# Cantina Apex

> Apex by Cantina provides AI penetration testing, code security, findings with exploit evidence, and verification of proposed fixes. Connect your coding agent to an existing workspace or plan a new scan.

## Product information and evidence

- [Apex by Cantina](https://www.cantina.security/apex): Product capabilities and evaluation.
- [Cantina documentation](https://docs.cantina.security/apex): Platform and product setup.
- [Research](https://www.cantina.security/research): Benchmarks and field reports with methodology and limitations.
- [Published disclosures](https://www.cantina.security/disclosures): Vulnerabilities and vendor responses.

## Start here

- [Agent connection guide](https://apex.cantina.security/docs/agents.md): Plain Markdown instructions for setup, device login, existing workspace selection, and reviewing completed scans. Setup does not start a new scan.
- [Trial onboarding](https://apex.cantina.security/skills/onboarding.md): Use only when the user supplies a Cantina trial code.

## Guides and reference

- [Docs](https://apex.cantina.security/docs): Set up Apex by Cantina for AI code security, penetration testing, validated findings, and fix verification through the app, CLI, API, or MCP.
- [Connect agent](https://apex.cantina.security/docs/agents): Connect Claude Code, Codex, Cursor, or Copilot to Apex with local or hosted MCP, authenticate, and review findings from an existing scan.
- [Onboarding](https://apex.cantina.security/docs/onboarding): Connect GitHub or GitLab to Apex, select repositories, create a workspace, and prepare security context before your first code security scan.
- [Workspaces](https://apex.cantina.security/docs/workspaces): Manage Apex workspace scope, repositories, scan history, and findings. Archive inactive workspaces and restore them without deleting their history.
- [Scan manual](https://apex.cantina.security/docs/manual): Choose Apex full scans, PR scans, or Fix Review; define a threat model and repository scope; and plan security coverage for larger codebases.
- [Fix Review](https://apex.cantina.security/docs/fix-review): Verify proposed security fixes with Apex Fix Review, including finding selection, agent handoff, pull requests, bulk review, and post-fix verification.
- [Scheduled scans](https://apex.cantina.security/docs/scheduled-scans): Configure recurring Apex workspace scans and Fix Review, select a daily or weekly cadence, and understand scheduling prerequisites and controls.
- [CLI](https://apex.cantina.security/docs/apex-cli): Install Apex CLI, authenticate with device login, bind an existing workspace, and use security scans, findings, and local MCP tools from your terminal.
- [API](https://apex.cantina.security/docs/apex-api): Integrate Apex using its REST API or hosted MCP: configure authentication and scopes, start authorized scans, poll status, and retrieve findings.

## Integration endpoints

- Local coding agents: install Apex CLI and register the apex-mcp stdio server; authenticate with device login.
- Hosted MCP: https://ai.cantina.xyz/mcp (Streamable HTTP, organization service key or supported ChatGPT/Codex OAuth connection).
- REST: https://apex.cantina.security/docs/apex-api (service key scopes and endpoint reference).