Be the first to get access to new connectors. Get early access →
ConnectorBay Early access

Manifest Cyber (BYOK) — connector documentation

  • MCP endpoint: https://byok-manifestcyber.connectorbay.com/mcp
  • REST API: POST https://byok-manifestcyber.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://byok-manifestcyber.connectorbay.com/openapi.json
  • Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
  • Authentication: your own Manifest Cyber Manifest API token (with read scopes for what you query), sent in the X-Upstream-Key header of every request (never stored, logged or cached)
  • Health: https://byok-manifestcyber.connectorbay.com/health · Tool schemas: https://byok-manifestcyber.connectorbay.com/tools.json
  • Publisher: Unify Dynamics LLC · connectorbay.com/byok-manifestcyber · agent@connectorbay.com

What Manifest Cyber (BYOK) is for

Manifest Cyber (BYOK) lets an AI assistant read your own Manifest Cyber data through the Manifest Cyber API with a key you supply (Manifest API token (with read scopes for what you query)). Read-only: 12 tools (get_stats, list_assets, list_most_impacted_assets, list_components, list_sboms, list_suppliers, get_supplier_stats, get_supplier_overview, list_supplier_vulnerabilities, search_inventory, list_vulnerabilities, list_vulnerability_feed). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to api.manifestcyber.com. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Manifest Cyber. Manifest Cyber and its logos are trademarks of their owners and are used only to say which service the connector works with.

Ask your assistant things like:

  • "How many assets, components and vulnerabilities does Manifest track for us?"
  • "Which assets in Manifest have critical vulnerabilities?"
  • "Which assets are most impacted by vulnerabilities in Manifest?"
  • "Which components of this asset does Manifest know about?"
  • "Which SBOMs have been uploaded to Manifest recently?"
  • "Which suppliers carry the most risk in Manifest?"

What it does

  • get_stats: Show the organization's totals: assets, components, SBOMs and vulnerabilities.
  • list_assets: List assets (applications, containers, libraries) with version, type, SBOM format and vulnerability counts by severity. Paged and filterable.
  • list_most_impacted_assets: List the assets with the most vulnerabilities, with severity counts. Paged and filterable like list_assets.
  • list_components: List software components (package URL, version, ecosystem, licenses) across the organization, optionally for one asset or package URL. Paged.
  • list_sboms: List SBOM records (metadata, not contents) with asset, version, format, source and processing dates. Paged; optional asset and text filter.
  • list_suppliers: List third-party suppliers with asset count, worst risk band and summed vulnerability counts (including known-exploited). Paged; name search and sort.
  • get_supplier_stats: Show organization-wide supplier totals: suppliers, high-risk suppliers, third-party assets and vulnerabilities.
  • get_supplier_overview: Show one supplier's risk band, asset count, vulnerability counts and number of high-risk assets.
  • list_supplier_vulnerabilities: List vulnerabilities across a supplier's assets, deduplicated by CVE, ranked by recommended action then CVSS, with EPSS and known-exploited flag. Paged.
  • search_inventory: Search assets, components and vulnerabilities by text, for example a CVE id or package name.
  • list_vulnerabilities: Look up CVEs in Manifest's vulnerability catalog (not limited to your assets) with CVSS and EPSS scores. Paged; optional list of CVE ids.
  • list_vulnerability_feed: List the latest 10 published vulnerabilities with severity and how many of your assets they affect.

BYOK key

You bring your own Manifest Cyber Manifest API token (with read scopes for what you query) (https://docs.manifestcyber.com/docs/creating-api-keys.md). Your assistant sends it in the X-Upstream-Key header with each request. ConnectorBay uses it for that one call only: it is never stored, logged or cached, never shown in an answer, and it is only sent to api.manifestcyber.com over https, with no redirects followed. Create a key with the fewest permissions the tools need (read-only if the provider offers it), and revoke it at the provider whenever you like.

Data sources

Live from the Manifest Cyber API (api.manifestcyber.com) with a BYOK key; documentation: https://api-docs.manifestcyber.com/. Endpoints checked against that documentation on 2026-10-16.

What it is not

Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Manifest Cyber. Manifest Cyber and its logos are trademarks of their owners and are used only to say which service the connector works with. It is read-only: it never creates, changes, sends or deletes anything in your Manifest Cyber account.

Built for: Worldwide. Languages: English.