Connect to Sonar MCP

Sonar MCP supports stateless Streamable HTTP for remote clients and stdio for a local process. In both modes the server requires an explicit profile and the matching Sonar service identity.

Remote endpoint

The published Sonar MCP endpoint is:

POST https://mcp.astrixion.ai/mcp — stateless MCP requests; requires a client bearer token.
GET https://mcp.astrixion.ai/health — unauthenticated liveness check.

Missing or invalid MCP bearer credentials return 401. The token is operator-managed and is not published in these docs; obtain it through the team credential channel.

claude mcp add --transport http sonar https://mcp.astrixion.ai/mcp \
  --header "Authorization: Bearer <SONAR_MCP_TOKEN>"

Profile is fixed on the public endpoint

The public service runs the pentest profile. Inspect the tools returned by the connection rather than assuming an administrative surface.

Local stdio

Build apps/mcp-server, then configure a local client to launch its compiled entry point. The profile has no default: choose it explicitly and provide only its matching service token.

{
  "mcpServers": {
    "sonar": {
      "command": "node",
      "args": ["/absolute/path/to/apps/mcp-server/dist/index.js"],
      "env": {
        "BBM_BASE_URL": "http://localhost:3001",
        "BBM_MCP_PROFILE": "admin",
        "SONAR_SERVICE_TOKEN_ADMIN": "<SONAR_ADMIN_SERVICE_TOKEN>"
      }
    }
  }
}

Replace admin with a narrower profile and token whenever full administration is unnecessary. A stdio process does not use BBM_MCP_AUTH_TOKEN; access is controlled by who can launch and configure the local process plus the Sonar backend identity.

Operator configuration

Environment variable	Required	Purpose
`BBM_MCP_PROFILE`	Always	One of the seven fail-closed profile names.
`BBM_BASE_URL`	Optional	Sonar API origin; defaults to `http://localhost:3001`.
`SONAR_SERVICE_TOKEN_<PROFILE>`	Always	Matching backend service identity. Hyphens become underscores.
`BBM_MCP_AUTH_TOKEN`	HTTP	Client bearer token accepted by the MCP endpoint. Missing means the HTTP server refuses to start.
`BBM_MCP_HTTP_PORT`	HTTP	Listen port; defaults to `3005`.

pentest intentionally uses SONAR_SERVICE_TOKEN_RECON_EXECUTOR for its backend calls. The profile's explicit MCP allow-list is narrower than that service identity.

In the production Compose deployment, operators set MCP_AUTH_TOKEN; Compose passes the same secret value to the process as BBM_MCP_AUTH_TOKEN. Rotate that value and redeploy the MCP service to rotate the remote client credential.

After connecting

List the available tools and prompts; both are profile-specific.
If the target's program ID is unknown, call list_programs.
Call get_target_overview with the chosen program ID.
Page into the relevant asset tools or load the profile's skill prompt.

See Tool reference and Sonar guides.

Remote endpoint

Local stdio

Operator configuration

After connecting

On this page