Getting started

RingZero is a single service for your source code’s security needs: MCP server security for your AI agents, AI-driven penetration testing, supply chain analysis, and continuous security scanning of the infrastructure you own. These docs cover the three integration surfaces you run yourself — the AI pentesting itself runs inside the app against your registered hosts and needs no integration work beyond the sidecar.

Prerequisites

• A RingZero organization (app.ringzero.tech). If your company already has one, ask an org admin to invite you. (Exception: the MCP scanner CLI runs fully local with no account — an org only adds attribution and uploads.)
• The Admin (or Owner) role for issuing credentials — API keys and registration tokens. Members and Auditors can view scan results but cannot create credentials. See user roles.

The three integration surfaces

Surface	What it does	Credential	Where to start
MCP security CLI	Scans repos and machines for MCP server configs, checks each server (typosquats, secrets, scope, pinning), enforces your org allowlist, and audits agent usage	None for local scanning; API key with mcp:upload to sync results	MCP security overview, then the scanner CLI
Supply chain scanning	Uploads a dependency snapshot from your build; RingZero resolves the graph against CVE/GHSA advisories and produces findings	Scoped API key (rz_key_…)	Gradle plugin or the REST API
Security scanning sidecar	Runs next to your application, registers the host with your org, and keeps it eligible for scanning via heartbeats	Registration token (rz_reg_…)	How it works, then automated or manual setup and the per-stack deployment guides

They’re independent — you can adopt any of them first. They compound: supply chain findings steer the AI pentest agents toward the attack surface where a known-vulnerable package is actually reachable on your registered hosts.

Scanning internal or private infrastructure (a VPC with no ingress, an on-prem network, ClusterIP-only Kubernetes services)? You don’t expose anything to the internet — gateway mode runs both registration and scanning over a single outbound tunnel via a deployed Scan Gateway.

Where credentials live

Both credential types are issued inside the app (by an Admin or Owner) and shown once at creation:

• API keys — Settings → API keys. Used by build integrations and direct API calls. Prefix rz_key_. Every key carries an explicit scope list and a project restriction fixed at creation — no key has org-wide access.
• Registration tokens — Settings → Hosts → Registration tokens. Used only by the sidecar to register hosts — they can’t read anything. Per-org, expiring, revocable. Prefix rz_reg_.

The full access model — user roles, key scopes, and how every request is authorized — is on Authentication & permissions.

Caution

Treat both like passwords: store them in your CI secret store or a secrets manager, never in source control. Every page in these docs shows the secure way to provide them for that context.

The API at a glance

All integrations talk to the same REST API:

Base URL   https://api.ringzero.tech/v1
Auth       Authorization: Bearer <credential>
Format     JSON request and response bodies
Times      ISO-8601 UTC timestamps (e.g. 2026-07-19T14:02:00Z)

The API is versioned in the path (/v1). Breaking changes only ever ship as a new version prefix. Errors, rate limits, pagination, and the full endpoint index live in API conventions.

Next steps

Scan your MCP servers Run ringzero-mcp against your repos, bootstrap the org allowlist, and wire up usage auditing.

Scan your Gradle build Apply the plugin, provide your API key securely, and gate builds on policy.

Register your first host Skim how registration works, then deploy the sidecar with a downloaded config bundle.