Be the first to get access to new connectors. Get early access →
ConnectorBay Early access
Discover
Cobalt (BYOK) icon

Cobalt (BYOK)

Read your Cobalt pentest assets, pentests, findings, engagements, DAST scans and credit balance with your own API token and organisation token

Unify Dynamics LLC

Tools11read-only
Sign-inBYOKbring your own key
Key keptNeverused for one call only
PriceFreeoptional Pro limits
ProviderCobaltunofficial, not affiliated
Works withMCP · RESTany agent

Try asking

Real questions, and the tools your agent calls to answer them.

Which assets does my organisation have in Cobalt?
Tools called
list_assets
Which of my Cobalt pentests are live?
Tools called
list_pentests
What high severity findings do my Cobalt pentests have?
Tools called
list_findings
What code review engagements are running in Cobalt?
Tools called
list_engagements
How many domains and hosts does Cobalt see on my attack surface?
Tools called
get_attack_surface_stats
How many Cobalt credits do we have left?
Tools called
get_credit_balance

About

Cobalt (BYOK) lets an AI assistant read your own Cobalt data through the Cobalt API with a key you supply (Cobalt personal API token). Read-only: 11 tools (list_assets, list_pentests, list_findings, list_engagements, get_attack_surface_stats, get_credit_balance, list_contracts, list_credit_transactions, list_dast_targets, list_dast_scans, list_dast_findings). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to api.us.cobalt.io, api.eu.cobalt.io. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Cobalt. Cobalt and its logos are trademarks of their owners and are used only to say which service the connector works with.

Sources: Live from the Cobalt API (api.us.cobalt.io, api.eu.cobalt.io) with a BYOK key; documentation: https://cobalt-public-api.netlify.app/v2/. Endpoints checked against that documentation on 2026-10-16.

Privacy

The publisher, Unify Dynamics LLC, states that tool inputs are processed in memory and not retained.

Data not collectedNo account, no profile, no stored prompts or results.

What it can do

11 tools, grouped by job. Every one is read-only or compute-only.

OpenAPI
Read your data11 tools
  • List assetsList the organisation's assets (the things pentested): title, type, technology stack and tags.
  • List pentestsList pentests with title, asset, testing type (agile or comprehensive), methodology, start and end dates and state (new, in_review, planned,…
  • List findingsList pentest findings with title, severity, state, vulnerability category, affected targets, CVSS and CVE/CWE references.
  • List engagementsList engagements such as secure code reviews with type, tag, title, methodology, state, dates and linked asset ids.
  • Get attack surface statsShow attack surface counts for the organisation: total domains, hosts seen in the last 7 days and hosts first seen in the last 7 days.
  • Get credit balanceShow the organisation's current Cobalt credit balance.
  • List contractsList contracts with start and end date, state and total, spent and unused credits.
  • List credit transactionsList credit transactions with description, amount, date and whether pending, plus the current balance.
  • List dast targetsList DAST scanner targets with name, URL and whether enabled.
  • List dast scansList DAST scans with target id, status and start and completion time.
  • List dast findingsList DAST findings with title, severity, state, affected URL and last-found time.

Information

PublisherUnify Dynamics LLC
CategorySafety
LanguagesEnglish
Built forWorldwide
CompatibilityAny MCP client · any agent · REST
Version0.1.0
MCP endpointhttps://byok-cobalt.connectorbay.com/mcp
REST APIopenapi.json
SupportGet help · Status
CountryWorldwide
FunctionOther
LayerDeep connectors

More like this

More in Other

Make (BYOK)

Read your Make (make.com) organizations, teams, scenarios, execution logs and usage with BYOK (read scopes)

Live · MCP + REST9 tools

Pinecone (BYOK)

Read your Pinecone vector indexes, collections, backups and restore jobs (control plane only, no vectors) with BYOK

Live · MCP + REST9 tools

Mailgun (BYOK)

Read your Mailgun sending domains, delivery events, stats, bounces, complaints and unsubscribes with BYOK (US region, read-only)

Live · MCP + REST10 tools

SonarCloud (BYOK)

Read your SonarQube Cloud (SonarCloud) projects, issues, measures, branches and analyses with BYOK

Live · MCP + REST8 tools

Snyk (BYOK)

Read your Snyk organizations, projects, targets and security issues with BYOK (Enterprise plan)

Live · MCP + REST8 tools

Codecov (BYOK)

Read your Codecov repositories, commits, pull requests, branches and coverage totals and trends with BYOK

Live · MCP + REST10 tools

Get Cobalt (BYOK)

Free · BYOK · Read-only

BYOK: bring your own keyThis connector uses your own Cobalt Cobalt personal API token. Create one at https://docs.cobalt.io/articles/create-a-personal-cobalt-api-token-LT9Nl8EAVR, with the fewest permissions it needs (read-only if the provider offers it). Your assistant sends it in the X-Upstream-Key header with every request. It is used for that one call only: never stored, logged or cached, and only ever sent to Cobalt. Revoke it at the provider whenever you like. Unofficial connector: not affiliated with Cobalt.