Getting started

Start with MCP configuration checks or supply chain scanning. Gradle builds support large monorepos, team attribution, and custom module labels. The host-scanning sidecar, Scan Gateway, and AI pentesting are planned; those guides describe the proposed integration.

Prerequisites

• A RingZero organization (app.ringzero.tech). If your company already has one, ask an org admin to invite you. Local MCP checks and Gradle/npm dependency reports need no account. Uploads require an organization; SCA advisory matching runs server-side.
• The Admin (or Owner) role for issuing API keys. Members and Auditors can view scan results but cannot create credentials. See user roles.

The three integration surfaces

Surface	What it does	Credential	Where to start
MCP security CLI	Scans repos and machines for MCP server configs, checks each server (typosquats, secrets, scope, pinning), enforces your org allowlist, and audits agent usage	None for local scanning; API key with mcp:upload to sync results	MCP security overview, then the scanner CLI
Supply chain scanning	Matches resolved dependency versions against advisories; Gradle scans also show introducing modules, affected consumers, and team labels	None for local dependency reports; API key with sca:upload for advisory matching	Gradle plugin, npm CLI, or the REST API
Security scanning sidecar (coming soon)	Planned host registration and heartbeats for authorized security scanning	Registration token (rz_reg_…, planned)	Proposed integration

MCP and supply chain scanning can be adopted independently. Using dependency findings to guide AI pentest agents on registered hosts is planned.

Scanning internal or private infrastructure (a VPC with no ingress, an on-prem network, ClusterIP-only Kubernetes services)? You don’t expose anything to the internet in the proposed gateway mode: registration and scanning would use an outbound tunnel through a Scan Gateway. This is a coming-soon integration.

Where credentials live

API keys are issued inside the app (by an Admin or Owner) and shown once at creation:

• API keys — Settings → API keys. Used by build integrations and direct API calls. Prefix rz_key_. Every key carries an explicit scope list and a project restriction fixed at creation. A key can cover all projects or a specific list, but its actions remain limited by its scopes.
• Registration tokens (planned) will support the coming-soon host registration flow.

The full access model — user roles, key scopes, and how every request is authorized — is on Authentication & permissions.

Caution

Treat credentials like passwords: store them in your CI secret store or a secrets manager, never in source control. Every page in these docs shows the secure way to provide them for that context.

The API at a glance

All integrations talk to the same REST API:

Base URL   https://api.ringzero.tech/v1
Auth       Authorization: Bearer <credential>
Format     JSON request and response bodies
Times      ISO-8601 UTC timestamps (e.g. 2026-07-19T14:02:00Z)

The API is versioned in the path (/v1). Breaking changes only ever ship as a new version prefix. Errors, rate limits, pagination, and the full endpoint index live in API conventions.

Next steps

Scan your MCP servers Run ringzero-mcp against your repos, bootstrap the org allowlist, and wire up usage auditing.

Scan your Gradle build Scan the build or individual modules, add team labels, and review introducing dependencies.

Plan host security scanning Review the proposed sidecar and gateway integration. Coming soon.