AgentKeeper MCP Server

AgentKeeper MCP Server lets approved AI assistants query AgentKeeper evidence through a hosted, governed MCP endpoint. Use it when a SOC copilot, coding assistant, SOAR workflow, GRC assistant, or internal agent needs scoped access to AgentKeeper activity, investigations, workstation posture, Gateway posture, policy context, and audit-ready summaries.

This is not a generic connector and it is not the local MCP Gateway. Treat it like API access for AI clients: credentials live in Settings > MCP Server, every call is scoped, every result is redacted by default, and every request leaves an audit trail.

Only Owners and Admins can create, rotate, enable, disable, or review hosted AgentKeeper MCP Server clients. Developers and legacy Members cannot access the client management screen or client audit diagnostics.

Where this belongs

AgentKeeper has multiple MCP-related surfaces. They solve different jobs.

If you are configuring Claude Desktop, Cursor, or another client to route developer MCP tools through AgentKeeper, start with MCP Gateway. If you are giving an assistant access to AgentKeeper's own security evidence, stay here.

What ships now

Prompt evidence remains sealed in MCP responses. The hosted MCP Server does not expose a raw prompt unseal tool in this release; human dashboard unseal remains owner/admin-only with a required reason and audit log.

Setup in under 10 minutes

1. Open Settings > MCP Server as an owner or admin.
2. Create a service-account client.
3. Keep standard redaction unless Security approves a narrower or deeper profile.
4. Grant only the scopes the assistant needs.
5. Store the visible-once ak_mcp_... token.
6. Copy the MCP URL and config snippet into the client.
7. Select Claude Code, Cursor, or VS Code and copy the generated config. Run Run real data test to check initialization, tool discovery, and a live security summary.
8. Ask the assistant for a security summary or bounded activity search.

To expand or reduce an existing client's access, open it in the Clients table and select Change permissions. The existing token keeps working, the new scope set applies immediately, and the change is written to both the MCP audit trail and the organization admin audit log.

Client configuration

Use this shape for MCP clients that support remote Streamable HTTP servers.

{
  "mcpServers": {
    "agentkeeper": {
      "type": "http",
      "url": "https://agentkeeper.dev/api/mcp",
      "headers": {
        "Authorization": "Bearer ak_mcp_REPLACE_WITH_VISIBLE_ONCE_SECRET"
      }
    }
  }
}

Some clients use slightly different names for remote HTTP MCP servers. Keep the values the same: URL /api/mcp, header Authorization: Bearer ..., and protected-resource metadata URL /.well-known/oauth-protected-resource.

Claude Code

claude mcp add agentkeeper --transport http https://agentkeeper.dev/api/mcp \
  --header "Authorization: Bearer ak_mcp_REPLACE_WITH_VISIBLE_ONCE_SECRET"

Run claude mcp list or /mcp in Claude Code to confirm the server is registered.

Cursor

Add this to .cursor/mcp.json:

{
  "mcpServers": {
    "agentkeeper": {
      "url": "https://agentkeeper.dev/api/mcp",
      "headers": {
        "Authorization": "Bearer ak_mcp_REPLACE_WITH_VISIBLE_ONCE_SECRET"
      }
    }
  }
}

Restart Cursor after changing the file.

VS Code

Add this to .vscode/mcp.json:

{
  "servers": {
    "agentkeeper": {
      "type": "http",
      "url": "https://agentkeeper.dev/api/mcp",
      "headers": {
        "Authorization": "Bearer ak_mcp_REPLACE_WITH_VISIBLE_ONCE_SECRET"
      }
    }
  }
}

Windsurf

Add this to ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "agentkeeper": {
      "serverUrl": "https://agentkeeper.dev/api/mcp",
      "headers": {
        "Authorization": "Bearer ak_mcp_REPLACE_WITH_VISIBLE_ONCE_SECRET"
      }
    }
  }
}

Restart the client after editing its MCP config.

Embed in an internal agent

Use the official MCP TypeScript client with a token supplied by your secret manager. Do not embed a service token in browser code, commit it, or paste it into a model prompt.

import { Client } from "@modelcontextprotocol/sdk/client/index.js";
import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";

const client = new Client({ name: "internal-security-agent", version: "1.0.0" });
const transport = new StreamableHTTPClientTransport(new URL(process.env.AGENTKEEPER_MCP_URL!), {
  requestInit: { headers: { Authorization: `Bearer ${process.env.AGENTKEEPER_MCP_TOKEN}` } },
});
await client.connect(transport);
try {
  const result = await client.callTool({ name: "agentkeeper_get_security_summary", arguments: { window_hours: 24 } });
  if (result.isError) throw new Error("AgentKeeper tool call failed");
  // Preserve result IDs, omissions, redaction metadata, and links in your agent's output.
  console.log(result.structuredContent);
} finally {
  await transport.terminateSession();
  await client.close();
}

The endpoint uses JSON responses to POST requests. GET returns 405 because it does not offer an SSE stream. Deleted or expired session IDs return 404; initialize again. This release uses manually provisioned bearer tokens, not an interactive OAuth sign-in flow. Clients that require OAuth-only remote connectors are not supported.

Questions to try

Start with prompts that force the assistant to cite result scope before making claims.

• "Ask AgentKeeper for a security summary for the last 24 hours. Include the redaction profile, omissions, and links."
• "Search AgentKeeper activity for blocked or warned MCP activity today, then summarize the top investigative questions."
• "Prepare an investigation brief for the highest-severity open alert, including timeline, host posture, policy decision, and omitted data."
• "Compare MCP Gateway drift and list unmanaged or runtime-only MCP servers with affected hosts."
• "Search Agent Inventory for every skill, plugin, and MCP server observed in the last 30 days. Include install coverage, usage, risk, policy posture, and omissions."
• "Search the full AI Discovery queue for high-risk items, then retrieve the evidence samples, complete counts, omissions, and newest review history for the top result."
• "Create an audit-ready evidence packet for this customer question, but do not include raw prompts or tool payloads."

Scopes

Denied calls return the required scopes and the scopes the client actually has, so admins can understand the exact permission gap before changing credentials.

Write scopes do not unlock destructive administration. The v1 governed write surface is limited to investigation acknowledgement, assignment, comments, exception requests, and export requests. Policy edits, deletes, unblock actions, raw evidence reveal, client administration, and broad mutation tools are excluded.

Redaction profiles

Every tool response includes:

{
  "schema_version": "agentkeeper.mcp.v1",
  "result_id": "...",
  "org_id": "...",
  "source": "agentkeeper.activity",
  "time_window": { "from": "...", "to": "..." },
  "redaction_profile": "standard",
  "result_cap": 50,
  "next_cursor": "...",
  "links": [],
  "summary": {},
  "evidence": [],
  "redactions": {
    "profile": "standard",
    "redacted": 4,
    "omitted": 0,
    "capped": 2,
    "notes": []
  },
  "omissions": []
}

The assistant should cite result_id, time window, redaction profile, omissions, and console links whenever it prepares an incident summary or audit packet.

Response contract

AgentKeeper returns model-readable evidence, not chat-shaped prose. Each response should make it obvious what was searched, what was capped, what was redacted, and where a human can verify the source.

Tools

Tool descriptions are intentionally model-readable. They explain the required scopes, bounded windows, caps, and how to use links for console drill-down.

The new Inventory and AI Discovery tools are read-only. They cannot approve or reclassify a discovery, edit skill policy, install or remove software, or modify a workstation. inventory:read and ai_discovery:read are separate, and AI Discovery must be selected explicitly, so neither an existing client nor a new default read-only client silently gains review, owner, note, risk, or evidence data.

Inventory results distinguish installed/reporting evidence from observed usage. A workstation that has not reported inventory is not counted as a confirmed absence. AI Discovery results preserve configured, inventoried, and observed source provenance; a discovered or approved item is not automatically routed, protected, or enforced.

Every AI Discovery response includes summary.source_availability. If an inventory source, optional integration, or activity collector is unavailable, complete is false, failure counts and sanitized error codes are returned, and omissions states that totals are partial. An unavailable source is never presented as an empty source.

Activity pages preserve all returned rows before advancing next_cursor. Investigation, workstation, and gateway searches accept a one-based page and report next_page. Invalid arguments are rejected rather than silently ignored. Nested evidence and long text remain profile-capped, with truncation counts in redactions.

Investigation acknowledgement, comments, and assignment are atomic and idempotent per client and case. Reusing an idempotency key with a different action or payload is rejected. Acknowledgement does not reopen resolved cases or change policy enforcement.

Resources

Export jobs run every minute and expire after seven days. They are client-bound snapshots, not unlimited bulk downloads. Activity exports include at most 200 events plus a continuation cursor; use the original time window with agentkeeper_search_activity for additional pages. Investigation and host exports are current snapshots. Drift exports use the exact requested event window plus current inventory and control posture. The underlying read scopes are required as well as evidence:export.

Prompts

Prompts do not perform hidden actions. They give the assistant a disciplined workflow that starts with redaction, omissions, and time windows before making claims.

Admin review before enabling a client

Before credentials are used, review the client like an API key with an AI-specific blast radius.

Support diagnostics

Support can diagnose a request with:

• Client ID
• Org ID
• Request ID
• Session hash
• Audit event ID
• Protocol method
• Tool, resource, or prompt name
• Redaction profile and counts
• Denied scope
• Rate-limit state
• Timestamp and user agent

Security model

Read access excludes destructive admin actions, raw profile exposure by default, unbounded analytics scans, and policy mutation. Large exports should return jobs and durable resource links rather than streaming huge windows through MCP.

The highest-risk classes are cross-org access, token leakage, redaction leaks, unbounded queries, and client compatibility drift. Treat those as launch gates, not polish.

Troubleshooting

Product benchmark

The setup experience should feel like the best modern hosted MCP servers: obvious endpoint, no local install, copyable client snippets, practical prompts to try, clear authentication guidance, live test transcript, and client-specific troubleshooting. AgentKeeper's differentiator is the security layer around the evidence: redaction by default, policy context, auditability, durable links, transparent permission explanations, and enterprise-safe summaries.