MCP server

Hosted MCP server

Point any Streamable HTTP MCP client at the hosted endpoint:

https://index365.co/api/mcp

There is nothing to install, no Node, and the tool set stays current automatically. In Claude, connecting is keyless: you sign in with your browser (OAuth) and approve the connection. Clients that support custom headers pass an API key in the Authorization: Bearer header, using a key from the dashboard API Keys page. ChatGPT supports neither today; see its section. Each section below shows the exact setup for its platform.

Set up by platform

Every section below uses the same hosted URL. Claude connects with browser sign-in and no key; the other supported clients use an API key from the dashboard API Keys page today. ChatGPT is the one exception: it accepts neither, so it cannot connect yet (see its section).

Claude.ai and Claude Desktop (custom connector)

Connect with browser sign-in, no key required:

1. Open Claude, then go to Settings, Connectors, Add custom connector.
2. Set Name to index365 and URL to https://index365.co/api/mcp. Leave the Advanced settings blank: no OAuth Client ID is needed.
3. Click Connect, then approve the browser sign-in.

Claude Code

Set INDEX365_API_KEY in your environment first, then add the server. The shell expands the variable, so the key itself never lands in your shell history:

claude mcp add --transport http index365 https://index365.co/api/mcp --header "Authorization: Bearer $INDEX365_API_KEY"

Then run /mcp inside Claude Code to confirm the connection and list the tools. Browser sign-in from Claude Code is not available yet: its OAuth flow uses a loopback callback the hosted server does not accept today, so use the API key header.

Cursor

Add the server to .cursor/mcp.json in your project, or ~/.cursor/mcp.json for every project. The env interpolation keeps the key itself out of the file:

{
  "mcpServers": {
    "index365": {
      "url": "https://index365.co/api/mcp",
      "headers": { "Authorization": "Bearer ${env:INDEX365_API_KEY}" }
    }
  }
}

Set INDEX365_API_KEY in your environment, then reload Cursor and approve the server under Settings, MCP.

Codex CLI

Add a server section to ~/.codex/config.toml. bearer_token_env_var tells Codex to read the key from your environment and send it as the Authorization header, so the key never sits in the file:

[mcp_servers.index365]
url = "https://index365.co/api/mcp"
bearer_token_env_var = "INDEX365_API_KEY"

Gemini CLI

Add the server to ~/.gemini/settings.json. Note the key for a hosted server is httpUrl, not url:

{
  "mcpServers": {
    "index365": {
      "httpUrl": "https://index365.co/api/mcp",
      "headers": { "Authorization": "Bearer <your i365_ key>" }
    }
  }
}

Devin

1. Go to Settings, Connections, MCP servers, then click Add a custom MCP.
2. Name it index365, choose the HTTP transport, and set the Server URL to https://index365.co/api/mcp.
3. Set Authentication to Auth Header, keep the default Authorization header key, and set the value to Bearer followed by your i365_ key.
4. Click Save, then Test listing tools to verify the connection.

Grok (xAI API)

xAI connects to remote MCP servers from the API side: add the server to a request's tools with server_url, a server_label, and your key as authorization, which xAI sends as the Authorization header on requests to the server:

{
  "type": "mcp",
  "server_url": "https://index365.co/api/mcp",
  "server_label": "index365",
  "authorization": "Bearer <your i365_ key>"
}

ChatGPT

ChatGPT custom connectors authenticate with browser sign-in only; OpenAI does not support static API keys for connectors. index365's browser sign-in currently covers Claude clients, so ChatGPT cannot connect yet. It becomes available once index365 adds browser sign-in support for more clients (see below).

Other MCP hosts (JSON config)

Any other HTTP MCP host can read the server from a JSON config with the key in the Authorization header:

{
  "mcpServers": {
    "index365": {
      "type": "http",
      "url": "https://index365.co/api/mcp",
      "headers": { "Authorization": "Bearer <your i365_ key>" }
    }
  }
}

The hosted server lists the full 1.0 tool set: 11 tools under the index365_ prefix, covering scans, reports, findings, index365_archive_project, and index365_restore_project. The old delete_project name is unlisted in 1.0; for a grace period it still answers as an alias for index365_archive_project, which performs the same reversible archive, not a hard delete.

Browser sign-in for more clients (in development)

Today, browser sign-in works from Claude. Support for more clients is in development; as it lands, the sections above flip from key-first to sign-in-first. Until then, use the Claude custom connector flow above (browser sign-in, no key) or a Bearer API key on the platforms that accept one.

Run it locally instead

Prefer to run the server on your own machine? The @index365/mcp package is published on npm, so the commands below fetch it on demand with npx and need no separate install step. The local server mounts the same 11 tools as the hosted endpoint.

Claude Code:

claude mcp add index365 -e INDEX365_API_KEY=<key> -- npx -y @index365/mcp

Codex, Cursor, or any MCP host (JSON config):

{
  "mcpServers": {
    "index365": {
      "command": "npx",
      "args": ["-y", "@index365/mcp"],
      "env": { "INDEX365_API_KEY": "<your i365_ key>" }
    }
  }
}

Tools

• index365_start_scan: the one start tool. product is ai_readiness (default), marketing_signal, or website_security. The call waits for the scan and returns the final result in the same call; scans typically take a few minutes. A scan that outlasts the hosted wait bound returns its in-flight state instead, and index365_get_scan_status resumes from there. Starting a scan requires the runs:write scope and spends organization credits.
• index365_get_scan_status: status and recovery. If a blocking index365_start_scan call is cut off client-side, recover the in-flight run here instead of starting a new one. Responses include pollAfterSeconds so an agent knows when to check back.
• index365_get_report: the one report tool. Pass a runId, or a projectId plus productfor the latest completed report. The payload is compact by design, sized for an agent's first read. Marketing Signal reports carry the five stage scores and name their evidence base (public signals until connected sources launch).
• index365_list_findings and index365_get_finding: read a run's findings, filtered by severity, category, or stage. index365_get_finding includes a fixPrompt field, the same ready-to-paste fix prompt as the dashboard, so your agent never re-derives the fix.
• index365_list_projects, index365_create_project (idempotent by domain), index365_archive_project, and index365_restore_project: the reversible project lifecycle. Archive needs the projects:delete scope and confirmDomain set to the project's exact domain; restore needs projects:write. Creating an archived domain also restores the original project. index365_list_projects accepts status=active|paused|archived|all; omit status to exclude archived projects.
• index365_list_integrations and index365_list_connected_signals: connected signal providers for Marketing Signal.

Prompts ship for the common workflows: triage_findings, prepare_pr_plan (map findings to reviewable PRs in your repo), marketing_fix_plan (stage-ordered marketing fixes), summarize_run_for_slack, and fix_finding (turn one findingId into an applied fix; maps to a slash command in Claude Code and Cursor).

The product enum already includes website_security, but Website Security is not yet available over MCP: index365_start_scan returns a clear not-yet-available error for that product until it ships. Until then, Website Security scans run through the REST API (scanMode=paid_website_security); see the REST API page.

Migrating from 0.x

MCP 1.0.0 puts every tool under the index365_ vendor prefix and consolidates the start and report tools, with product as an input instead of separate tools per product. The old tool names, including delete_project, are unlisted in 1.0 but keep answering for at least 90 days: each call runs the new tool and prepends a one-line rename note. Update configs, prompts, and saved workflows to the new names before the grace period ends.

A typical agent session

> Use index365 to scan yoursite.com and fix what it finds.

1. index365_list_projects   -> resolve the project id
2. index365_start_scan      -> waits for the scan, returns the result: score 68
3. index365_get_report      -> top issues: missing llms.txt, weak metadata
4. index365_get_finding     -> fixPrompt per finding; agent applies each fix in your repo
5. index365_start_scan      -> re-scan to confirm the score moved

Security model

• Keys are org-scoped and carry the full scope set, so your agent can run scans and manage projects out of the box. Keys are revocable instantly and every request is audit-logged.
• Outputs are bounded and paginated by design, so a single tool call cannot flood your agent's context.