Be the first to get access to new connectors. Get early access →
ConnectorBay Early access

Cobalt (BYOK) — connector documentation

  • MCP endpoint: https://byok-cobalt.connectorbay.com/mcp
  • REST API: POST https://byok-cobalt.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://byok-cobalt.connectorbay.com/openapi.json
  • Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
  • Authentication: your own Cobalt Cobalt personal API token, sent in the X-Upstream-Key header and the Cobalt organisation token (the token field of your organisation from the /orgs endpoint) in X-Upstream-Key-2 of every request (never stored, logged or cached)
  • Health: https://byok-cobalt.connectorbay.com/health · Tool schemas: https://byok-cobalt.connectorbay.com/tools.json
  • Publisher: Unify Dynamics LLC · connectorbay.com/byok-cobalt · agent@connectorbay.com

What Cobalt (BYOK) is for

Cobalt (BYOK) lets an AI assistant read your own Cobalt data through the Cobalt API with a key you supply (Cobalt personal API token). Read-only: 11 tools (list_assets, list_pentests, list_findings, list_engagements, get_attack_surface_stats, get_credit_balance, list_contracts, list_credit_transactions, list_dast_targets, list_dast_scans, list_dast_findings). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to api.us.cobalt.io, api.eu.cobalt.io. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Cobalt. Cobalt and its logos are trademarks of their owners and are used only to say which service the connector works with.

Ask your assistant things like:

  • "Which assets does my organisation have in Cobalt?"
  • "Which of my Cobalt pentests are live?"
  • "What high severity findings do my Cobalt pentests have?"
  • "What code review engagements are running in Cobalt?"
  • "How many domains and hosts does Cobalt see on my attack surface?"
  • "How many Cobalt credits do we have left?"

What it does

  • list_assets: List the organisation's assets (the things pentested): title, type, technology stack and tags. Filter by asset type.
  • list_pentests: List pentests with title, asset, testing type (agile or comprehensive), methodology, start and end dates and state (new, in_review, planned, cancelled, live, remediation, closed).
  • list_findings: List pentest findings with title, severity, state, vulnerability category, affected targets, CVSS and CVE/CWE references. Filter by pentest, asset, state, severity or date.
  • list_engagements: List engagements such as secure code reviews with type, tag, title, methodology, state, dates and linked asset ids.
  • get_attack_surface_stats: Show attack surface counts for the organisation: total domains, hosts seen in the last 7 days and hosts first seen in the last 7 days.
  • get_credit_balance: Show the organisation's current Cobalt credit balance.
  • list_contracts: List contracts with start and end date, state and total, spent and unused credits.
  • list_credit_transactions: List credit transactions with description, amount, date and whether pending, plus the current balance.
  • list_dast_targets: List DAST scanner targets with name, URL and whether enabled.
  • list_dast_scans: List DAST scans with target id, status and start and completion time.
  • list_dast_findings: List DAST findings with title, severity, state, affected URL and last-found time. Filter by target or scan id.

BYOK key

You bring your own Cobalt Cobalt personal API token (https://docs.cobalt.io/articles/create-a-personal-cobalt-api-token-LT9Nl8EAVR). Your assistant sends it in the X-Upstream-Key header with each request. ConnectorBay uses it for that one call only: it is never stored, logged or cached, never shown in an answer, and it is only sent to api.us.cobalt.io, api.eu.cobalt.io over https, with no redirects followed. Create a key with the fewest permissions the tools need (read-only if the provider offers it), and revoke it at the provider whenever you like.

Data sources

Live from the Cobalt API (api.us.cobalt.io, api.eu.cobalt.io) with a BYOK key; documentation: https://cobalt-public-api.netlify.app/v2/. Endpoints checked against that documentation on 2026-10-16.

What it is not

Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Cobalt. Cobalt and its logos are trademarks of their owners and are used only to say which service the connector works with. It is read-only: it never creates, changes, sends or deletes anything in your Cobalt account.

Built for: Worldwide. Languages: English.