Integration · Developer tools

Connect Claude & ChatGPT to Cantina

Ask your AI which findings are open in a Cantina security review, what changed on a finding, or how many findings came in this week. It can read repositories and their code files, submit and update findings, comment and escalate, and search published reports, using the permissions of the manager who created your API key.

Connect Cantina free

Free plan, no credit card. Takes about a minute.

Try asking

“List the high-severity findings in our audit repository.”
The AI finds the repository and lists its findings with a severity filter.
“Summarize finding 42 and what has happened on it.”
It reads the finding with description, severity, status and assignee, plus its change history.
“Assign finding 42 to Alex and set severity to medium.”
It updates the finding's assignee and severity.

What your AI can do

Findings

List, read, submit and update findings, see their change history, comment on them and escalate them to reviewers.

Repositories and people

List and read repositories, their code files, comments, users and your own role, plus companies and company users.

Reports and insights

Search and read published security review reports, and get finding statistics for a repository.

“Reply to the latest comment on finding 17.”
It posts a comment on the finding as a reply to that comment. Other participants can see it.
“How many findings has the review received since Monday?”
It reads the repository's finding statistics and insights since that date.
“Show me the file the finding points to.”
It lists the repository's code files and reads the one you need.

99 tools for Cantina

These tools are switched on when you connect. You can switch any of them off, or require your approval before it runs.

add_a_user_to_a_repositoryChanges dataCreate a new user for a company. Required: user id or repository role. Search users first to avoid duplicates. API summary: Add a user to a repository.
approve_userVisible to othersAccept a user (user id). Has effects visible outside this system. API summary: Accepts an unverified or previously disabled company user to a company.
comment_on_findingChanges dataPost a comment on a finding (`repo_id`, `finding_ref`) with `content`; optionally reply to a `parent` comment. Other participants can see it.
create_an_sso_enforcement_rule_for_a_companyChanges dataCreate a new company for a company. Required: domain. Search companies first to avoid duplicates. API summary: Create an SSO enforcement rule for a company.
create_askChanges dataCreate a new ask. Required: prompt or conversation id. API summary: Ask the AI service a question about a repository.
create_comment_reactChanges dataCreate a new react for a comment. Required: reaction. API summary: Add a reaction to a comment on a finding in a repository.
create_companyChanges dataCreate a new company for a company. Required: provider, provider base url, client id, client secret or domains. Search companies first to avoid duplicates. API summary: Configure SSO for a company.
create_company_company_usersVisible to othersCreate a new company. Required: company user ids. Search companies first to avoid duplicates. Has effects visible outside this system. API summary: Batch add company users to a repository.
create_company_customerChanges dataCreate a new customer for a company. API summary: Allows a company member to join a repo as a client and company managers to join a repo as admin.
create_company_finding_viewChanges dataCreate a new finding view for a company. Required: personal, name or filter. Search finding views first to avoid duplicates.
create_company_join_soloChanges dataCreate a new join solo for a company. API summary: Allows an auditor to join a repo as a solo team.
create_company_join_teamChanges dataCreate a new join team for a company. Required: team id. API summary: Allows an auditor, who is a team leader to join a repository as a team.
create_company_managerChanges dataCreate a new manager for a company. Required: user ref. API summary: Promotes a company user to a company manager.
create_company_reset_pingChanges dataCreate a new reset ping for a company. API summary: Reset ping counts for all reviewers. It will recalculate the ping counts for all reviewers, not considering spent pings.
create_company_userChanges dataCreate a new user for a company. Required: name, username, email or role. Search users first to avoid duplicates. API summary: Create a new user and add them to the company.
create_document_reactChanges dataCreate a new react for a document. Required: reaction. API summary: Add a reaction to a comment on a file in a repository.
create_evaluate_draft_qualityChanges dataCreate a new evaluate draft quality. Required: title, description or severity. API summary: Evaluate the quality of a finding before submitting it.
create_findingChanges dataSubmit a new finding to a repository: `repo_id`, `title`, `severity`, `description`, plus optional impact, likelihood, category and related files.
create_sharedChanges dataCreate a new shared. API summary: Endpoint to record that a repository badge was shared on Twitter.
create_subscriptionChanges dataCreate a new subscription. Required: target url. API summary: Endpoint to create a Zapier subscription.
create_webhookDeletesCreate a new webhook. Required: installation. Destructive action; may require approval. API summary: Webhook endpoint called by GitHub on events related to Cantina GitHub App.
delete_a_user_from_a_repositoryDeletesPermanently delete a user by user id. Destructive action; may require approval. API summary: Delete a user from a repository.
delete_an_sso_enforcement_rule_for_a_companyDeletesPermanently delete a company by rule id. Destructive action; may require approval. API summary: Delete an SSO enforcement rule for a company.
delete_comment_reactsMoves moneyPermanently delete a react by comment id. Financial or irreversible action; may require approval. API summary: Delete a reaction from a comment on a finding in a repository.
delete_companyDeletesPermanently delete a company by connection id. Destructive action; may require approval. API summary: Delete an SSO connection for a company.
delete_company_finding_viewDeletesPermanently delete a finding view by view id. Destructive action; may require approval.
delete_company_managerDeletesPermanently delete a manager by manager id. Destructive action; may require approval. API summary: Changes a manager to member in a company.
delete_company_userDeletesPermanently delete a user by user id. Destructive action; may require approval. API summary: Removes a company user from a company.
delete_documentDeletesPermanently delete a document by comment id. Destructive action; may require approval. API summary: Delete a comment from a file.
delete_document_reactsMoves moneyPermanently delete a react by comment id. Financial or irreversible action; may require approval. API summary: Delete a reaction from a comment on a file in a repository.
delete_finding_messageDeletesPermanently delete a message by message id. Destructive action; may require approval. API summary: Delete a comment from a finding in a repository.
delete_installationDeletesPermanently delete a installation by installation uuid. Destructive action; may require approval. API summary: Delete a pending GitHub installation record.
delete_subscriptionDeletesPermanently delete a subscription by subscription id. Destructive action; may require approval. API summary: Deletes a Zapier subscription.
download_companyDownload the document for a company. API summary: Download a single repository as a gzipped tarball.
escalate_findingVisible to othersEscalate a finding (`repo_id`, `finding_ref`) with an explanatory `comment_content`. Notifies the reviewers.
get_a_public_client_profileList companies for a company. API summary: Get a public client profile.
get_companyGet one company by `company_id`.
get_company_teamGet one team for a company by team id. API summary: Retrieves repository team by id.
get_company_userGet one user for a company by user id. API summary: Get the user information in the context of a repository.
get_documentGet one document by path. API summary: List the comments for a specific file or a single comment.
get_findingGet one finding by `repo_id` and `finding_ref`, with description, severity, status and assignee.
get_metadataGet one metadata by path. API summary: Get the metadata of a single file.
get_my_repository_roleGet your own membership and role in a repository (`repo_id`).
get_reportGet one report by `report_id`; set `with_files` to include its files.
get_repositoryGet one repository by `repo_id`, including scope, timeframe, status and reward settings.
get_repository_fileGet the contents of one file in a repository by `repo_id` and `path`.
get_repository_insightsGet finding statistics and insights for a repository (`repo_id`), optionally since a date.
get_subscriptionGet one subscription by subscription id. API summary: Endpoint to retrieve a Zapier subscription.
list_all_findingsList findings across all your repositories, with optional search/filter `s`.
list_companiesList the Cantina companies (organisations) you belong to.
list_companies_company_change_logList companies for a company. API summary: Returns a company's change log.
list_company_aisList ais for a company. API summary: Ask the AI service about the status of a given repository.
list_company_audit_logsList audit logs for a company. Optional filters: target users, actions, since, performing users or order by. Results are paginated. API summary: Get company audit log.
list_company_invitesList invites for a company. API summary: Returns invites for user for the repository.
list_company_logsList logs for a company. API summary: Returns a repository's change log.
list_company_my_teamsList my teams for a company. API summary: Information about the reviewer's team participating in the repository.
list_company_publicsList publics for a company. API summary: Get a single public repository.
list_company_repositoriesList all repositories belonging to a company (`company_id`).
list_company_teamsList teams for a company. API summary: List teams participating in the repository.
list_company_usersList users in a company (`company_id`), searchable with `q`.
list_domainsList domains. API summary: List all SSO enforcement rule domains.
list_event_samplesList samples for a event. API summary: Endpoint to return sample data for the Zap editor, helping users test triggers and map fields before activating their Zap.
list_finding_eventsList the history of changes on a finding by `repo_id` and `finding_ref`.
list_findingsList findings in a repository (`repo_id`), with optional search/filter `s` and paging.
list_github_repositoriesList repositories for a github. API summary: Endpoint to list the GitHub repositories the Cantina App has access to for a given account.
list_installation_callbacksList installation callbacks. Optional filters: installation id, code, setup action or state. API summary: Endpoint called by GitHub post-installation.
list_installation_linksList installation links. API summary: Returns the GitHub App installation link.
list_installationsList installations. API summary: Endpoint to list the GitHub organizations the Cantina App has been installed in.
list_labelsList the finding labels used across your repositories.
list_leaderboardsList leaderboards. API summary: Get the Pectra leaderboard.
list_reportsList published security review reports, searchable by `q`.
list_repositoriesList the security review repositories (audits, competitions, bounties) you can access, filtered by text `q`, kind, role or status.
list_repository_commentsList comments in a repository (`repo_id`), filtered by text, resolved, pinged or author.
list_repository_filesList the code files in a repository (`repo_id`).
list_repository_usersList the people in a repository (`repo_id`), optionally filtered by name or role.
list_reviewer_badgesList badges for a reviewer. API summary: Reviewer's badge for a repository, accepting either username or user ID as input.
list_sso_connections_for_a_companyList companies for a company. API summary: List SSO connections for a company.
list_sso_enforcement_rules_for_a_companyList companies for a company. API summary: List SSO enforcement rules for a company.
list_teamsList teams. API summary: Get the leaderboard for the competition (per team).
list_usersList users. API summary: Get company audit log users.
list_users_list_all_repo_usersList users. Optional filters: repositories or role. API summary: List all repository users across repositories the user has access to.
refund_finding_submission_feeMoves moneyRefund a finding (finding ref). Financial or irreversible action; may require approval. API summary: Refund finding submission fee.
search_company_finding_viewsSearch finding views for a company. Use this to find existing finding views before creating a new finding view. API summary: List the user's finding views.
search_publicsSearch publics by kind, q, status or role. Use this to find existing publics before creating a new public. API summary: List repositories of public contests and bounties.
search_rate_limit_statusesSearch rate limit statuses. Use this to find existing rate limit statuses before creating a new rate limit status. API summary: Get the current finding submission rate-limit status for the requester.
submit_user_inviteVisible to othersResend a user (user id). Has effects visible outside this system. API summary: Resend a user invite email.
update_a_single_repositoryChanges dataUpdate an existing company identified by repo id. Only the fields you pass are changed. API summary: Update a single repository.
update_companyChanges dataUpdate an existing company identified by company id. Only the fields you pass are changed. API summary: Update company information.
update_company_commit_hashesVisible to othersUpdate an existing commit hash identified by repo id. Has effects visible outside this system. API summary: Change the commit hash of an existing repository.
update_company_documentChanges dataUpdate an existing document identified by path prefix. Only the fields you pass are changed. API summary: Update the metadata of files from a given repository based on the provided path prefix.
update_company_finding_viewChanges dataUpdate an existing finding view identified by view id. Only the fields you pass are changed. API summary: Update a finding view.
update_company_labelsVisible to othersUpdate an existing label identified by repo id. Only the fields you pass are changed. Has effects visible outside this system. API summary: Update the labels of a single repository.
update_company_reviewerChanges dataUpdate an existing reviewer identified by user id. Only the fields you pass are changed. API summary: Give back a ping to a reviewer.
update_company_teamChanges dataUpdate an existing team identified by team id. Only the fields you pass are changed. API summary: Update repository team.
update_company_userChanges dataUpdate an existing user identified by user id. Only the fields you pass are changed. API summary: Update the user information in the context of a repository.
update_documentChanges dataUpdate an existing document identified by path. API summary: Comment on a file.
update_findingChanges dataUpdate a finding by `repo_id` and `finding_ref`: status, severity, labels, assignee, title, description, duplicate link or fix info.
update_finding_commentChanges dataEdit your comment `message_id` on a finding (`repo_id`, `finding_ref`) with new `content`.
update_user_companiesVisible to othersUpdate an existing company identified by user id. Only the fields you pass are changed. Has effects visible outside this system. API summary: Update the repository access for a company user.

Set up in three steps

1
Pick the app
Create a free HeyMyApps account and choose Cantina from the app list.
2
Paste your key
Paste a Cantina API key. Sign in as a Company Manager, open Settings > API keys, click Generate New API Key, set an expiration date and copy the key. It is shown only once.
3
Add the link to your AI
You get a personal MCP link. Add it to Claude, ChatGPT or Cursor:
1. Click your name, then Settings › Connectors › Add custom connector.
2. Paste your link as the Remote MCP server URL.
3. Switch it on from the + menu in a chat.

Questions

What can the AI do in Cantina?

The AI can read repositories, their files, comments and users, findings and their history, labels, companies, company users, reports and repository insights. It can submit findings, update findings, comment on them, edit its own comments and escalate a finding to the reviewers.

Does the AI see my Cantina credentials?

No. Your Cantina credentials are encrypted at rest and never shown to the AI. After you save them, they are not shown again, not even to you. The AI only sees the results of the tools it calls.

Can I control what the AI is allowed to do?

Yes. You choose which tools are switched on, so you can start read-only. Escalating a finding notifies the reviewers, and comments are visible to other participants. These can require your approval before they run. Every tool call is logged.

Does it work with ChatGPT?

Yes. In ChatGPT go to Settings › Apps & Connectors › Advanced and turn on Developer mode, then add your HeyMyApps link. Developer mode needs a paid ChatGPT plan: Plus, Pro, Business or Enterprise. The same link also works in Claude (Settings › Connectors › Add custom connector), Cursor and other MCP clients.

What does it cost?

HeyMyApps has a free plan with no credit card required. Paid plans bill per completed task. You also need your own Cantina account.

What permissions does the Cantina API key have?

The key has the permissions of the Company Manager who created it. You set an expiration date when you generate it under Settings > API keys, and the key is shown only once. The tools you switch on in HeyMyApps limit the AI further.