MCP server

Hosted MCP server

Point any Streamable HTTP MCP client at the hosted endpoint:

https://index365.co/api/mcp

Connecting is keyless. You sign in with your browser (OAuth), approve the connection, and start working. There is nothing to install, no Node, and the tool set stays current automatically.

Prefer an API key (for CI or direct HTTP)? Pass it in the Authorization: Bearer header instead, using a key from the dashboard API Keys page. See the API-key option in each section below.

Quick start

Claude Code

Add the server, then sign in with your browser. No key to paste:

claude mcp add --transport http index365 https://index365.co/api/mcp

Then run /mcp inside Claude Code and approve the browser sign-in. Claude Code opens the OAuth consent page, you approve the connection, and the tools are ready. Tokens are stored and refreshed for you.

claude mcp add --transport http index365 https://index365.co/api/mcp --header "Authorization: Bearer <your i365_ key>"

Claude.ai and Claude Desktop (custom connector)

Connect with browser sign-in, no key required:

1. Open Claude, then go to Settings, Connectors, Add custom connector.
2. Set Name to index365 and URL to https://index365.co/api/mcp. Leave the Advanced settings blank: no OAuth Client ID is needed.
3. Click Connect, then approve the browser sign-in.

API key (config file)

Prefer a key over the connector flow? Claude Desktop, Cursor, or any HTTP MCP host can read it from a JSON config. This is the API-key alternative to the OAuth connector above:

{
  "mcpServers": {
    "index365": {
      "type": "http",
      "url": "https://index365.co/api/mcp",
      "headers": { "Authorization": "Bearer <your i365_ key>" }
    }
  }
}

The hosted server mounts the read, create, and audit tools. The destructive delete_project tool is available on the local server below (otherwise delete a project from the dashboard or the REST API).

One-click connect (coming soon)

A one-click connector is on the way: connect index365 from Claude and Cursor with a single Connect button. Until then, use the custom connector flow above (browser sign-in, no key) or a Bearer API key.

Run it locally instead

Prefer to run the server on your own machine? The @index365/mcp package is published on npm, so the commands below fetch it on demand with npx and need no separate install step. The local server mounts the same tools plus the destructive delete_project.

Claude Code:

claude mcp add index365 -e INDEX365_API_KEY=<key> -- npx -y @index365/mcp

Codex, Cursor, or any MCP host (JSON config):

{
  "mcpServers": {
    "index365": {
      "command": "npx",
      "args": ["-y", "@index365/mcp"],
      "env": { "INDEX365_API_KEY": "<your i365_ key>" }
    }
  }
}

Tools

• list_projects, get_run_status, list_findings, get_finding, get_report_context: read tools that read audit results and reports.
• get_marketing_signal_report, list_integrations, list_connected_signals: Marketing Signal read tools. The report carries the five stage scores and names its evidence base (public signals until connected sources launch).
• start_audit and run_marketing_signal_audit: start paid runs. They work only when your key carries the runs:write scope, and spend organization credits.
• create_project (idempotent by domain) and delete_project: manage projects. They need the projects:write / projects:delete scopes; delete requires confirmDomainset to the project's exact domain.

Prompts ship for the common workflows: triage_findings, prepare_pr_plan (map findings to reviewable PRs in your repo), marketing_fix_plan (stage-ordered marketing fixes), and summarize_run_for_slack.

Website Security audits run through the REST API today (scanMode=paid_website_security); see the REST API page. A dedicated MCP tool is on the roadmap.

A typical agent session

> Use index365 to audit yoursite.com and fix what it finds.

1. list_projects            -> resolve the project id
2. start_audit              -> run queued
3. get_run_status (poll)    -> completed, score 68
4. get_report_context       -> top issues: missing llms.txt, weak metadata
5. prepare_pr_plan prompt   -> 2 PRs planned from findingIds
6. agent edits your repo, opens PRs, re-audits after deploy

Security model

• Keys are org-scoped and carry the full scope set, so your agent can run audits and manage projects out of the box. Keys are revocable instantly and every request is audit-logged.
• Outputs are bounded and paginated by design, so a single tool call cannot flood your agent's context.