--- name: configure-dast-scan description: >- Add Dynamic Application Security Testing (DAST) steps to existing Harness pipelines using Harness STO scanners. Supports API DAST / Traceable (default), Burp Suite Enterprise, ZAP (OWASP), Nikto, and Nmap. Scans running application instances for vulnerabilities including API security issues, injection flaws, misconfigurations, and exposed services. Can insert the scan step into an existing CI or SecurityTests stage or create a dedicated SecurityTests stage. Use when asked to add DAST scanning, configure dynamic application testing, set up API security scanning, scan a running application, or add runtime security testing to a pipeline. Trigger phrases: add DAST scan, dynamic application security testing, API DAST, configure Traceable, scan running app, add Burp Suite scan, add ZAP scan, add Nikto scan, runtime security scan, API security scan. metadata: author: Harness version: 1.0.0 mcp-server: harness-mcp-v2 license: Apache-2.0 compatibility: Requires Harness MCP v2 server (harness-mcp-v2) ---

# Configure DAST Scan

Add a Dynamic Application Security Testing (DAST) step to an existing Harness pipeline using Harness STO scanners. DAST scanners test running application instances for security vulnerabilities at runtime.

## Instructions

### Step 1: Establish Scope and Pipeline Context

Ask for org, project, and pipeline identifier if not already known. This skill only works with existing pipelines.

``` Call MCP tool: harness_get Parameters: resource_type: "pipeline" resource_id: "<pipeline_identifier>" org_id: "<organization>" project_id: "<project>" ```

### Step 2: Analyze Pipeline Structure

Parse the pipeline YAML to identify: - All stages and their types (`CI`, `SecurityTests`, `Deployment`, `Approval`) - Whether a `SecurityTests` stage already exists - Existing steps in each stage

Present the structure to the user:

``` Pipeline: <name>

Stage 1: <stage_name> (type: <stage_type>) - Step 1: <step_name> (type: <step_type>) ... ```

**Ask the user where they want the DAST scanner step added:**

Present the available insertion points: - Any existing `SecurityTests` stage (scanner step is added into that stage's `execution.steps`) - Any existing `CI` stage (scanner step is added directly into that stage's `execution.steps`) - A new `SecurityTests` stage (appended to the pipeline)

**Recommendation guidance:** - DAST scans run against a **live application instance** — they are best placed **after deployment** so the target is running - If the pipeline has a Deployment stage, recommend adding a `SecurityTests` stage **after** the deployment stage - If no deployment stage exists, the user must provide the target URL of an already-running instance - Adding to an existing `SecurityTests` stage is simplest if one already exists

If the user doesn't specify, default to adding a new `SecurityTests` stage at the end of the pipeline (or after the Deployment stage if one exists).

### Step 3: Recommend Scanner Type

Present the available DAST scanners supported in Harness STO:

**Available DAST Scanners:** - **API DAST (Traceable)** (default — Harness native API security scanner, formerly called Traceable) - **Burp Suite Enterprise** (commercial, comprehensive web app DAST with crawl + audit) - **ZAP** (OWASP Zed Attack Proxy, open-source web app scanner) - **Nikto** (open-source, web server scanner) - **Nmap** (open-source, network/port scanner with vulnerability scripts)

**Default recommendation:** Use **API DAST (Traceable)** — the Harness native DAST scanner for API security testing. It connects with your Traceable account to initiate scans against existing scan configurations, and results integrate directly with Harness STO.

Ask the user which scanner they prefer. If they don't specify, use API DAST (Traceable) as the default.

**Step type mapping and scanner auth requirements:**

| Scanner | `type` field | Product auth needed? | Auth fields | |---------|-------------|----------------------|-------------| | API DAST (Traceable) | `Traceable` | Yes | `domain` (Traceable platform URL), `access_token` (API token) | | Burp Suite Enterprise | `BurpEnterprise` | Yes | `domain` (Burp Enterprise URL), `access_token` (API key) | | ZAP | `Zap` | No | — | | Nikto | `Nikto` | No | — | | Nmap | `Nmap` | No | — |

**If the user picks a scanner that requires auth (API DAST, Burp Suite):**

1. Inform the user that scanner product credentials are required 2. Ask for the required secret references from the table above — these must already exist as Harness secrets 3. Format them as `<+secrets.getValue("project.<secret_identifier>")>` 4. These go into the `auth` block of the step spec

Example prompt to user: > "API DAST (Traceable) requires a platform domain and access token. Please provide: > 1. Your Traceable platform URL (e.g., `https://api.traceable.ai/`) > 2. The Harness secret identifier for your Traceable API token (e.g., `traceable_api_token`). I'll reference it as `<+secrets.getValue("project.traceable_api_token")>`."

If the secret doesn't exist yet, suggest creating it first via `/create-secret` before proceeding.

### Step 4: Select Scan Mode (API DAST / Traceable only)

**This step applies only to API DAST (Traceable).** For other scanners (Burp Suite, ZAP, Nikto, Nmap), default to `orchestration` and skip to Step 5.

Present the three available scan modes and ask the user which one they want:

**Available Scan Modes:**

- **Orchestration** (default) — Triggers a new scan run within an existing Traceable Scan. Results are automatically saved in STO. Requires an active runner in Traceable. - **Extraction** — Retrieves the latest scan results from an existing Traceable Scan and imports them into STO. No new scan is triggered — useful for pulling results from scans run on a schedule or externally. - **Ingestion** — Reads scan results from a local JSON file and imports them into STO. The user must fetch results separately (e.g., via a Run step with Traceable API call). No Traceable credentials needed in the step itself.

If the user doesn't specify, default to **Orchestration**.

**Fields required per mode:**

| Field | Orchestration | Extraction | Ingestion | |-------|:---:|:---:|:---:| | Domain (Traceable URL) | Yes | Yes | No | | Access Token | Yes | Yes | No | | Scan Name (Suite ID) | Yes | Yes | No | | Runner Selection | Optional | No | No | | Ingestion File path | No | No | Yes | | Target Name (manual) | No | No | Yes | | Target Variant (manual) | No | No | Yes |

**For Ingestion mode**, inform the user they need a preceding **Run step** to fetch results from Traceable's API and save them as a JSON file. Example command for the Run step:

``` curl -H "Authorization: Bearer $API_TOKEN" \ "https://api.traceable.ai/graphql/scans/$SCAN_ID/vulnerabilities" \ -o /harness/vulnerabilities.json ```

The ingestion file path (e.g., `/harness/vulnerabilities.json`) must be configured as a shared path in the stage.

### Step 5: Collect Target Instance Details

DAST scans require a running application target. Collect different fields based on the scanner:

---

**For API DAST (Traceable):**

Traceable uses its own scan configurations managed in the Traceable platform. Collect based on the scan mode chosen in Step 4:

**Orchestration mode:**

| Field | Required | Description | |-------|----------|-------------| | Traceable Domain | Yes | Platform URL, e.g., `https://api.traceable.ai/` or `https://api-staging.traceable.ai/` | | Access Token | Yes | Traceable API token (Harness secret reference) | | Scan Name (Suite ID) | Yes | The Traceable Scan ID from the scan URL (e.g., `b35b11b4-3e87-47df-8c2e-a5ceb5ea764c`) | | Runner Selection | No | `auto` (default) or manual Runner ID — runners must be active in Traceable |

**Extraction mode:**

| Field | Required | Description | |-------|----------|-------------| | Traceable Domain | Yes | Platform URL, e.g., `https://api.traceable.ai/` | | Access Token | Yes | Traceable API token (Harness secret reference) | | Scan Name (Suite ID) | Yes | The Traceable Scan ID to pull latest results from |

**Ingestion mode:**

| Field | Required | Description | |-------|----------|-------------| | Ingestion File | Yes | Path to the JSON results file, e.g., `/harness/vulnerabilities.json` | | Target Name | Yes | Manual target identifier (e.g., `my-api-service`) | | Target Variant | Yes | Manual variant label (e.g., `1.0.0` or `staging`) |

---

**For Burp Suite Enterprise:**

| Field | Required | Description | |-------|----------|-------------| | Burp Domain | Yes | Burp Enterprise server URL | | Access Token | Yes | Burp API key (Harness secret reference) | | Instance Domain | Yes | Target application URL, e.g., `https://myapp.io` | | Instance Protocol | No | `https` (default) or `http` | | Instance Port | No | TCP port (e.g., `443`, `8080`) | | Instance Path | No | Path to append (e.g., `/api/v1`) | | Scan Configuration | No | Default is `Crawl and audit lightweight`. See Step 5 for options |

---

**For ZAP, Nikto, Nmap (instance scanners):**

| Field | Required | Description | |-------|----------|-------------| | Instance Domain | Yes | Target application domain, e.g., `https://myapp.io` | | Instance Protocol | No | `https` (default) or `http` | | Instance Port | No | TCP port (e.g., `443`, `8080`, `3000`) | | Instance Path | No | Path to append (e.g., `/portal/us`) |

---

### Step 6: Generate the Scanner Step YAML

Use the step `type` from the scanner mapping in Step 3.

**For API DAST / Traceable (default — Orchestration mode):**

```yaml - step: type: Traceable name: API_DAST_Scan identifier: API_DAST_Scan spec: mode: orchestration config: default target: type: instance detection: auto auth: domain: <traceable_platform_url> access_token: <+secrets.getValue("project.traceable_api_token")> tool: suite_id: <traceable_scan_id> advanced: log: level: info ```

**For API DAST / Traceable (Extraction mode):**

```yaml - step: type: Traceable name: API_DAST_Scan identifier: API_DAST_Scan spec: mode: extraction config: default target: type: instance detection: auto auth: domain: <traceable_platform_url> access_token: <+secrets.getValue("project.traceable_api_token")> tool: suite_id: <traceable_scan_id> advanced: log: level: info ```

**For API DAST / Traceable (Orchestration with manual runner):**

```yaml - step: type: Traceable name: API_DAST_Scan identifier: API_DAST_Scan spec: mode: orchestration config: default target: type: instance detection: auto auth: domain: <traceable_platform_url> access_token: <+secrets.getValue("project.traceable_api_token")> tool: suite_id: <traceable_scan_id> runner_id: <traceable_runner_id> advanced: log: level: info ```

**For API DAST / Traceable (Ingestion mode):**

```yaml - step: type: Traceable name: API_DAST_Scan identifier: API_DAST_Scan spec: mode: ingestion config: default target: type: instance name: <target_name> variant: <target_variant> ingestion: file: <ingestion_file_path> advanced: log: level: info ```

**For Burp Suite Enterprise (Orchestration mode):**

```yaml - step: type: BurpEnterprise name: Burp_Suite_Scan identifier: Burp_Suite_Scan spec: mode: orchestration config: default target: type: instance detection: auto auth: domain: <burp_enterprise_url> access_token: <+secrets.getValue("project.burp_api_key")> instance: domain: <target_app_url> protocol: https port: <port> path: <path> adv

--- name: configure-dast-scan description: >- Add Dynamic Application Security Testing (DAST) steps to existing Harness pipelines using Harness STO scanners. Supports API DAST / Traceable (default), Burp Suite Enterprise, ZAP (OWASP), Nikto, and Nmap. Scans running application instances for vulnerabilities including API security issues, injection flaws, misconfigurations, and exposed services. Can insert the scan step into an existing CI or SecurityTests stage or create a dedicated SecurityTests stage. Use when asked to add DAST scanning, configure dynamic application testing, set up API security scanning, scan a running application, or add runtime security testing to a pipeline. Trigger phrases: add DAST scan, dynamic application security testing, API DAST, configure Traceable, scan running app, add Burp Suite scan, add ZAP scan, add Nikto scan, runtime security scan, API security scan. metadata: author: Harness version: 1.0.0 mcp-server: harness-mcp-v2 license: Apache-2.0 compatibility: Requires Harness MCP v2 server (harness-mcp-v2) ---

# Configure DAST Scan

Add a Dynamic Application Security Testing (DAST) step to an existing Harness pipeline using Harness STO scanners. DAST scanners test running application instances for security vulnerabilities at runtime.

## Instructions

### Step 1: Establish Scope and Pipeline Context

Ask for org, project, and pipeline identifier if not already known. This skill only works with existing pipelines.

``` Call MCP tool: harness_get Parameters: resource_type: "pipeline" resource_id: "<pipeline_identifier>" org_id: "<organization>" project_id: "<project>" ```

### Step 2: Analyze Pipeline Structure

Parse the pipeline YAML to identify: - All stages and their types (`CI`, `SecurityTests`, `Deployment`, `Approval`) - Whether a `SecurityTests` stage already exists - Existing steps in each stage

Present the structure to the user:

``` Pipeline: <name>

Stage 1: <stage_name> (type: <stage_type>) - Step 1: <step_name> (type: <step_type>) ... ```

**Ask the user where they want the DAST scanner step added:**

Present the available insertion points: - Any existing `SecurityTests` stage (scanner step is added into that stage's `execution.steps`) - Any existing `CI` stage (scanner step is added directly into that stage's `execution.steps`) - A new `SecurityTests` stage (appended to the pipeline)

**Recommendation guidance:** - DAST scans run against a **live application instance** — they are best placed **after deployment** so the target is running - If the pipeline has a Deployment stage, recommend adding a `SecurityTests` stage **after** the deployment stage - If no deployment stage exists, the user must provide the target URL of an already-running instance - Adding to an existing `SecurityTests` stage is simplest if one already exists

If the user doesn't specify, default to adding a new `SecurityTests` stage at the end of the pipeline (or after the Deployment stage if one exists).

### Step 3: Recommend Scanner Type

Present the available DAST scanners supported in Harness STO:

**Available DAST Scanners:** - **API DAST (Traceable)** (default — Harness native API security scanner, formerly called Traceable) - **Burp Suite Enterprise** (commercial, comprehensive web app DAST with crawl + audit) - **ZAP** (OWASP Zed Attack Proxy, open-source web app scanner) - **Nikto** (open-source, web server scanner) - **Nmap** (open-source, network/port scanner with vulnerability scripts)

**Default recommendation:** Use **API DAST (Traceable)** — the Harness native DAST scanner for API security testing. It connects with your Traceable account to initiate scans against existing scan configurations, and results integrate directly with Harness STO.

Ask the user which scanner they prefer. If they don't specify, use API DAST (Traceable) as the default.

**Step type mapping and scanner auth requirements:**

| Scanner | `type` field | Product auth needed? | Auth fields | |---------|-------------|----------------------|-------------| | API DAST (Traceable) | `Traceable` | Yes | `domain` (Traceable platform URL), `access_token` (API token) | | Burp Suite Enterprise | `BurpEnterprise` | Yes | `domain` (Burp Enterprise URL), `access_token` (API key) | | ZAP | `Zap` | No | — | | Nikto | `Nikto` | No | — | | Nmap | `Nmap` | No | — |

**If the user picks a scanner that requires auth (API DAST, Burp Suite):**

1. Inform the user that scanner product credentials are required 2. Ask for the required secret references from the table above — these must already exist as Harness secrets 3. Format them as `<+secrets.getValue("project.<secret_identifier>")>` 4. These go into the `auth` block of the step spec

Example prompt to user: > "API DAST (Traceable) requires a platform domain and access token. Please provide: > 1. Your Traceable platform URL (e.g., `https://api.traceable.ai/`) > 2. The Harness secret identifier for your Traceable API token (e.g., `traceable_api_token`). I'll reference it as `<+secrets.getValue("project.traceable_api_token")>`."

If the secret doesn't exist yet, suggest creating it first via `/create-secret` before proceeding.

### Step 4: Select Scan Mode (API DAST / Traceable only)

**This step applies only to API DAST (Traceable).** For other scanners (Burp Suite, ZAP, Nikto, Nmap), default to `orchestration` and skip to Step 5.

Present the three available scan modes and ask the user which one they want:

**Available Scan Modes:**

- **Orchestration** (default) — Triggers a new scan run within an existing Traceable Scan. Results are automatically saved in STO. Requires an active runner in Traceable. - **Extraction** — Retrieves the latest scan results from an existing Traceable Scan and imports them into STO. No new scan is triggered — useful for pulling results from scans run on a schedule or externally. - **Ingestion** — Reads scan results from a local JSON file and imports them into STO. The user must fetch results separately (e.g., via a Run step with Traceable API call). No Traceable credentials needed in the step itself.

If the user doesn't specify, default to **Orchestration**.

**Fields required per mode:**

| Field | Orchestration | Extraction | Ingestion | |-------|:---:|:---:|:---:| | Domain (Traceable URL) | Yes | Yes | No | | Access Token | Yes | Yes | No | | Scan Name (Suite ID) | Yes | Yes | No | | Runner Selection | Optional | No | No | | Ingestion File path | No | No | Yes | | Target Name (manual) | No | No | Yes | | Target Variant (manual) | No | No | Yes |

**For Ingestion mode**, inform the user they need a preceding **Run step** to fetch results from Traceable's API and save them as a JSON file. Example command for the Run step:

``` curl -H "Authorization: Bearer $API_TOKEN" \ "https://api.traceable.ai/graphql/scans/$SCAN_ID/vulnerabilities" \ -o /harness/vulnerabilities.json ```

The ingestion file path (e.g., `/harness/vulnerabilities.json`) must be configured as a shared path in the stage.

### Step 5: Collect Target Instance Details

DAST scans require a running application target. Collect different fields based on the scanner:

---

**For API DAST (Traceable):**

Traceable uses its own scan configurations managed in the Traceable platform. Collect based on the scan mode chosen in Step 4:

**Orchestration mode:**

| Field | Required | Description | |-------|----------|-------------| | Traceable Domain | Yes | Platform URL, e.g., `https://api.traceable.ai/` or `https://api-staging.traceable.ai/` | | Access Token | Yes | Traceable API token (Harness secret reference) | | Scan Name (Suite ID) | Yes | The Traceable Scan ID from the scan URL (e.g., `b35b11b4-3e87-47df-8c2e-a5ceb5ea764c`) | | Runner Selection | No | `auto` (default) or manual Runner ID — runners must be active in Traceable |

**Extraction mode:**

| Field | Required | Description | |-------|----------|-------------| | Traceable Domain | Yes | Platform URL, e.g., `https://api.traceable.ai/` | | Access Token | Yes | Traceable API token (Harness secret reference) | | Scan Name (Suite ID) | Yes | The Traceable Scan ID to pull latest results from |

**Ingestion mode:**

| Field | Required | Description | |-------|----------|-------------| | Ingestion File | Yes | Path to the JSON results file, e.g., `/harness/vulnerabilities.json` | | Target Name | Yes | Manual target identifier (e.g., `my-api-service`) | | Target Variant | Yes | Manual variant label (e.g., `1.0.0` or `staging`) |

---

**For Burp Suite Enterprise:**

| Field | Required | Description | |-------|----------|-------------| | Burp Domain | Yes | Burp Enterprise server URL | | Access Token | Yes | Burp API key (Harness secret reference) | | Instance Domain | Yes | Target application URL, e.g., `https://myapp.io` | | Instance Protocol | No | `https` (default) or `http` | | Instance Port | No | TCP port (e.g., `443`, `8080`) | | Instance Path | No | Path to append (e.g., `/api/v1`) | | Scan Configuration | No | Default is `Crawl and audit lightweight`. See Step 5 for options |

---

**For ZAP, Nikto, Nmap (instance scanners):**

| Field | Required | Description | |-------|----------|-------------| | Instance Domain | Yes | Target application domain, e.g., `https://myapp.io` | | Instance Protocol | No | `https` (default) or `http` | | Instance Port | No | TCP port (e.g., `443`, `8080`, `3000`) | | Instance Path | No | Path to append (e.g., `/portal/us`) |

---

### Step 6: Generate the Scanner Step YAML

Use the step `type` from the scanner mapping in Step 3.

**For API DAST / Traceable (default — Orchestration mode):**

```yaml - step: type: Traceable name: API_DAST_Scan identifier: API_DAST_Scan spec: mode: orchestration config: default target: type: instance detection: auto auth: domain: <traceable_platform_url> access_token: <+secrets.getValue("project.traceable_api_token")> tool: suite_id: <traceable_scan_id> advanced: log: level: info ```

**For API DAST / Traceable (Extraction mode):**

```yaml - step: type: Traceable name: API_DAST_Scan identifier: API_DAST_Scan spec: mode: extraction config: default target: type: instance detection: auto auth: domain: <traceable_platform_url> access_token: <+secrets.getValue("project.traceable_api_token")> tool: suite_id: <traceable_scan_id> advanced: log: level: info ```

**For API DAST / Traceable (Orchestration with manual runner):**

```yaml - step: type: Traceable name: API_DAST_Scan identifier: API_DAST_Scan spec: mode: orchestration config: default target: type: instance detection: auto auth: domain: <traceable_platform_url> access_token: <+secrets.getValue("project.traceable_api_token")> tool: suite_id: <traceable_scan_id> runner_id: <traceable_runner_id> advanced: log: level: info ```

**For API DAST / Traceable (Ingestion mode):**

```yaml - step: type: Traceable name: API_DAST_Scan identifier: API_DAST_Scan spec: mode: ingestion config: default target: type: instance name: <target_name> variant: <target_variant> ingestion: file: <ingestion_file_path> advanced: log: level: info ```

**For Burp Suite Enterprise (Orchestration mode):**

```yaml - step: type: BurpEnterprise name: Burp_Suite_Scan identifier: Burp_Suite_Scan spec: mode: orchestration config: default target: type: instance detection: auto auth: domain: <burp_enterprise_url> access_token: <+secrets.getValue("project.burp_api_key")> instance: domain: <target_app_url> protocol: https port: <port> path: <path> adv

--- name: configure-dast-scan description: >- Add Dynamic Application Security Testing (DAST) steps to existing Harness pipelines using Harness STO scanners. Supports API DAST / Traceable (default), Burp Suite Enterprise, ZAP (OWASP), Nikto, and Nmap. Scans running application instances for vulnerabilities including API security issues, injection flaws, misconfigurations, and exposed services. Can insert the scan step into an existing CI or SecurityTests stage or create a dedicated SecurityTests stage. Use when asked to add DAST scanning, configure dynamic application testing, set up API security scanning, scan a running application, or add runtime security testing to a pipeline. Trigger phrases: add DAST scan, dynamic application security testing, API DAST, configure Traceable, scan running app, add Burp Suite scan, add ZAP scan, add Nikto scan, runtime security scan, API security scan. metadata: author: Harness version: 1.0.0 mcp-server: harness-mcp-v2 license: Apache-2.0 compatibility: Requires Harness MCP v2 server (harness-mcp-v2) ---

# Configure DAST Scan

Add a Dynamic Application Security Testing (DAST) step to an existing Harness pipeline using Harness STO scanners. DAST scanners test running application instances for security vulnerabilities at runtime.

## Instructions

### Step 1: Establish Scope and Pipeline Context

Ask for org, project, and pipeline identifier if not already known. This skill only works with existing pipelines.

``` Call MCP tool: harness_get Parameters: resource_type: "pipeline" resource_id: "<pipeline_identifier>" org_id: "<organization>" project_id: "<project>" ```

### Step 2: Analyze Pipeline Structure

Parse the pipeline YAML to identify: - All stages and their types (`CI`, `SecurityTests`, `Deployment`, `Approval`) - Whether a `SecurityTests` stage already exists - Existing steps in each stage

Present the structure to the user:

``` Pipeline: <name>

Stage 1: <stage_name> (type: <stage_type>) - Step 1: <step_name> (type: <step_type>) ... ```

**Ask the user where they want the DAST scanner step added:**

Present the available insertion points: - Any existing `SecurityTests` stage (scanner step is added into that stage's `execution.steps`) - Any existing `CI` stage (scanner step is added directly into that stage's `execution.steps`) - A new `SecurityTests` stage (appended to the pipeline)

**Recommendation guidance:** - DAST scans run against a **live application instance** — they are best placed **after deployment** so the target is running - If the pipeline has a Deployment stage, recommend adding a `SecurityTests` stage **after** the deployment stage - If no deployment stage exists, the user must provide the target URL of an already-running instance - Adding to an existing `SecurityTests` stage is simplest if one already exists

If the user doesn't specify, default to adding a new `SecurityTests` stage at the end of the pipeline (or after the Deployment stage if one exists).

### Step 3: Recommend Scanner Type

Present the available DAST scanners supported in Harness STO:

**Available DAST Scanners:** - **API DAST (Traceable)** (default — Harness native API security scanner, formerly called Traceable) - **Burp Suite Enterprise** (commercial, comprehensive web app DAST with crawl + audit) - **ZAP** (OWASP Zed Attack Proxy, open-source web app scanner) - **Nikto** (open-source, web server scanner) - **Nmap** (open-source, network/port scanner with vulnerability scripts)

**Default recommendation:** Use **API DAST (Traceable)** — the Harness native DAST scanner for API security testing. It connects with your Traceable account to initiate scans against existing scan configurations, and results integrate directly with Harness STO.

Ask the user which scanner they prefer. If they don't specify, use API DAST (Traceable) as the default.

**Step type mapping and scanner auth requirements:**

| Scanner | `type` field | Product auth needed? | Auth fields | |---------|-------------|----------------------|-------------| | API DAST (Traceable) | `Traceable` | Yes | `domain` (Traceable platform URL), `access_token` (API token) | | Burp Suite Enterprise | `BurpEnterprise` | Yes | `domain` (Burp Enterprise URL), `access_token` (API key) | | ZAP | `Zap` | No | — | | Nikto | `Nikto` | No | — | | Nmap | `Nmap` | No | — |

**If the user picks a scanner that requires auth (API DAST, Burp Suite):**

1. Inform the user that scanner product credentials are required 2. Ask for the required secret references from the table above — these must already exist as Harness secrets 3. Format them as `<+secrets.getValue("project.<secret_identifier>")>` 4. These go into the `auth` block of the step spec

Example prompt to user: > "API DAST (Traceable) requires a platform domain and access token. Please provide: > 1. Your Traceable platform URL (e.g., `https://api.traceable.ai/`) > 2. The Harness secret identifier for your Traceable API token (e.g., `traceable_api_token`). I'll reference it as `<+secrets.getValue("project.traceable_api_token")>`."

If the secret doesn't exist yet, suggest creating it first via `/create-secret` before proceeding.

### Step 4: Select Scan Mode (API DAST / Traceable only)

**This step applies only to API DAST (Traceable).** For other scanners (Burp Suite, ZAP, Nikto, Nmap), default to `orchestration` and skip to Step 5.

Present the three available scan modes and ask the user which one they want:

**Available Scan Modes:**

- **Orchestration** (default) — Triggers a new scan run within an existing Traceable Scan. Results are automatically saved in STO. Requires an active runner in Traceable. - **Extraction** — Retrieves the latest scan results from an existing Traceable Scan and imports them into STO. No new scan is triggered — useful for pulling results from scans run on a schedule or externally. - **Ingestion** — Reads scan results from a local JSON file and imports them into STO. The user must fetch results separately (e.g., via a Run step with Traceable API call). No Traceable credentials needed in the step itself.

If the user doesn't specify, default to **Orchestration**.

**Fields required per mode:**

| Field | Orchestration | Extraction | Ingestion | |-------|:---:|:---:|:---:| | Domain (Traceable URL) | Yes | Yes | No | | Access Token | Yes | Yes | No | | Scan Name (Suite ID) | Yes | Yes | No | | Runner Selection | Optional | No | No | | Ingestion File path | No | No | Yes | | Target Name (manual) | No | No | Yes | | Target Variant (manual) | No | No | Yes |

**For Ingestion mode**, inform the user they need a preceding **Run step** to fetch results from Traceable's API and save them as a JSON file. Example command for the Run step:

``` curl -H "Authorization: Bearer $API_TOKEN" \ "https://api.traceable.ai/graphql/scans/$SCAN_ID/vulnerabilities" \ -o /harness/vulnerabilities.json ```

The ingestion file path (e.g., `/harness/vulnerabilities.json`) must be configured as a shared path in the stage.

### Step 5: Collect Target Instance Details

DAST scans require a running application target. Collect different fields based on the scanner:

---

**For API DAST (Traceable):**

Traceable uses its own scan configurations managed in the Traceable platform. Collect based on the scan mode chosen in Step 4:

**Orchestration mode:**

| Field | Required | Description | |-------|----------|-------------| | Traceable Domain | Yes | Platform URL, e.g., `https://api.traceable.ai/` or `https://api-staging.traceable.ai/` | | Access Token | Yes | Traceable API token (Harness secret reference) | | Scan Name (Suite ID) | Yes | The Traceable Scan ID from the scan URL (e.g., `b35b11b4-3e87-47df-8c2e-a5ceb5ea764c`) | | Runner Selection | No | `auto` (default) or manual Runner ID — runners must be active in Traceable |

**Extraction mode:**

| Field | Required | Description | |-------|----------|-------------| | Traceable Domain | Yes | Platform URL, e.g., `https://api.traceable.ai/` | | Access Token | Yes | Traceable API token (Harness secret reference) | | Scan Name (Suite ID) | Yes | The Traceable Scan ID to pull latest results from |

**Ingestion mode:**

| Field | Required | Description | |-------|----------|-------------| | Ingestion File | Yes | Path to the JSON results file, e.g., `/harness/vulnerabilities.json` | | Target Name | Yes | Manual target identifier (e.g., `my-api-service`) | | Target Variant | Yes | Manual variant label (e.g., `1.0.0` or `staging`) |

---

**For Burp Suite Enterprise:**

| Field | Required | Description | |-------|----------|-------------| | Burp Domain | Yes | Burp Enterprise server URL | | Access Token | Yes | Burp API key (Harness secret reference) | | Instance Domain | Yes | Target application URL, e.g., `https://myapp.io` | | Instance Protocol | No | `https` (default) or `http` | | Instance Port | No | TCP port (e.g., `443`, `8080`) | | Instance Path | No | Path to append (e.g., `/api/v1`) | | Scan Configuration | No | Default is `Crawl and audit lightweight`. See Step 5 for options |

---

**For ZAP, Nikto, Nmap (instance scanners):**

| Field | Required | Description | |-------|----------|-------------| | Instance Domain | Yes | Target application domain, e.g., `https://myapp.io` | | Instance Protocol | No | `https` (default) or `http` | | Instance Port | No | TCP port (e.g., `443`, `8080`, `3000`) | | Instance Path | No | Path to append (e.g., `/portal/us`) |

---

### Step 6: Generate the Scanner Step YAML

Use the step `type` from the scanner mapping in Step 3.

**For API DAST / Traceable (default — Orchestration mode):**

```yaml - step: type: Traceable name: API_DAST_Scan identifier: API_DAST_Scan spec: mode: orchestration config: default target: type: instance detection: auto auth: domain: <traceable_platform_url> access_token: <+secrets.getValue("project.traceable_api_token")> tool: suite_id: <traceable_scan_id> advanced: log: level: info ```

**For API DAST / Traceable (Extraction mode):**

```yaml - step: type: Traceable name: API_DAST_Scan identifier: API_DAST_Scan spec: mode: extraction config: default target: type: instance detection: auto auth: domain: <traceable_platform_url> access_token: <+secrets.getValue("project.traceable_api_token")> tool: suite_id: <traceable_scan_id> advanced: log: level: info ```

**For API DAST / Traceable (Orchestration with manual runner):**

```yaml - step: type: Traceable name: API_DAST_Scan identifier: API_DAST_Scan spec: mode: orchestration config: default target: type: instance detection: auto auth: domain: <traceable_platform_url> access_token: <+secrets.getValue("project.traceable_api_token")> tool: suite_id: <traceable_scan_id> runner_id: <traceable_runner_id> advanced: log: level: info ```

**For API DAST / Traceable (Ingestion mode):**

```yaml - step: type: Traceable name: API_DAST_Scan identifier: API_DAST_Scan spec: mode: ingestion config: default target: type: instance name: <target_name> variant: <target_variant> ingestion: file: <ingestion_file_path> advanced: log: level: info ```

**For Burp Suite Enterprise (Orchestration mode):**

```yaml - step: type: BurpEnterprise name: Burp_Suite_Scan identifier: Burp_Suite_Scan spec: mode: orchestration config: default target: type: instance detection: auto auth: domain: <burp_enterprise_url> access_token: <+secrets.getValue("project.burp_api_key")> instance: domain: <target_app_url> protocol: https port: <port> path: <path> adv

--- name: configure-dast-scan description: >- Add Dynamic Application Security Testing (DAST) steps to existing Harness pipelines using Harness STO scanners. Supports API DAST / Traceable (default), Burp Suite Enterprise, ZAP (OWASP), Nikto, and Nmap. Scans running application instances for vulnerabilities including API security issues, injection flaws, misconfigurations, and exposed services. Can insert the scan step into an existing CI or SecurityTests stage or create a dedicated SecurityTests stage. Use when asked to add DAST scanning, configure dynamic application testing, set up API security scanning, scan a running application, or add runtime security testing to a pipeline. Trigger phrases: add DAST scan, dynamic application security testing, API DAST, configure Traceable, scan running app, add Burp Suite scan, add ZAP scan, add Nikto scan, runtime security scan, API security scan. metadata: author: Harness version: 1.0.0 mcp-server: harness-mcp-v2 license: Apache-2.0 compatibility: Requires Harness MCP v2 server (harness-mcp-v2) ---

# Configure DAST Scan

Add a Dynamic Application Security Testing (DAST) step to an existing Harness pipeline using Harness STO scanners. DAST scanners test running application instances for security vulnerabilities at runtime.

## Instructions

### Step 1: Establish Scope and Pipeline Context

Ask for org, project, and pipeline identifier if not already known. This skill only works with existing pipelines.

``` Call MCP tool: harness_get Parameters: resource_type: "pipeline" resource_id: "<pipeline_identifier>" org_id: "<organization>" project_id: "<project>" ```

### Step 2: Analyze Pipeline Structure

Parse the pipeline YAML to identify: - All stages and their types (`CI`, `SecurityTests`, `Deployment`, `Approval`) - Whether a `SecurityTests` stage already exists - Existing steps in each stage

Present the structure to the user:

``` Pipeline: <name>

Stage 1: <stage_name> (type: <stage_type>) - Step 1: <step_name> (type: <step_type>) ... ```

**Ask the user where they want the DAST scanner step added:**

Present the available insertion points: - Any existing `SecurityTests` stage (scanner step is added into that stage's `execution.steps`) - Any existing `CI` stage (scanner step is added directly into that stage's `execution.steps`) - A new `SecurityTests` stage (appended to the pipeline)

**Recommendation guidance:** - DAST scans run against a **live application instance** — they are best placed **after deployment** so the target is running - If the pipeline has a Deployment stage, recommend adding a `SecurityTests` stage **after** the deployment stage - If no deployment stage exists, the user must provide the target URL of an already-running instance - Adding to an existing `SecurityTests` stage is simplest if one already exists

If the user doesn't specify, default to adding a new `SecurityTests` stage at the end of the pipeline (or after the Deployment stage if one exists).

### Step 3: Recommend Scanner Type

Present the available DAST scanners supported in Harness STO:

**Available DAST Scanners:** - **API DAST (Traceable)** (default — Harness native API security scanner, formerly called Traceable) - **Burp Suite Enterprise** (commercial, comprehensive web app DAST with crawl + audit) - **ZAP** (OWASP Zed Attack Proxy, open-source web app scanner) - **Nikto** (open-source, web server scanner) - **Nmap** (open-source, network/port scanner with vulnerability scripts)

**Default recommendation:** Use **API DAST (Traceable)** — the Harness native DAST scanner for API security testing. It connects with your Traceable account to initiate scans against existing scan configurations, and results integrate directly with Harness STO.

Ask the user which scanner they prefer. If they don't specify, use API DAST (Traceable) as the default.

**Step type mapping and scanner auth requirements:**

| Scanner | `type` field | Product auth needed? | Auth fields | |---------|-------------|----------------------|-------------| | API DAST (Traceable) | `Traceable` | Yes | `domain` (Traceable platform URL), `access_token` (API token) | | Burp Suite Enterprise | `BurpEnterprise` | Yes | `domain` (Burp Enterprise URL), `access_token` (API key) | | ZAP | `Zap` | No | — | | Nikto | `Nikto` | No | — | | Nmap | `Nmap` | No | — |

**If the user picks a scanner that requires auth (API DAST, Burp Suite):**

1. Inform the user that scanner product credentials are required 2. Ask for the required secret references from the table above — these must already exist as Harness secrets 3. Format them as `<+secrets.getValue("project.<secret_identifier>")>` 4. These go into the `auth` block of the step spec

Example prompt to user: > "API DAST (Traceable) requires a platform domain and access token. Please provide: > 1. Your Traceable platform URL (e.g., `https://api.traceable.ai/`) > 2. The Harness secret identifier for your Traceable API token (e.g., `traceable_api_token`). I'll reference it as `<+secrets.getValue("project.traceable_api_token")>`."

If the secret doesn't exist yet, suggest creating it first via `/create-secret` before proceeding.

### Step 4: Select Scan Mode (API DAST / Traceable only)

**This step applies only to API DAST (Traceable).** For other scanners (Burp Suite, ZAP, Nikto, Nmap), default to `orchestration` and skip to Step 5.

Present the three available scan modes and ask the user which one they want:

**Available Scan Modes:**

- **Orchestration** (default) — Triggers a new scan run within an existing Traceable Scan. Results are automatically saved in STO. Requires an active runner in Traceable. - **Extraction** — Retrieves the latest scan results from an existing Traceable Scan and imports them into STO. No new scan is triggered — useful for pulling results from scans run on a schedule or externally. - **Ingestion** — Reads scan results from a local JSON file and imports them into STO. The user must fetch results separately (e.g., via a Run step with Traceable API call). No Traceable credentials needed in the step itself.

If the user doesn't specify, default to **Orchestration**.

**Fields required per mode:**

| Field | Orchestration | Extraction | Ingestion | |-------|:---:|:---:|:---:| | Domain (Traceable URL) | Yes | Yes | No | | Access Token | Yes | Yes | No | | Scan Name (Suite ID) | Yes | Yes | No | | Runner Selection | Optional | No | No | | Ingestion File path | No | No | Yes | | Target Name (manual) | No | No | Yes | | Target Variant (manual) | No | No | Yes |

**For Ingestion mode**, inform the user they need a preceding **Run step** to fetch results from Traceable's API and save them as a JSON file. Example command for the Run step:

``` curl -H "Authorization: Bearer $API_TOKEN" \ "https://api.traceable.ai/graphql/scans/$SCAN_ID/vulnerabilities" \ -o /harness/vulnerabilities.json ```

The ingestion file path (e.g., `/harness/vulnerabilities.json`) must be configured as a shared path in the stage.

### Step 5: Collect Target Instance Details

DAST scans require a running application target. Collect different fields based on the scanner:

---

**For API DAST (Traceable):**

Traceable uses its own scan configurations managed in the Traceable platform. Collect based on the scan mode chosen in Step 4:

**Orchestration mode:**

| Field | Required | Description | |-------|----------|-------------| | Traceable Domain | Yes | Platform URL, e.g., `https://api.traceable.ai/` or `https://api-staging.traceable.ai/` | | Access Token | Yes | Traceable API token (Harness secret reference) | | Scan Name (Suite ID) | Yes | The Traceable Scan ID from the scan URL (e.g., `b35b11b4-3e87-47df-8c2e-a5ceb5ea764c`) | | Runner Selection | No | `auto` (default) or manual Runner ID — runners must be active in Traceable |

**Extraction mode:**

| Field | Required | Description | |-------|----------|-------------| | Traceable Domain | Yes | Platform URL, e.g., `https://api.traceable.ai/` | | Access Token | Yes | Traceable API token (Harness secret reference) | | Scan Name (Suite ID) | Yes | The Traceable Scan ID to pull latest results from |

**Ingestion mode:**

| Field | Required | Description | |-------|----------|-------------| | Ingestion File | Yes | Path to the JSON results file, e.g., `/harness/vulnerabilities.json` | | Target Name | Yes | Manual target identifier (e.g., `my-api-service`) | | Target Variant | Yes | Manual variant label (e.g., `1.0.0` or `staging`) |

---

**For Burp Suite Enterprise:**

| Field | Required | Description | |-------|----------|-------------| | Burp Domain | Yes | Burp Enterprise server URL | | Access Token | Yes | Burp API key (Harness secret reference) | | Instance Domain | Yes | Target application URL, e.g., `https://myapp.io` | | Instance Protocol | No | `https` (default) or `http` | | Instance Port | No | TCP port (e.g., `443`, `8080`) | | Instance Path | No | Path to append (e.g., `/api/v1`) | | Scan Configuration | No | Default is `Crawl and audit lightweight`. See Step 5 for options |

---

**For ZAP, Nikto, Nmap (instance scanners):**

| Field | Required | Description | |-------|----------|-------------| | Instance Domain | Yes | Target application domain, e.g., `https://myapp.io` | | Instance Protocol | No | `https` (default) or `http` | | Instance Port | No | TCP port (e.g., `443`, `8080`, `3000`) | | Instance Path | No | Path to append (e.g., `/portal/us`) |

---

### Step 6: Generate the Scanner Step YAML

Use the step `type` from the scanner mapping in Step 3.

**For API DAST / Traceable (default — Orchestration mode):**

```yaml - step: type: Traceable name: API_DAST_Scan identifier: API_DAST_Scan spec: mode: orchestration config: default target: type: instance detection: auto auth: domain: <traceable_platform_url> access_token: <+secrets.getValue("project.traceable_api_token")> tool: suite_id: <traceable_scan_id> advanced: log: level: info ```

**For API DAST / Traceable (Extraction mode):**

```yaml - step: type: Traceable name: API_DAST_Scan identifier: API_DAST_Scan spec: mode: extraction config: default target: type: instance detection: auto auth: domain: <traceable_platform_url> access_token: <+secrets.getValue("project.traceable_api_token")> tool: suite_id: <traceable_scan_id> advanced: log: level: info ```

**For API DAST / Traceable (Orchestration with manual runner):**

```yaml - step: type: Traceable name: API_DAST_Scan identifier: API_DAST_Scan spec: mode: orchestration config: default target: type: instance detection: auto auth: domain: <traceable_platform_url> access_token: <+secrets.getValue("project.traceable_api_token")> tool: suite_id: <traceable_scan_id> runner_id: <traceable_runner_id> advanced: log: level: info ```

**For API DAST / Traceable (Ingestion mode):**

```yaml - step: type: Traceable name: API_DAST_Scan identifier: API_DAST_Scan spec: mode: ingestion config: default target: type: instance name: <target_name> variant: <target_variant> ingestion: file: <ingestion_file_path> advanced: log: level: info ```

**For Burp Suite Enterprise (Orchestration mode):**

```yaml - step: type: BurpEnterprise name: Burp_Suite_Scan identifier: Burp_Suite_Scan spec: mode: orchestration config: default target: type: instance detection: auto auth: domain: <burp_enterprise_url> access_token: <+secrets.getValue("project.burp_api_key")> instance: domain: <target_app_url> protocol: https port: <port> path: <path> adv