> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting OpenCVE to Neo

> Create an OpenCVE Organization API Token, save it in Neo, and turn OpenCVE on per agent

You connect OpenCVE once at the MSP level, with a token of your OpenCVE organization on OpenCVE Cloud (app.opencve.io).

## 1. Create an Organization API Token

**1. Open your organization's settings**

Sign in to OpenCVE and open your organization's settings, then its API tokens.

**2. Create the token**

Create a token and give it a name such as `neo-agent`. A read-only token is enough to look up and search CVEs and read projects. Choose read-write only if agents should triage CVEs or change projects. On the Pro plan and up you can pick scopes instead: `catalog:read` is required, and add the read or write scope of each area you turn on in Neo (the table in step 3).

**3. Copy the token**

Copy the token. It starts with `opc_org.` and OpenCVE shows it only once.

## 2. Add the token in Neo

**1. Open Integrations**

In the Neo Dashboard, open **Integrations** and find the OpenCVE card, under Vulnerability & Attack Surface.

**2. Save the token**

Paste the **Organization API Token** and click **Save**. Neo reads one CVE with the token before saving, so a wrong token, or one without the `catalog:read` scope, is reported straight away. That check uses one call of your hourly API limit.

## 3. Turn OpenCVE on per agent

Open the agent, go to the **Tools & Settings** tab, and configure the OpenCVE block under **Tools & Integrations**. Pick a profile, or set each area:

| Area | Access levels you can pick | OpenCVE token scopes | Notes |
| - | - | - | - |
| **CVE Catalog** | Disabled, Read Only | `catalog:read` | CVE lookups and searches, vendors, products, weaknesses. Every OpenCVE job needs it. |
| **Projects and Subscriptions** | Disabled, Read Only, Read/Write | `projects`, `subscriptions`, `reports` | Helpdesk asks a technician before each change. |
| **CVE Tracker** | Disabled, Read Only, Read/Write | `tracker` | A project's CVEs with their triage status and assignee. |
| **Notifications and Automations** | Disabled, Read Only, Read/Write | `notifications`, `automations` | Neo shows each notification's address by host only, and hides header values. Helpdesk asks before each change. |
| **Organization and Members** | Disabled, Read Only, Read/Write | `org`, `members`, `audit_logs` | IT Admin asks a technician before a member is invited, changed or removed. |

The **Read Only** profile changes nothing in OpenCVE. To check CVEs against a client's devices, also give the agent read access to the integrations that hold them, such as the Datto RMM audit, the Auvik inventory and the IT Glue configurations.

See [OpenCVE API](https://docs.neoagent.io/agents/tools/security/opencve-api.md) for what the agent can do.

## Set up an agent

Ask your Neo Support Agent for the agent you need, for example: "Set up a chat agent for my technicians that looks up CVEs in OpenCVE, read-only, and checks a CVE against a client's software in Datto RMM, network devices in Auvik and configurations in IT Glue."


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.