Developer access

Prem Cyberscan API & MCP

Start reviews and read repository, review, finding, statistics, and report data without changing repository access.

API server

Create a workspace token from the profile menu, then send it in the Authorization: Bearer header. Repository installation, selection, removal, and sync stay in the web app.

Local MCP adapter

Run it where your client runs.

The adapter calls the same HTTPS API and contains no scanner logic, GitHub credential, or model-provider key.

Download the MCP adapter.
Save it on the device running Fluso or your MCP client.
Paste this configuration and replace the path and one-time token.

{
  "mcpServers": {
    "prem-security": {
      "command": "node",
      "args": ["/absolute/path/to/prem-security-mcp.mjs"],
      "env": {
        "PREM_SECURITY_URL": "CURRENT_ENVIRONMENT_ORIGIN",
        "PREM_SECURITY_API_TOKEN": "prem_sec_…"
      }
    }
  }
}

Available operations

The full review lifecycle, one permission boundary.

Run a review

start_scancancel_scancontinue_scan

Start against an exact ref or commit, stop cooperatively, and continue accepted saved work. Current per-check continuations skip each saved check. Older bundle-level recovery can rerun checks inside an incomplete bundle, but never silently becomes a full scan.

Watch it

get_run_statusget_runget_run_eventslist_runs

Truthful stage and terminal status, the full run record including where a stopped review can resume from, and the ordered worker, checkpoint, and reconciliation activity.

Use the results

list_findingsget_reportget_statisticslist_repositories

Findings with evidence and safe validation plans, audit or Markdown reports, and workspace totals where missing usage stays distinct from zero.

Mind the wallet

get_credits

Available and reserved balance, per-model rates and maximum reservations, and recent credit activity — top-ups, holds, releases, and settled review usage.

Record owner feedback

get_feedbackcomment_runcomment_findingupdate_finding_feedback

Select an exact run and finding, inspect the source, record your evidence and uncertainty, then read back the saved feedback. Writes require a new token with “Allow owner feedback writes” selected. Existing tokens retain their access without gaining write permission. Feedback never changes scanner severity, evidence, receipts or shared reviews.

The adapter cannot install the GitHub App or add, remove, or sync repositories. Scan creation, continuation and feedback writes require stable idempotency keys. Finding state changes also require the revision from get_feedback. On a stale conflict, reload the current state and deliberately reapply with a fresh key. Non-relevance, accepted risk, false positives and suggested severity overrides require a reason. A partial scan is not evidence that a repository is clean.