example.com --fail-on critical

scan finds or creates a target for the URL, runs the external engines, prints the findings ranked worst-first with severity + confidence, and exits non-zero when any finding is at or above --fail-on (default high) — drop it straight into CI:

- run: pip install cystene && cystene login --basic <<< "$CYSTENE_EMAIL\n$CYSTENE_PASSWORD"
- run: cystene scan "$DEPLOY_URL" --fail-on high

Use from your AI assistant (MCP)

After cystene login, wire the stdio server into your client:

Claude Code:

claude mcp add cystene -- cystene-mcp

Claude Desktop / Cursor — add to the MCP config:

{
  "mcpServers": {
    "cystene": { "command": "cystene-mcp" }
  }
}

Then ask: "Scan https://app.example.com and show me the critical findings."

Tools (MCP)

Security

• Passwords never reach the AI — login happens in your browser or terminal.
• Credentials stored locally in ~/.cystene/credentials.json (chmod 600).
• Automatic token refresh on expiry.
• No destructive operations exposed over MCP.
• All API validations, permissions, subscription gating, and audit logging apply.

Requirements

• Python 3.12+
• A Cystene account