Connect Autobahn Security to your AI assistant

Overview

The Autobahn Security connector links your AI assistant directly to your Autobahn account.

Once connected, you can ask about your assets, issues, scans and workouts in plain English. No exports, no API scripting, no leaving the conversation.

It works with any AI tool that supports remote MCP connectors, including Claude, Claude Code, Cursor, VS Code (GitHub Copilot), and ChatGPT. You add the connector once with a single URL, sign in with your own Autobahn API credentials, and your assistant can then use up to 41 tools on your behalf: 30 that only read your data, and 11 that can make changes and always ask for your approval first.

There is nothing to install and no VPN.

What your assistant can and cannot see

Your assistant only ever sees data belonging to your organization, the one your API token was issued for.
Your API credentials are typed into Autobahn’s own sign-in page, never into your assistant’s settings. Your assistant holds only an encrypted session token. Your key is never stored on our servers.
Read-only tools run without interruption. Anything that changes data asks for your explicit approval each time.
Sessions last about a week. When one expires you simply sign in again.
You can revoke access at any time from Autobahn under Settings, then Developer, then API Token.

Step 1. Create an API token

In the Autobahn platform, go to Settings -> Developer -> API Token, and create a token.

⚠️ The API key is shown only once, when you create it. Copy it somewhere safe before closing the dialog. It cannot be retrieved later, only regenerated.

Depending on your account you will have one of two credential types. Both work, and the sign-in page lets you choose between them:

API key: a single value beginning ab_
External API user ID and Secret key: a pair of values

Step 2. Add the connector

The connector URL is the same for every client:

https://mcp.app.autobahn-security.com/mcp

Wherever a client asks for an OAuth Client ID, leave it empty. The connector registers itself automatically.

Pick your client below.

Claude (Free, Pro or Max plan)

1. Open Settings -> Connectors.

2. Click Add custom connector.

3. Paste the URL above. Leave OAuth Client ID empty.

4. Click Add, then Connect.

Claude (Team or Enterprise plan)

On these plans only a workspace Owner can add a connector, and they add it once for everyone.

1. An Owner goes to Admin settings -> Connectors -> Add.

2. They paste the URL above, leave OAuth Client ID empty, and click Add.

3. Everyone else then opens Settings -> Connectors, finds the Autobahn entry, and clicks Connect.

💡 If you cannot see an Add custom connector option, you are most likely on a Team or Enterprise plan without Owner rights. Ask whoever administers Claude at your company to add it for you.

Claude Code (CLI)

If you work in the Claude Code CLI, you can add the same connector from a terminal:

claude mcp add --transport http autobahn https://mcp.app.autobahn-security.com/mcp

Then type /mcp, select autobahn, and choose Authenticate.

Cursor

1. Open Settings -> Cursor Settings -> Tools and Integrations (labelled MCP in some versions).

2. Click Add custom MCP or New MCP Server.

3. Enter the URL above.

Or add it to your .cursor/mcp.json file:

{
  "mcpServers": {
    "autobahn": {
      "url": "https://mcp.app.autobahn-security.com/mcp"
    }
  }
}

The first time you use an Autobahn tool, Cursor opens a browser window to sign in.

VS Code (GitHub Copilot)

You need VS Code 1.101 or later, and Copilot Agent mode.

1. Open the Command Palette and run MCP: Add Server.

2. Choose HTTP, then paste the URL above.

3. Complete the sign-in when prompted.

Or add it to a .vscode/mcp.json file in your project:

{
  "servers": {
    "autobahn": {
      "type": "http",
      "url": "https://mcp.app.autobahn-security.com/mcp"
    }
  }
}

Antigravity

1. Follow Antigravity’s instructions for connecting custom MCP servers and add this to your mcp_config.json file:

{
  "mcpServers": {
    "autobahn": {
      "serverUrl": "https://mcp.app.autobahn-security.com/mcp"
    }
  }
}

2. Save the configuration.

3. Go back to your Manage MCP servers page. Find the Refresh button at the top right corner. You will find autobahn in the list and click Authenticate.

Note the key here is serverUrl, not url. Antigravity uses a different name from Cursor and VS Code.

ChatGPT

ChatGPT supports custom MCP connectors through Developer Mode, on eligible paid plans.

1. In Settings, open Connectors (or Apps), then enable Developer Mode under Advanced.

2. Add a new connector, paste the URL above, and authenticate.

3. Choose which tools to enable.

Note: which tools ChatGPT exposes, and how it handles approvals for tools that make changes, can differ from Claude. Read-only questions work the same everywhere.

Any other MCP client

Any tool that supports remote MCP servers over HTTP can connect. You only need two things:

The URL: https://mcp.app.autobahn-security.com/mcp
Leave the OAuth Client ID empty. Sign-in happens in a browser.

—

Step 3. Sign in

Connecting opens Autobahn’s sign-in page in a browser window. This is the same for every client.

1. Choose your credential type: API key, or External API user ID + Secret key.

2. Paste your value(s). Connect stays disabled until the fields are filled in.

3. You will see “You’re connected”, and the window returns you to your assistant automatically. You can also click Done.

4. After signing in, the Autobahn connector appears in your connected list.

💡 Let the window finish or click Done. Closing it too early can leave the connection incomplete.

You will be asked to sign in again when your session expires, roughly once a week. Nothing is stored on our side: your credentials are checked against the platform, encrypted into the session token, and discarded.

What you can ask

Scans

“Show me my 5 most recent scans and whether they finished.”
“What did my latest scan target, and what came back alive?”
“Are any scans scheduled for this week?”

Issues

“List my critical issues and group them by asset.”
“Explain this issue and how to fix it.”
“Which issues are still unassigned?”

Assets

“Which of my assets are most hackable right now?”
“What open ports were found on my internet-facing hosts?”
“Show me everything you know about this host.”

Overview and progress

“Summarise my hackability score and what is dragging it down.”
“What are my top workouts, and what would fix the most risk?”

Making changes (asks for approval)

“Tag these issues as urgent.”
“Assign the assets in this workout to me.”
“Invite this colleague to the team.”

Worked examples

Triage this week’s critical issues

“List my critical issues, show which assets they affect, and tag the ones on internet-facing hosts as urgent.”

Your assistant looks up your critical issues, maps them to assets, checks which are exposed, then asks you to approve each tag before applying it.

Check a scan actually covered what you expected

“For my latest scan, what did it target, what responded, and what did it miss?”

Useful for confirming coverage after changing a scan configuration.

Hand work to the right owner

“Show my top workouts, then assign the assets in the first one to me.”

Your assistant lists the workouts, pulls the assets, and asks for approval before reassigning.

Troubleshooting

Symptom	What to do
“These credentials were rejected”	The key is wrong, has been revoked, or you picked the wrong credential type. Create a new token under Settings → Developer → API Token.
Tools stop working after a while	Your session has expired. Reconnect from your client’s connector settings.
No “Add custom connector” option (Claude)	You are probably on a Team or Enterprise plan without Owner rights. Ask your Claude workspace administrator to add it.
The Autobahn connector is not listed (Claude)	It has not been added for your workspace yet. Ask your Claude workspace administrator.
Fewer results than expected	You only see data for the organisation your API token belongs to. Ask your assistant to “run a health check” to confirm which organisation you are connected as.
Sign-in fails repeatedly	Contact your Autobahn representative with the time it happened and any error text shown.

Good to know

“Run a health check” is the quickest way to confirm your assistant is connected and which organisation it is seeing.
Ask for a specific slice, a time window, a single asset, a limit, rather than “everything”. Large result sets are paginated.
Your assistant never sees your API key. It is entered on Autobahn’s page and exchanged for a session token.
You stay in control of changes. Every tool that writes data asks first, and you can decline.

How Can We Help you?