Skip to main content
Strix hosts a remote Model Context Protocol (MCP) server. An AI assistant that supports remote MCP servers can start scans, read vulnerabilities, manage schedules, and use the rest of the Strix API as tools. The server URL is:
The server uses the Streamable HTTP transport and OAuth 2.1 authorization. You do not create an API token for MCP. You sign in to Strix in the browser when the client asks.

​
Add the server to a client

Most clients ask for a name and a server URL. Enter Strix and https://app.strix.ai/mcp. The client then opens a browser window for the Strix sign-in. After you sign in and approve the request, the client can call the Strix tools.

​
Claude

Add a custom connector in the Claude connector settings. Enter the server URL and select Connect to complete the sign-in.

​
ChatGPT

Enable developer mode in the ChatGPT connector settings. Create a connector with the server URL and select OAuth as the authentication method.

​
Cursor

Add this entry to .cursor/mcp.json and complete the sign-in when Cursor asks:

​
Other clients

Any client that supports remote MCP servers with OAuth can use the same URL. If the client asks for authorization server details, the client can read them from the discovery documents that this page describes.

​
Workspace and permissions

The sign-in binds the OAuth access token to one Strix workspace. Tools then run as you, in that workspace. Your member role limits the tools that you can use. The same rules apply to API tokens:
  • A viewer can call read tools only.
  • An analyst can also call tools that start scans and change data.
  • An admin can also call tools for members, invitations, webhooks, and the audit log.
If your membership has resource-level restrictions, the tools return only the targets, tags, or business units that you can access. The MCP server does not accept a Strix API token. The REST API does not accept an MCP access token. Use API tokens with the REST API and use the OAuth sign-in with MCP.

​
Tools

The server exposes one tool for each REST API operation that works without a browser. The tool name is the operationId of the operation in the API reference. For example, the POST /api/v1/scans operation becomes the createScan tool. Each tool declares MCP annotations so that the assistant can ask for your confirmation before it makes a change: Tools that start scans, retests, PR reviews, or chats spend credits. Confirm the target with the assistant before it calls one of these tools. The server does not expose these operations:
  • API token and CLI session management.
  • Billing checkout, billing portal, and credit purchases.
  • Connector install links and connector credential intake.
  • Network connector creation and the connector deploy command.
  • LLM provider key updates and engagement credential intake.
  • File upload, scan report download, and chat workspace file download.
The createWebhook tool creates the webhook but does not return the signing secret. The updateWebhook tool cannot rotate the secret. Open the dashboard to rotate a webhook secret. Use the dashboard or the REST API for these operations.

​
Discovery documents

MCP clients find the authorization server with these documents. You do not need to read them to use the server. The protected resource metadata lists the Strix authorization server. The client does not request Strix scopes during sign-in. The server derives your permissions from your role and your RBAC settings. The permission names match the API token scopes in Authentication.

​
Errors

If a request has no valid access token, the server returns 401 Unauthorized with a WWW-Authenticate header. The header points to the protected resource metadata so that the client can start the sign-in. If a tool needs a scope that your role does not grant, the tool returns an error result with the missing scope name. The assistant can show this message to you. If a tool call fails in the REST API, the tool returns the API error message. The HTTP status of the MCP response stays 200.