Run QA and security audits from your coding agent
AuditWard ships a native MCP server for Claude Code, Claude Desktop, and any client that speaks MCP over Streamable HTTP. One call starts a full QA and security scan of a URL you're authorized to test. The evidence comes back as findings, screenshots, and a PDF report.
Set up in three steps.
Create an MCP token in the dashboard under Settings → API & MCP. The token is shown once, so copy it when it appears.
Register the server with your client. For Claude Code, run the command below with your token.
Ask your assistant to test something. For example: "run a QA scan of https://staging.example.com and summarize the findings". It starts the scan, polls progress, and reports back.
claude mcp add auditward --transport http https://platform-api.auditward.com/mcp/ \
--header "Authorization: Bearer YOUR_MCP_TOKEN"Or connect with OAuth
Clients that support OAuth-based MCP connections (such as Claude Desktop custom connectors) can skip manual tokens: add a connector with the URL https://platform-api.auditward.com/mcp/ and you will be redirected to AuditWard to sign in and approve access. Approved connections appear as revocable grants tied to your account.
Six tools, one audit workflow.
qa_testStart a full QA and security scan of a URL (asynchronous).qa_statusCheck progress, checklist state, and findings of a scan session.qa_get_artifactsFetch presigned URLs for screenshots, videos, and reports.qa_provide_contextAnswer questions from a paused scan, such as login credentials.qa_cancelCancel a running scan.qa_reportGenerate the PDF report for a completed session.What you get back
qa_get_artifacts returns presigned URLs for screenshots and videos from the browser session. qa_report generates the pentest-style PDF report. Every scan also has a live dashboard you can open in the browser to watch the screenshot feed and checklist progress.
The credential loop
Your agent starts a scan of an authenticated app. When the scan hits a login wall or needs context, it pauses with structured questions. Answer with qa_provide_context (or in the dashboard) and the scan resumes. Answers are encrypted before storage.
Not raw browser automation
Raw browser-automation MCP servers hand your agent low-level page control, burn its context window on DOM state, and return no judgment. AuditWard plans the checklist, drives the browser and security tooling itself, and returns triaged, severity-ranked, compliance-tagged findings with evidence.
Auth and availability
The server is secured with OAuth 2.0 client registration, authorization-code flow with PKCE, and refresh tokens; manual tokens are managed in the dashboard. MCP access is included on Starter, Team, and Business plans. Scans started over MCP count against your plan quota and may incur overage, and they require the same target authorization as dashboard scans.
MCP questions.
Which MCP clients are supported?
Any client that speaks MCP over Streamable HTTP, including Claude Code, Claude Desktop (custom connectors), and your own tooling built on the MCP SDKs.
Is MCP on the free plan?
No. MCP access is included on the Starter, Team, and Business plans.
Can the agent scan localhost?
No. Scans run against public URLs you are authorized to test, with the same domain verification and authorization rules as dashboard scans.
How are credentials handled?
Answers to a paused scan's credential questions are encrypted before storage and are never stored in plaintext.