Skip to content

MCP Server Tools

The NodeZero MCP server enables Claude (and other MCP-compatible AI assistants) to work with your Horizon3 pentest data using natural language prompts. You ask a question and the MCP server picks the right tool and returns the answer. No GraphQL required for everyday use.

Everything you see is scoped to your own Horizon3 account and your user permissions.

Key Terminology

NodeZero uses precise language that differs from generic security tools. Getting these right is the difference between an accurate answer and a misleading one.

For example, "weaknesses" are the findings within one pentest, while a "weakness series" is the same weakness deduplicated across all pentests for trend tracking. Ask for weaknesses when you mean "what did this pentest find?" and ask for the weakness series when you mean "what's still exploitable across all pentests, and is it trending down?"

Refer to the Glossary for precise definitions.

MCP Server Tools Available

Find and Summarize Pentests – get_pentest_details

Retrieve your pentests and their statistics (hosts, services, weaknesses, impacts, attack paths, credentials, and more), filtered by date, person, client, name, or type, without writing a GQL query.

Try:

  • "Show me my five most recent pentests and their status."
  • "Pull up my latest internal pentest and tell me how many weaknesses, impacts, and credentials it found."
  • "Which pentests did our team run in the last month?"

Get Proven Weaknesses and How to Fix Them – get_vulnerability_details

Return the weaknesses NodeZero proved, with severity, affected asset, scores (base, context, and overall), and remediation guidance. Filter by severity, affected asset, or a specific pentest.

Try:

  • "What critical weaknesses did NodeZero prove in my most recent pentest, and on which hosts?"
  • "Show me all the critical weaknesses affecting a specific host or IP."
  • "Walk me through the top weakness in this pentest and how to remediate it."

Understand NodeZero's Terms – get_h3_terminology

Look up Horizon3's precise definitions so answers stay accurate.

Try:

  • "What's the difference between a 'weakness' and a 'vulnerability' in NodeZero?"
  • "What does context score mean, and how is it different from a CVSS score?"
  • "Explain what an attack path is."

Ask Anything (Read-Only) – run_h3_graphql_query

For questions the purpose-built tools don't cover, this runs a read-only query against the Horizon3 API. It cannot change anything — write operations are rejected. This is also how you reach the Vulnerability Management Hub / weakness series (account-wide, deduplicated weaknesses).

Try:

  • "How many pentests have we run, and how many unique open weaknesses are we tracking across all of them?"
  • "Walk me through the Vuln Management Hub — our open weakness series ranked by risk score."
  • "Which of our open weaknesses have the most attack paths behind them?"

Explore the API Schema – fetch_h3_graphql_docs

Look up a type, field, or enum in the Horizon3 GraphQL schema — useful when you (or the assistant) want to build a custom query for run_h3_graphql_query.

Try:

  • "What fields are available on a Weakness in the H3 API?"
  • "What pentest types can I create with NodeZero?"
  • "How do I query the weaknesses for a specific pentest?"

Create and Scope a Pentest – setup_pentest_scope

Start a new pentest. This performs a real action — your assistant will confirm before running it. Provide a name and, depending on the pentest type, the scope:

  • Internal pentest (NodeZero, the default): a network scope in CIDR notation.
  • External pentest (ExternalAttack): an asset group and/or OSINT domains.
  • Other types are available (Active Directory Password Audit, AWS, Azure, Kubernetes, Phishing, and more) — ask "what pentest types can I create?" to see them.

Try:

  • "Launch an internal NodeZero pentest named 'Q3 Internal' scoped to 10.0.0.0/24."
  • "Set up an external pentest against our primary asset group."

Combining Tools

The real power is chaining tools in one request. For example:

"Onboard a new analyst: for my most recent internal pentest, summarize the top critical weaknesses NodeZero proved and where they are, then explain what a 'weakness' means here versus a generic scanner finding."

Behind the scenes the assistant: 1. uses get_pentest_details to find your most recent internal pentest and its counts, 2. uses get_vulnerability_details to pull that pentest's critical weaknesses and affected hosts, and 3. uses get_h3_terminology to explain, accurately, that a NodeZero weakness is proven exploitable, not theoretical.

You get one coherent answer assembled from three tools — without naming any of them yourself.

Deprecated Server Tools

  • run_h3_graphql_request is deprecated and will be removed. Use run_h3_graphql_query for read-only queries and the purpose-built tools above.