This release brings the ULTRA RED MCP server into closed beta. You'll also find better attribution in asset timelines, a new Discovery filter, and a few additional improvements.
MCP (Model Context Protocol) lets AI assistants like Claude, GitHub Copilot, or custom agents work directly against your ULTRA RED data and workflows. Instead of clicking through the platform, you can hand a task to an agent and have it run against your live attack surface.
The server exposes 15 tools across two categories.
The read tools cover intelligence and monitoring: listing and inspecting targets, assets, vectors, asset timelines, and discovery findings. There's also a tool for current scanner proxy IPs, useful for firewall allowlisting.
The write tools cover response and management: adding assets, tagging and enriching them, toggling monitoring, moving vectors through the remediation lifecycle, and injecting vectors from external tools.
For the full tool list and example use cases, see the MCP two-pager.
ULTRA RED MCP is a paid feature available in closed beta. Reach out to your ULTRA RED contact to enable it on your account.
We've added more context to asset timeline events so it's easier to trace who did what and where information came from. Four events now show the username that triggered them: "Saved from Vita", "Vector attached", "Vector detached", and "Score changed". The "New enrichment added" event now shows the source of the enrichment.
A new lead domain filter lets you narrow Discovery findings by their originating lead domain. We've also opened up monitoring control on Related Domains through the API, so you can change their monitoring status programmatically instead of going through the UI.
A dedicated audit trail screen is in the works, giving you a single place to see user actions across the platform. More on that in an upcoming release.
