Fortify ScanCentral DAST Skill

Fortify ScanCentral DAST (SC-DAST) integration via Model Context Protocol (MCP).

When to Use This Skill

• Run dynamic application security testing (DAST) scans
• List and monitor scan status
• Pause/resume running scans
• Discover available scan settings and policies
• Manage scan sensors and sensor pools
• View scan results in SSC using SSC skill

Available MCP Tools

Only key MCP tools for SC-DAST are listed here.

Parameter Formats

Authentication

SC-DAST uses SSC authentication (simplest authentication model - no additional tokens required).

Session Check: Always check SSC session status before SC-DAST operations:

Tool: fcli_ssc_session_list
Parameters: { "refresh-cache": true }

If session expired or missing:
Ask the user to run this command locally in their terminal:

fcli ssc session login --url <SSC_URL> -u <username> -p <password>

Default Session:
If the user doesn't specify a session name, inform them that the default session will be used.

Domain-Specific Guidance: Scan Workflow

SC-DAST scans follow a straightforward workflow:

Phase 1: Discovery

• List available scan settings: scan_settings_list
• List available scan policies: scan_policy_list
• Get specific settings/policy details if needed

Phase 2: Start Scan

Start scan with required parameters:

• --settings (CICD token or ID) - REQUIRED
• --name (scan name) - REQUIRED
• --policy (policy name or ID) - optional
• --overwrite-scan-mode or --priority-scan-mode (boolean flags, mutually exclusive) - optional
• --login-macro (login macro ID) - optional

Important: Ensure scan settings are configured to automatically publish results to SSC. This is typically configured in the scan settings by the administrator.

Phase 3: Monitor Progress

• Use scan_wait_for with --until: "status=Complete" or --while: "status=Running"
• Use scan_list with --server-queries: "status=Running" to check all running scans
• Unique capability: Use scan_pause and scan_resume to control scan execution

Phase 4: View Results

• Once scan completes, findings automatically appear in SSC (if configured)
• View findings in SSC using SSC skill (fcli_ssc_issue_list, fcli_ssc_issue_count, etc.)

Filtering

SC-DAST supports both server-side and client-side filtering:

Server-Side Filtering (Preferred): Use --server-queries parameter with key-value pairs:

• Single filter: "status=Running"
• Contains match: "name~MyApp"
• Multiple filters: "status=Complete,name~Security"

Client-Side Filtering: Use query parameter for complex filtering with SpEL (Spring Expression Language):

query: "status == 'Complete' && scanVersion > 5"

When to use each:

• Server-side (--server-queries): Preferred for performance, especially with large datasets
• Client-side (query): Use for complex expressions not supported by server-side filtering

Pagination

SC-DAST uses job_token-based pagination (same pattern as SSC):

When pagination.totalRecords is null:

1. Call fcli_sc_dast_mcp_job:

   Parameters: {
     "operation": "wait",
     "job_token": "<job_token from previous response>"
   }
   

2. After job completes, retry the original list call to get results.

Example Flow:

1. Call scan_list → Response has totalRecords: null, job_token: "abc123..."
2. Call mcp_job with operation: "wait", job_token: "abc123..."
3. Retry scan_list → Response now has full results with totalRecords populated

Error Recovery

Decision Tree: Choosing the Right Approach

Best Practices

DO:

• ✅ Always check SSC session status before SC-DAST operations
• ✅ Use discovery workflow (list settings/policies) before starting scans
• ✅ Use server-side filtering (--server-queries) for performance
• ✅ Ensure scan settings are configured to auto-publish to SSC
• ✅ Use scan_wait_for with appropriate timeouts for long-running scans (typically 30min-2hrs)
• ✅ Leverage pause/resume capability for scan management
• ✅ Use CICD token for scan settings in automation scenarios
• ✅ Handle pagination with job_token pattern when totalRecords is null
• ✅ View results in SSC using SSC skill after scan completes

DO NOT:

• ❌ Start scans without verifying settings/policy existence
• ❌ Use client-side filtering for large datasets (prefer --server-queries)
• ❌ Poll scan status manually - use scan_wait_for instead
• ❌ Forget to verify scan settings are configured to publish to SSC
• ❌ Ignore pagination when totalRecords is null

References

Example Workflows

External Resources

• FCLI Documentation
• SC-DAST User Guide