Integration

Intruder integration

Intruder is a cloud vulnerability scanner. List the security issues found on your targets with their occurrences, raw scanner output, affected targets and fixed history; snooze an occurrence or comment on it; add, tag and delete targets (one address, or many at once with CIDR ranges); start, follow and cancel scans; manage recurring scan schedules; read license usage; and configure the logins and API schemas the web application scanner uses. Starting a scan or a schedule sends real scan traffic to the targets. Scanner login secrets (passwords, cookies, headers) can be written but are never read back, and the link to a stored recorded login is not returned. Authentication is a personal access token created in the Intruder portal (My account, API Access Tokens), sent as a Bearer token.

Connect Intruder How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in Intruder.Built from the 33 Intruder tools below, on the connection you add once.

What you can do with Intruder

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Scan, 4 operations

cancel_scanCancel scanPOSTCancels a running scan. Returns Intruder's confirmation text (Scan was cancelled) in message.
get_scanGet scanGETReturns one scan: name, status, scan type, target addresses, throttling and web-ports options, creation, start and completion times. Use it to follow a scan started with start_scan.
list_scansList scansGETLists scans with their name, status, scan type, schedule period and creation time, filterable by status, scan type, schedule period and tag. Use get_scan for one scan's targets and start and end times.
start_scanStart scanPOSTStarts a vulnerability scan now against target_addresses and/or targets carrying tag_names; leaving both out scans EVERY target. Sends scan traffic to real systems. Follow it with get_scan. At most 500 active and scheduled scans.

Scan schedule, 4 operations

create_scan_scheduleCreate scan schedulePOSTCreates a recurring scan schedule (daily, weekly, monthly or quarterly) from first_scan_time, which must be in the future and on the hour. Its scans then run automatically against real systems. Returns the schedule id.
delete_scan_scheduleDelete scan scheduleDELETEDeletes a scan schedule, so its future scans no longer run. This cannot be undone.
list_scan_schedulesList scan schedulesGETLists recurring scan schedules: frequency, first and next scan dates, latest scan and its status, targets, tags and options. Filter by tag, or by whether a schedule scans every target.
update_scan_scheduleUpdate scan schedulePATCHUpdates a scan schedule: only the fields sent change, leave any field out to keep it. Returns Intruder's notice text.

Target, 4 operations

bulk_add_targetsBulk add targetsPOSTAdds several targets in one call; an address may be a CIDR range. Send items as a list of objects with an address each. Returns the created targets.
create_targetCreate targetPOSTAdds one target (an address such as example.com) to the account for scanning, optionally with tags and a web application login. Returns the target with its id. Use bulk_add_targets for several addresses or CIDR ranges.
delete_targetDelete targetDELETEDeletes a target from the account. Refused while the target is being scanned. This cannot be undone.
list_targetsList targetsGETLists targets with status, type, tags, license type, last scan date and detected WAF, filterable by address, tag, status, type, WAF interference and last scanned date. Use an item's id as target_id.

Target api schema, 4 operations

add_target_api_schemaAdd target api schemaPOSTUploads an API schema file to a target so the scanner can test the API served at base_url, optionally logging in with one of the target's authentications. Returns the schema record with its id.
delete_target_api_schemaDelete target api schemaDELETERemoves an API schema from a target. This cannot be undone.
list_target_api_schemasList target api schemasGETLists the API schemas attached to a target for API scanning. Pass the target id from list_targets.
update_target_api_schemaUpdate target api schemaPATCHUpdates an API schema on a target: rename it, change its base_url or authentication, or upload a new file. Only the fields sent change; leave any field out to keep it.

Target authentication, 4 operations

add_target_authenticationAdd target authenticationPOSTAdds a login the scanner uses on a target (form, http, http_header, session_cookie, recorded, oauth_client_credentials). Credentials sent are stored by Intruder and never read back. Returns the authentication.
delete_target_authenticationDelete target authenticationDELETERemoves a login from a target, so the scanner no longer uses it. This cannot be undone. Returns the removed authentication without its secrets.
list_target_authenticationsList target authenticationsGETLists the logins the web application scanner uses on a target: type, URLs, form field names, extra domains and enabled state. Passwords, cookies and headers are never returned.
update_target_authenticationUpdate target authenticationPATCHUpdates a login on a target; only the fields sent change. Use it to refresh a short-lived session cookie or header before a scan. Returns the authentication without its secrets.

Occurrence, 2 operations

list_occurrencesList occurrencesGETLists where one issue occurs: target, port, protocol, CVEs, CVSS, exploit likelihood and snooze state. Pass an item's id, with the issue_id, to snooze_occurrence, list_occurrence_comments or list_occurrence_scanner_output.
snooze_occurrenceSnooze occurrencePOSTSnoozes one occurrence of an issue for a set duration or forever, with a reason. Changes its state in Intruder for every user of the account. Needs issue_id and the occurrence id from list_occurrences.

Occurrence comment, 2 operations

add_occurrence_commentAdd occurrence commentPOSTAdds a plain-text comment to one occurrence of an issue, visible to everyone in the Intruder account. Needs issue_id and the occurrence id from list_occurrences. Returns the comment.
list_occurrence_commentsList occurrence commentsGETLists the comments on one occurrence of an issue, newest first: text, author, whether a user or Greg AI wrote it, and when. Needs issue_id and the occurrence id from list_occurrences.

Target tag, 2 operations

add_target_tagAdd target tagPOSTAdds a tag (at most 40 characters) to a target. Tags group targets for filtering, scans and schedules. Returns the tag.
remove_target_tagRemove target tagDELETERemoves one tag from a target. The tag name goes in name.

Api health, 1 operation

get_healthGet healthGETChecks the Intruder API is up and the access token works. Returns status and authenticated_as, the email of the Intruder user who owns the token (personal data).

Fixed occurrence, 1 operation

list_fixed_occurrencesList fixed occurrencesGETLists fixed occurrences, vulnerabilities that have been resolved, with remediation date, severity, host and port, filterable by severity, tag, target and a remediated_after / remediated_before window.

Issue, 1 operation

list_issuesList issuesGETLists the open security issues (vulnerabilities) found on your targets, 25 per page by default, filterable by severity, exploit likelihood, tag, target, category and snooze state. Pass an issue id to list_occurrences.

Issue target, 1 operation

list_issue_targetsList issue targetsGETLists the targets affected by one issue: target id, address, display address (e.g. a cloud account name) and target type. Pass the issue id from list_issues.

License, 1 operation

list_licensesList licensesGETReturns the account's infrastructure and application license counts: total, available and consumed. A license stays tied to a target for 30 days once used.

Scanner output, 1 operation

list_occurrence_scanner_outputList occurrence scanner outputGETReturns the raw scanner output for one occurrence: the plugin that found it (name, CVEs, CVSS scores) and its evidence lines, as captured from your own systems. Needs issue_id and the occurrence id from list_occurrences.

Tag, 1 operation

list_tagsList tagsGETLists the tag names in the account. Tags group targets for filtering issues, targets and scans, and for scans and schedules by tag.

Use Intruder from Claude Code, Cursor or Codex

Connect Intruder in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Intruder operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Intruder

Create your workspace
Sign up free. Nothing to install.
Connect Intruder once
Add your Intruder connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.