Other clients

The generic recipe

Any client that can add a remote HTTP MCP server with a custom header works. There is nothing Vulnetix-specific to support.

Field	Value
Transport	HTTP (Streamable HTTP)
URL	`https://mcp.vulnetix.com/mcp`
Header name	`Authorization`
Header value	`ApiKey <orgId>:<hex>`
Auth type, if asked	Custom header or none. Never OAuth

The endpoint accepts POST only. GET and DELETE return 405 by design: protocol revision 2026-07-28 removed the standalone event stream and session teardown.

Names to expect

Clients spell the same thing differently. If a field below is missing from your client’s form, the value it wants is on the same row.

Concept	Seen as
The server list	`mcpServers`, `servers`, `context_servers`, `extensions`
The URL	`url`, `serverUrl`, `uri`, `endpoint`
The transport	`http`, `streamableHttp`, `streamable-http`, `streamable_http`
The headers	`headers`, `http_headers`, `requestOptions.headers`

Clients that only support stdio

Some clients can only launch a local command. Bridge with mcp-remote, which speaks stdio to the client and HTTP to us:

{
  "mcpServers": {
    "vulnetix": {
      "command": "npx",
      "args": [
        "-y", "mcp-remote",
        "https://mcp.vulnetix.com/mcp",
        "--header", "Authorization:ApiKey ${VULNETIX_ORG}:${VULNETIX_KEY}"
      ],
      "env": {
        "VULNETIX_ORG": "<orgId>",
        "VULNETIX_KEY": "<hex>"
      }
    }
  }
}

Warning

mcp-remote is a third-party package, not ours. It adds a Node process and a dependency to keep current, which is everything the direct HTTP integration avoids. Use it only when your client cannot do remote HTTP, and prefer upgrading the client.

Note there is no space after Authorization: in the --header argument; mcp-remote splits on the first colon, and a space there ends up inside the header name.

Protocol versions

The server answers both eras of MCP:

2026-07-28 is the current revision. Stateless, per-request metadata.
2025-11-25 and earlier are served through the SDK’s stateless legacy path.

You do not have to configure this. Most client SDKs still default to the legacy era, and that works.

Verified

Every client with a page in this section has been checked against the live endpoint: Claude Code, Claude Desktop, Cursor, VS Code / Copilot, Windsurf, Zed, Cline, Roo Code, Goose, Continue, JetBrains AI Assistant, Codex CLI.

Expected to work, unverified

These support remote MCP by their own documentation, but we have not run them against this server. They should need nothing beyond the generic recipe.

Amp (Sourcegraph)
Warp terminal
Trae
Qodo Gen
Sourcegraph Cody
LibreChat
Open WebUI
Msty
BoltAI
5ire
Witsy

If you get one working, or find that it does not, please open an issue. We would rather list it as verified than guess.

Known not to work

Anything that cannot set a request header. Without Authorization there is no way to identify your organisation, and the server has no anonymous mode by design.

If your client supports OAuth but not custom headers, it cannot connect today. The server publishes RFC 9728 Protected Resource Metadata at /.well-known/oauth-protected-resource with an empty authorization_servers list, so an OAuth authorization server can be added later without breaking any client already configured. That work is not done yet.