read thedocs.

CyberCNS — now branded ConnectSecure — is a vulnerability-management and attack-surface platform built for MSPs. It scans your managed companies for vulnerabilities, inventories assets and installed software, monitors external attack surface, runs compliance assessments, and reports on Active Directory and Azure posture. StackJack connects to its V4 API.

Connecting CyberCNS to StackJack gives your AI assistant a family of 295 cns_ MCP tools — MCP (Model Context Protocol) tools are the standardized commands an AI assistant can call through StackJack. With them, your AI can:

• Inventory managed companies, agents, assets, installed software, hardware detail, firewall configuration, ports, and certificates
• Assess vulnerabilities, attack-surface findings, compliance posture, and security baselines across your clients
• Report on remediation plans and velocity, problem summaries, and AD/Azure directory posture through the built-in report queries
• Manage (on Pro plans) companies, credentials, discovery settings, scan schedules, tags, EDR and PII settings, integrations, and vulnerability suppressions
• Build (on Pro plans) standard report jobs and manage report templates and cover pages

How StackJack authenticates to CyberCNS

CyberCNS V4 uses a bespoke token exchange rather than standard OAuth. You provide three things — your Tenant Name, a Client ID, and a Client Secret — and StackJack presents them to your pod's authorize endpoint to receive a short-lived access token. StackJack caches that token and re-mints a fresh one automatically when it expires. There is no refresh token and nothing for you to rotate beyond the API key itself.

The Client ID and Client Secret are a per-user API key: in ConnectSecure you create it under Settings → Users → (select a user) → API Key. Every tool call runs with that user's permissions — a 403 from a tool means the key's user lacks access to that resource, not an account-wide block. Create the key on a user whose access matches what you want your AI to see and do.

Your pod host

CyberCNS has no single global address — each tenant lives on a numbered pod (for example https://pod401.myconnectsecure.com), which you can read from your browser's address bar while signed in to ConnectSecure. On-premises installations use your own ConnectSecure host with the same API. You enter this host as the Pod URL; it must match where the API key was created.

Before you begin

• In StackJack: you need a role that can manage connectors (tenant Owner, a co-owner, or an Administrator).
• In ConnectSecure: access sufficient to view Settings → Users and create an API key for a user.
• Know your pod host — the https://podNNN.myconnectsecure.com (or on-prem) address shown in the portal.

Step 1 — Find your pod host and tenant name

1. Sign in to ConnectSecure.
2. Note the host in your browser's address bar — that is your Pod URL (for example https://pod401.myconnectsecure.com).
3. Note your Tenant Name — the account/company identifier your ConnectSecure account is known by. It is the first component of the API authorization and is required.

Step 2 — Create an API key

1. Go to Settings → Users.
2. Select the user the API should act as. Prefer a dedicated user whose access matches what you want your AI to do, rather than a personal admin login.
3. Open the API Key section and generate a key. This yields a Client ID and Client Secret. The key inherits that user's permissions.

Step 3 — Add the credentials in StackJack

1. In the StackJack portal, open Connectors.
2. Find the CyberCNS (ConnectSecure) card. Click How To Connect for the same steps inline, or Configure to enter the credentials.
3. Enter the Pod URL (your pod or on-prem host, no trailing path).
4. Enter the Tenant Name, the Client ID, and the Client Secret.
5. Click Save.

What happens when you save

• The Tenant Name, Client ID, and Client Secret are stored encrypted in Azure Key Vault — never in the StackJack database, and never shown back to you.
• If this is the first time you configure CyberCNS, a Free-tier subscription for the connector is created automatically so its Free tools work right away.
• StackJack immediately live-validates the credentials by minting a token and making a cheap authenticated read (a one-record company list). Validation never blocks the save: you'll either see a success confirmation or a "saved but validation failed" warning with the reason.
• The connector card shows the current connection and validity status from then on.

Plans and available tools

• Free includes the 243 read-only tools: list/get across companies, agents, assets, hardware, firewall, ports and certificates; plus the full report-query surface — inventory, AD/Azure directory, problems and remediation plans, application and environment-wide vulnerabilities, and compliance.
• Pro adds the 52 write and delete tools: create/update companies, credentials, discovery settings, scan schedules, tags, EDR, PII and custom profiles, integrations, and vulnerability suppressions; start external scans; and the report-builder writes (create report jobs, upload templates, set cover pages).
• Business offers the same tool set as Pro with a higher monthly call quota.

Safety note — destructive tools. 23 Pro tools are irreversible and flagged as such to your AI so it asks before running them: the 21 cns_delete_* tools (delete a company, credential, asset, tag, suppression, and so on), plus cns_reset_agents and cns_remove_schedule. Scope your AI's access deliberately — use the tool selections on the MCP Setup page and the Permissions page to enable only the actions you want an AI to take.

CyberCNS has no per-user OAuth, so there is no per-user attribution — all AI traffic authenticates as the single API-key user. Current pricing and quotas are shown in the portal's Billing page and at checkout.

Rate limits

CyberCNS allows up to 300 requests per minute (and 2,000 per hour, 30,000 per day). StackJack paces requests to stay under the per-minute limit and backs off automatically if the API signals it is busy, so bursts of tool calls queue briefly instead of failing — a long multi-page inventory or report read may simply take a little longer.

Filtering and paging results

Most list and report tools accept a condition filter and an order_by sort in ConnectSecure's query language (for example condition=name:startswith:acme or order_by=created:desc), and page through results with skip and limit. Ask your AI to narrow a large query by company, severity, or date and it will pass the condition through.

Rotating or replacing the credentials

The API key is the recovery secret. If you regenerate or delete the API key in ConnectSecure — or the key's user loses access — the stored credential becomes invalid. To restore access, create a new key and open Connectors → CyberCNS (ConnectSecure) → Configure in StackJack, enter the new Client ID and Client Secret (re-enter the Pod URL and Tenant Name if needed), then Save.

Troubleshooting