# runZero MCP

This MCP server gives AI agents access to runZero queries, keeps a local SQLite view of the attack surface, and tracks changes over time.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed · ★ 63
- Author: Servosity
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/Servosity/msp-skills/tree/HEAD/skills/runzero
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/runzero-mcp

## What it does

runZero MCP exposes runZero queries to an AI agent and keeps a local SQLite copy of the full attack surface. The local data can be sliced again without using API quota, compared across time, and joined with vulnerability records while offline. Authentication with runZero is required after installation.

The package includes `runzero-cli`, `runzero-mcp`, and `SKILL.md`, which lets Claude Code, Codex, and Claude Cowork discover the skill. The installer supports macOS, Linux, and Windows PowerShell. MCP connections are also listed for Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, and Zed.

Use the default stdio transport. In this build, HTTP mode has no password and is exposed through network interfaces, so a web page can reach the server. That makes HTTP unsuitable even on localhost and matters before you connect a remote agent.

## Requirements
- Environment variables: `RUNZERO_API_KEY`, `RUNZERO_BASE_URL` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Install**
- The MCP registry has no launch command for it: see the repository README

## When to use it
- run runZero queries through an AI agent
- keep an attack-surface snapshot in SQLite
- compare infrastructure changes over time
- join assets with vulnerabilities offline
- avoid spending API quota on repeated slicing

## Example prompts
- Compare the latest attack-surface snapshots and summarize what changed.
- Find assets linked to vulnerabilities in the local SQLite data.
- Run a runZero query and group the results by asset.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [GitHub](https://affpapa.org/en/nevibecode/mcp/github.md) — MCP server · ★ 33989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [Netdata](https://affpapa.org/en/nevibecode/mcp/netdata.md) — MCP server · ★ 81163
- [Front-End Checklist](https://affpapa.org/en/nevibecode/mcp/front-end-checklist.md) — MCP server · ★ 74569
- [Scrapling MCP Server](https://affpapa.org/en/nevibecode/mcp/scrapling-mcp-server.md) — MCP server · ★ 89899

From the same set: [servosity/msp-skills](https://affpapa.org/en/nevibecode/by/servosity/msp-skills.md) — 73 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md