Open a session
Start with open_session and carry the returned session ID through every stateful MCP method.
Premium MCP mode
Local MCP for agent workflows while the app is active.
Veridicus Scan includes a premium, local, foreground, session-based MCP surface. Use it when an agent should
run scan_text, scan_url, scan_file, or scan_repo, retrieve a report,
or guard a risky plan or action while the app runtime is active.
Core flow
The MCP path is explicit and session-based.
The bridge does not hide state. Open a session, run the local tools you need, then close the session. That keeps the automation surface close to the app’s trust model instead of turning it into an unbounded background service.
Run scans or guardrail methods
Choose scan_text, scan_url, scan_file, or scan_repo, then use report or runtime-guard methods needed for the current task.
Close the session cleanly
Call close_session when the workflow finishes. The current local policy allows one active session at a time.
Method families
The MCP feature goes beyond scan-and-return.
The bridge exposes source-specific scan methods, report surfaces, and runtime guards. Method names stay explicit so an agent can choose the narrowest input path and preserve the returned policy scope.
Scan sources
scan_textfor prompts, snippets, or extracted textscan_urlfor a user-chosen public HTTPS destinationscan_filefor one local artifactscan_repofor bounded repository intake
Reports and context
get_reportfor the current reviewed resultexport_reportfor JSON or PDF handoff- Evidence snippets are redacted by default on the applicable sanitized report path
- Coverage notes travel with bounded or partial results
Runtime guardrails
scope_toolsestablishes the authoritative tool scopeguard_planevaluates a proposed plangate_actionevaluates a specific tool action
What it is and is not
MCP adds automation without turning the app into a hosted gateway.
MCP lets Veridicus Scan participate in agent execution and memory flows while keeping the same local runtime boundary: foreground, session-based, and designed to stay inside the app instead of becoming an always-on remote service.
Runs inside the local foreground model
The bridge is designed for on-device use while the app or local runtime is active, not as a permanent hosted gateway.
Repository scanning is an intake guard, not a complete verdict
scan_repo uses bounded traversal and repo-aware signals before an agent reads or installs from a repository. It does not claim to replace a full code or dependency security review.
MCP is treated as a premium capability
The core MCP methods are premium-protected because they turn the app into an active agent-runtime component. Entitlement and localized pricing are handled through StoreKit rather than a hardcoded site price.
Next step
Bring MCP into agent workflows, trust decisions, and exported reports.
Move from the automation surface into use cases, MCP security guidance, best-practices guidance, trust boundaries, exported evidence, or OpenClaw intake safety.