Pre-commit AI pentesting in your editor. Vortex MCP runs a real dynamic pentest against your locally-running app — from Claude Code or any MCP client — and hands back exploit-checked findings with remediation guidance.
The same Vortex engine as the platform — delivered at dev-time. Your app traffic originates on your machine.
?q=The Problem
AI generates whole features in seconds. The volume outpaces human review, and insecure patterns land in the branch before anyone reads them.
SAST and linters flag shapes in source. They miss auth bypasses, injection, and logic flaws that only exist when the app is actually running.
A proper dynamic test happens after merge — sometimes once a year. The exploitable bug was reachable the whole time, in every commit since.
How It Works
You ask Claude to pentest your app. The Vortex brain in the cloud plans the attack and streams tool commands down to a local executor running in a Docker container on your machine — which runs the tools against your locally-running app.
Request path
Under the hood: industry-standard dynamic security tools, orchestrated by the Vortex brain — real DAST, not pattern-matching.
Your source stays yours. App traffic originates on your machine. In blackbox mode the brain never sees your source code; greybox sends only derived context — routes, OpenAPI, stack — never source.
Capabilities
Live attack payloads against your running app — the flaws a code scanner can't see because it never runs the code.
The pentest engine that powers the platform — delivered at dev-time, so what you fix locally matches what runs in CI and prod.
Claude Code, Cursor, Cline, Zed — or wired into CI. Any Model Context Protocol client can drive it.
Test blind like an outside attacker, or hand over derived context — routes, OpenAPI, stack — for deeper coverage. Never your source.
Standards-compliant findings drop straight into code scanning dashboards and PR annotations — no glue code.
Fail the build on a severity threshold. Choose smoke, standard, or deep to trade speed for depth.
Security Posture
Vortex MCP is built so the powerful, proprietary parts stay server-side and the thing on your laptop is deliberately small and contained.
The crown-jewel AI stays server-side. The local executor only runs tool commands it's told to run — there's no model or attack logic to extract from your machine.
Runs in an isolated container on your machine. The executor is a small, contained process that runs the tool commands it's given — kept separate from the rest of your environment.
Authenticate with a scoped org API token or OAuth 2.0 device flow — approve a code in your browser, no long-lived secret pasted into config.
An "only test what you own" guardrail keeps scans pointed at targets tied to your organization — not arbitrary hosts on the internet.
Why Trust It
Vortex MCP isn't a new scanner bolted onto your editor. It's the same Vortex pentest engine that BestDefense runs against live applications — brought forward to the moment code is written, before it can ship.
Get started
Start a free trial and run a real pentest against your local app from your editor — from Claude Code or any MCP client.
Runs on your machine · Docker required · blackbox or greybox.