Heist API and MCP
Read findings, retrieve evidence and request retests from your coding agent or your own software. Connect Heist to your issue tracker to send findings to your team and retest closed issues.
Connect your coding agent with MCP
In Claude Code, add Heist with the command below. Complete the sign-in flow and select your Heist workspace. Your agent uses the permissions of the connected account.
claude mcp add --transport http heist https://api.heisthq.com/mcpFor other MCP clients, add https://api.heisthq.com/mcp as a remote Streamable HTTP server and authenticate with your Heist account.
Example request to your agent
“Read the high-priority findings in Heist. Use the evidence to prepare a fix for review. After I deploy it, request a retest.”
- list_findings
- Find published issues by severity, status or search text.
- get_finding
- Read impact, evidence, recommendations and the affected application or route.
- finding_counts
- Check open, closed and accepted findings in your workspace.
- retest_finding
- Request a retest after a fix has been deployed. Requires an editor or admin role.
Use the REST API
The REST API exposes workspace findings, applications and retest actions. Requests require a valid Heist user/MCP access token or a supported app access token. Workspace permissions apply.
curl --header "Authorization: Bearer $HEIST_ACCESS_TOKEN" \
https://api.heisthq.com/external/findingsUse a valid access token for HEIST_ACCESS_TOKEN. The authenticated OpenAPI specification documents parameters, schemas and available operations:
https://api.heisthq.com/external/openapi.jsonYour MCP client can also read the specification through the external_api_openapi resource.
Connect repositories, issue trackers and Slack
Sync vulnerabilities to your issue tracker and trigger retests when issues close. Connect repositories for whitebox testing, and use Slack for findings above your chosen severity threshold.
See supported integrations and what’s included →