Install Jentic One Beta

Connect the MindFort API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the MindFort API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fmindfort.ai%2Fmindfort" | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fmindfort.ai%2Fmindfort" | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with MindFort API.

Trigger a black-box or white-box assessment of a target in balanced, deep, or ultra assessment_method

List findings filtered by severity, status, target_id, or assessment_id and sort them by severity or created_at

Resolve findings one at a time or in bulk with resolve_reason FIX, WONT_FIX, or FALSE_POSITIVE

Retest a finding after a fix, optionally with a specific target_credential_id

GET STARTED

Start building with MindFort API

Explore with Jentic One

View OpenAPI Document

Use Cases

Patterns agents use MindFort API for, with concrete tasks.

★ Agent-driven finding triage through Jentic

A coding agent can close the loop between a security finding and a fix. Through Jentic it lists active critical and high findings for a target, reads each finding, ships a fix in the codebase, then calls retest and resolves the finding with resolve_reason FIX once the retest passes. The MindFort API key stays on your own Jentic One instance, and your rules can keep target deletion and credential changes out of the agent's reach.

GET /v1/findings with target_id 'tgt_123', severity 'critical', status 'ACTIVE'; for each, GET /v1/findings/{finding_id}, apply the fix, POST /v1/findings/{finding_id}/retest, then POST /v1/findings/{finding_id}/status with status 'RESOLVED' and resolve_reason 'FIX'

Security testing in release pipelines

Teams can trigger an assessment when a release reaches staging. The trigger operation requires a target_id and accepts assessment_type black-box or white-box, assessment_method balanced, deep, or ultra, and a target_credential_id for authenticated testing. Assessments run asynchronously, so the pipeline polls the assessment and can cancel it if the release is pulled.

POST /v1/assessments/run with target_id 'tgt_123', assessment_type 'black-box', assessment_method 'balanced', then poll GET /v1/assessments/{assessment_id} until it completes

Authenticated testing with MFA-protected accounts

Many apps hide their riskiest surface behind login. MindFort stores test credentials per target, with a credential_type, username, password, role, and login_instructions, and exposes operations that fetch email MFA, authenticator 2FA, and SMS codes so assessments can sign in. An email credential can be generated for targets that need a fresh inbox.

POST /v1/targets/tgt_123/credentials with credential_name 'qa-admin', credential_type and username for the admin test account, and role 'admin'

Security posture reporting

Security leads can report on posture without exporting spreadsheets. Metrics operations return current metrics, timeseries, remediation and SLA metrics, finding aging, and severity and category distributions per target_id, and reports can be generated at full or condensed report_detail_level and downloaded.

POST /v1/reports with target_id 'tgt_123' and report_detail_level 'condensed', poll GET /v1/reports/{report_id}, then GET /v1/reports/{report_id}/download

Key Endpoints

55 endpoints — the mindfort api runs ai-driven security assessments against your web apps, apis, and networks and manages the findings they produce.

METHOD

PATH

DESCRIPTION

POST

/v1/assessments/run

Trigger an assessment

GET

/v1/findings

List findings

POST

/v1/findings/{finding_id}/status

Update finding status

POST

/v1/findings/{finding_id}/retest

Retest a finding

POST

/v1/targets

Create a target

POST

/v1/reports

Create a report

GET

/v1/targets/{target_id}/health-score

Get target health score

POST

/v1/assessments/run

Trigger an assessment

GET

/v1/findings

List findings

POST

/v1/findings/{finding_id}/status

Update finding status

POST

/v1/findings/{finding_id}/retest

Retest a finding

POST

/v1/targets

Create a target

POST

/v1/reports

Create a report

GET

/v1/targets/{target_id}/health-score

Get target health score

Why Jentic?

What agents get from Jentic-routed access to this vendor.

Setup

Wiring MindFort by hand means attaching its bearer key, polling asynchronous assessments, and paging through findings, metrics, and reports. Through Jentic you install once, import MindFort from the API Directory, store the key once, and your agent calls it.

Permission scoping

MindFort puts the target id and finding id in the URL path (/v1/targets/{target_id}/..., /v1/findings/{finding_id}/...), so a rule can pin your agent to one target or finding and the operations you pick. You choose the operations it may call, so destructive ones like target deletion or reading stored test credentials are not included unless you add them.

Credential isolation

Your MindFort API key is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'list critical security findings' or 'retest a vulnerability', and Jentic returns the matching MindFort operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

FAQs

Specific to using MindFort API through Jentic.

What authentication does the MindFort API use?

Per its OpenAPI spec, the MindFort API uses an API key generated from the MindFort dashboard, sent as a bearer token (bearerAuth): `Authorization: Bearer <your-api-key>`. Through Jentic the key is stored encrypted by your own Jentic One instance and injected when the agent calls.

Can I mark findings as false positives in bulk with the MindFort API?

Yes. POST /v1/findings/status takes a list of finding_ids with a status of ACTIVE, RESOLVED, or ARCHIVED and an optional resolve_reason of FIX, WONT_FIX, or FALSE_POSITIVE plus resolve_context. For a single finding use POST /v1/findings/{finding_id}/status.

How do I trigger an assessment through Jentic?

Install Jentic One with `curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh`, import the MindFort API from the directory, and store your API key. Your agent searches 'run a security assessment on a target', gets POST /v1/assessments/run with its schema, and sends the required target_id with an assessment_type and assessment_method. To run it on your own infrastructure, install Jentic One from its GitHub repo.

Can I limit what my agent is allowed to do with the MindFort API?

Yes. For example, allow GET /v1/findings, GET /v1/findings/{finding_id}, POST /v1/findings/{finding_id}/retest, and POST /v1/findings/{finding_id}/status, so a fixing agent can read, retest, and resolve findings but cannot launch new assessments, delete targets, or read stored test credentials. Every call it makes is logged.

Is there a MindFort MCP server?

You don't need an MCP server to give your agent MindFort. Jentic connects it directly from the API Directory: import it, store your credential once, and your agent calls it.

What are the rate limits for the MindFort API?

The OpenAPI spec does not specify rate limits. Check the MindFort documentation at https://docs.mindfort.ai for current limits.

What does a secured finding mean in MindFort?

Per the spec, informational probe results are labeled secured, as opposed to vulnerable findings. List findings with exclude_secured or status_filter vulnerable to see only issues that need fixing, or include secured results in a report with include_secured_findings.

MindFort API

AI ReadinessAI-Aware (B-)62/100

See full scorecard

Official vendor OpenAPI document · agent-readySecurityVulnerability Managementbearer55 EndpointsREST

For Agents

Register targets, trigger MindFort security assessments, triage and retest findings, and pull security metrics and reports.

Use for: Run a deep black-box assessment of our staging web app, List all critical findings that are still active, Mark this finding as a false positive, Retest the SQL injection finding now that we shipped a fix

Not supported: Does not scan source code dependencies, manage cloud configuration, or issue compliance certifications. Use for MindFort security assessments, findings, and reports only.

The MindFort API runs AI-driven security assessments against your web apps, APIs, and networks and manages the findings they produce. You register targets with a target_type of `web_app`, `api`, or `network`, attach test credentials with email, authenticator, or SMS second factors, and trigger black-box or white-box assessments in balanced, deep, or ultra mode. Findings can be filtered by severity and status, resolved with a reason such as FIX or FALSE_POSITIVE, retested, commented on, and rolled up into health scores, SLA and remediation metrics, and full or condensed reports. A Discovery feature schedules runs that suggest new targets to accept or dismiss.

Jentic One on Github View OpenAPI Document

Show dimension breakdown

Foundational Compliance

Base layer of spec validity and structural soundness.

Grade: A+Signals: 4

95%

Lint Results

Aggregated quality score from linter diagnostics, weighted by severity.

100%

Resolution Completeness

Percentage of `$ref` references that resolve successfully.

100%

Specification Validity

Checks whether the API description parses successfully and conforms to its declared specification (e.g., OpenAPI).

100%

Structural Integrity

Structural correctness score based on schema issues using logarithmic dampening.

Developer Experience & Jentic Compatibility

Clarity, completeness, and ingestion readiness for developers and tooling.

Grade: B-Signals: 4

Example Density

How richly the API is illustrated with examples.

100%

Example Validity

Percentage of examples that conform to their schemas.

44%

Response Coverage

Percentage of operations with complete response definitions (success, client error, server error).

100%

Tooling Readiness

Health of API ingestion, bundling, and resolution within Jentic pipelines.

AI-Readiness & Agent Experience

Semantic breadth, depth, and agent comprehension for AI systems.

Grade: DSignals: 4

25%

Description Coverage

Coverage of descriptions across API elements.

Error Standardization

Coverage of RFC 9457 Problem Details for error responses.

100%

OperationId Quality

Coverage, uniqueness, and casing consistency of operationIds for AI inference.

53%

Summary Coverage

Coverage of summaries across operations/tags/info.

Agent Usability

Functional utility, complexity comfort, and AI orchestration readiness.

Grade: A+Signals: 1

93%

Complexity Comfort

Agent comfort level based on API operational and structural complexity.

Security

Trust, risk posture, and security compliance.

Grade: B-Signals: 1

60%

Authentication Strength

Average quality of security schemes based on authentication method strength (weakest link for OAuth2).

AI Discoverability

Findability, semantic richness, and reasoning readiness.

Grade: C-Signals: 1

51%

Descriptive Richness

Clarity and depth of descriptions across API elements.

Connect the MindFort API to your agent

Capabilities

Start building with MindFort API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs

MindFort API

Jentic AI Readiness Score

MindFort API

Foundational Compliance

Lint Results

Resolution Completeness

Specification Validity

Structural Integrity

Developer Experience & Jentic Compatibility

Example Density

Example Validity

Response Coverage

Tooling Readiness

AI-Readiness & Agent Experience

Description Coverage

Error Standardization

OperationId Quality

Summary Coverage

Agent Usability

Complexity Comfort

Security

Authentication Strength

AI Discoverability

Descriptive Richness