CYBO Attest

app.ulapcyboPublished by ulapcybo.appOfficial publisherv1.0.2Updated Oct 26, 2026

Scan, fix and justify your application code until it is approved to ship.

VerifiedStreamable HTTPWeb executableCloud & InfrastructureDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Remote MCP server for CYBO Attest that lets an assistant inspect scan results, plan and start fixes, and justify findings until a build is approved to ship.

What you can do
  • Read security posture, applications, builds, scans, gates, findings, logs and assessor reviews
  • Get ordered fix plans, corrected Dockerfiles, approved base images and package upgrade guidance
  • Explain findings, gates, jobs and assessments, and draft justifications
  • Start scans, choose or apply a fixed Dockerfile, add and sync GitHub repositories, retry provisioning
  • Propose, withdraw and re-apply justifications, and request authorization for a version
  • Remove an application, with the client confirming first
When to use it
Use it when your team ships through the cDSO pipeline and you want an assistant to tell you what blocks a build, walk through fixes, rerun scans and prepare justifications without switching to the console. Approval or rejection of a build still happens in the console.
Requirements
A CYBO Attest account; the server is hosted remotely at attest.ulapcybo.app over Streamable HTTP, so nothing is installed locally. Sign-in is OAuth through the browser, and any MCP client supporting Streamable HTTP and OAuth works. Tools available depend on your roles and the access granted at sign-in.
Before you install
Every tool acts as you with your own roles and records your name and client, so changes such as starting scans, syncing repositories, requesting authorization, applying justifications or removing applications are real and attributed. Repository read tokens are entered only in the console, never as tool arguments. Findings and code context are sent to the hosted service and its Explainable AI features.

Installation

In SourceWeft

  1. Open CYBO Attest in the dashboard and add it to a workspace.
  2. Connect the required credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/app.ulapcybo%2Fattest/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "cybo-attest": {
      "type": "http",
      "url": "https://attest.ulapcybo.app/mcp"
    }
  }
}

README

CYBO Attest MCP server

CYBO Attest is the authorization console for applications built on the cDSO (Community DevSecOps) pipeline. Its MCP server lets you, your agents and your bots work with Attest from any MCP client: see what blocks each build, get an ordered plan to fix it, start scans, and justify findings that cannot be fixed, until the build is approved to ship.

This repository describes the server. The server itself is hosted by Ulap; there is nothing to install.

Server address: https://attest.ulapcybo.app/mcp (Streamable HTTP) Registry name: app.ulapcybo/attest Documentation: https://docs.ulapcybo.app/developer/connecting-an-ai-agent/

What it does

  • Security posture. The newest scan of every container: its verdict, the gates that fail, why it is blocked and the next action.
  • Fix plans. For one build, an ordered plan: the approved base image tag to rebuild on, the package versions to move to, and what must be fixed, with the failed job's log.
  • Findings. Every finding in full, the manifest line and commands that fix a vulnerable package, and Explainable AI answers on what a finding means for your application.
  • Scans. Start the scans of an application, follow its build and scans step by step, and read each scanner's evidence and job logs.
  • Applications. Add a GitHub repository, sync an application with its repository's newest commits, use Attest's corrected Dockerfile, and send a version toward review.
  • Justifications. Draft a justification for a finding that cannot be fixed, edit it, then propose it with a reason a Security Control Assessor can check.

Approving or rejecting a build stays with a Security Control Assessor in the console. No tool can do it.

Before you start

You need a CYBO Attest account at https://attest.ulapcybo.app. The MCP server signs you in through your browser with OAuth, and every tool acts as you, with your own roles: it can do exactly what you can do in the console, and nothing more. Every change records your name and the client you used.

Configure your client

VS Code with GitHub Copilot

Add the server to .vscode/mcp.json in your workspace (or to your user MCP configuration):

json
{  "servers": {    "cybo-attest": {      "type": "http",      "url": "https://attest.ulapcybo.app/mcp"    }  }}

Start the server from the file or the MCP servers list, then sign in when VS Code opens your browser. Use the tools from Copilot Chat in agent mode.

Claude Code

bash
claude mcp add --transport http cybo-attest https://attest.ulapcybo.app/mcp

Then run /mcp in Claude Code and choose CYBO Attest to sign in.

Other clients

Any MCP client that supports Streamable HTTP and OAuth can connect to https://attest.ulapcybo.app/mcp. The server publishes its sign in details at https://attest.ulapcybo.app/.well-known/oauth-protected-resource/mcp, so the client finds them on its own.

How to use it

Ask in plain language. For example:

  • "What is blocking my applications in CYBO Attest?"
  • "Make a plan to fix the newest build of my sample app, then fix the Dockerfile and dependencies."
  • "Explain this finding and tell me whether it can be fixed or must be justified."
  • "Start the scans again and tell me when they finish."
  • "Draft a justification for this finding so I can edit it."

A good order: get_security_posture to see what is blocked, plan_fixes for one build, fix the code, start_scan, then get_application_progress until the scans finish. Justify a finding only when it cannot be fixed.

Tools

The tools your client sees depend on your roles and the access you granted when you signed in.

Reading

ToolWhat it does
whoamiWho you are signed in as
get_security_postureThe newest scan of every container: verdict, failing gates, why it is blocked, next action
plan_fixesAn ordered plan to fix one build
list_applications, get_applicationYour applications, their components and sources
list_intake_applicationsApplications Attest provisioned for you
get_application_progressThe newest build and scans, step by step
get_application_configThe cDSO configuration Attest commits
get_dockerfile_fixYour Dockerfile and Attest's corrected one
list_authorization_candidatesVersions that can be sent toward authorization
get_github, list_github_repositoriesWhether GitHub is connected, and the repositories it reaches
list_justificationsJustifications, active and withdrawn
console_linkThe console page for work done only in the console
list_scans, find_scans, get_scanScans, their steps, gates and verdict
list_findings, get_finding, get_finding_changeFindings and how to fix a vulnerable package
explain_finding, draft_justificationExplainable AI on a finding, and a draft justification
explain_gate, explain_gate_controls, explain_job, explain_assessmentExplainable AI on gates, their controls, failed jobs and a scan's impact assessment
list_scan_runs, list_scan_jobs, get_scan_job_logPipeline runs, jobs and logs
list_base_images, list_base_image_tagsApproved base images and their tags
get_scan_evidence, get_scan_artifact, get_scan_sourceScanner records, published files, and files of the scanned repository
get_decision, get_review, get_review_summaryDecisions and the assessor's review

Changing

ToolWhat it does
start_scanStart the scans of an application
choose_dockerfile, use_fixed_dockerfilePick the Dockerfile, or build with Attest's corrected one
add_github_repositoryAdd a GitHub repository as an application
sync_applicationBring an application up to its repository's newest commits
retry_provisioningResume a failed provisioning
request_authorizationTag a version and send it toward review
propose_justification, withdraw_justification, apply_justificationsJustify a finding, withdraw a justification, commit them again
remove_applicationRemove an application (your client asks you first)

The server also offers two prompts, fix_blocking_findings and security_posture_report, and two resources: the API contract and a reference of scanners, gates and terms.

Security

  • Repository read tokens are never tool arguments, so they never pass through a model. You enter them only in the console.
  • Tokens are checked on every call against your organization and roles.
  • Privacy: https://ulapcybo.app/privacy

Support

Questions and access requests: [email protected]

Source: README.md at commit a2b869a

Tools

0
This server asks you to sign in, so SourceWeft could not read its tools without an account and has not indexed them. What a connected account sees can depend on that account and its permissions.

Version history

3
  1. v1.0.2LatestOct 21, 2026
  2. v1.0.1Oct 19, 2026
  3. v1.0.0Oct 19, 2026

Score

75% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.