Skip to main content
MCP Server — gives any Model Context Protocol client read access to your 37 Audits organizations, projects, and audit history, plus one tool to trigger a fresh audit run.

AI Readiness

Query your monitored URLs and audit results directly from Claude, Cursor, or any MCP-compatible client.

Read-only by default

Every tool is read-only except run_audits, which spends organization credits.
37 Audits exposes an MCP server over Streamable HTTP so AI clients can browse your organizations, projects, monitored URLs, and audit results without leaving the conversation. The server shares its authorization and data layer with the 37audits.com website and the REST API — an MCP client only ever sees organizations the authenticated caller belongs to.

​
Connecting

  1. Point your client at the endpoint — https://mcp.37audits.com, using the Streamable HTTP transport.
  2. Let the client discover authorization — an unauthenticated request receives a 401 with a WWW-Authenticate: Bearer resource_metadata="..." challenge. A spec-compliant client follows it to the OAuth discovery documents automatically; no token needs to be pasted in.
  3. Approve access — the client redirects you to https://www.37audits.com/oauth/consent, where you sign in and approve the requested scopes. The client then holds a short-lived access token and refreshes it as needed.
Desktop MCP hosts (Claude Desktop, Cursor, VS Code) don’t need CORS. Browser-based clients (Claude.ai, MCP Inspector, ChatGPT) are supported too — /mcp and /.well-known/** return Access-Control-Allow-Origin: *.

​
Authentication

The MCP server accepts two credential types on the same endpoint: Standard OAuth 2.1 with PKCE, discovered automatically by spec-compliant clients: Once authorized, the client sends Authorization: Bearer <token> with every request. An access token obtained another way (for example, one already used to sign in to the website) works the same way if pasted in manually.

​
API key (programmatic access)

For non-interactive or server-to-server use, send an organization-scoped key as x-api-key instead of a bearer token. Create one at https://www.37audits.com/organizations/{orgSlug}/api-keys. The key identifies the user who created it and is scoped to one organization and role.

​
Available tools

The server exposes 15 tools. All but run_audits are read-only, and none of them ever returns an organization, project, or record the caller isn’t a member of — asking for an id you can’t access returns “not found,” never “forbidden.”

​
Organizations

​
Projects

​
Monitored URLs

​
Project software

​
Auditor catalog

​
Audit results

​
Running audits

run_audits is the only tool that writes anything or spends credits — treat it like any other action that spends money on the user’s behalf, and only call it on explicit request. It checks the organization’s credit balance before running anything and fails with “insufficient credits” rather than partially running; credits are deducted only for auditors that actually complete, so a failed auditor isn’t charged. Use list_auditors/get_auditor first to find a specific auditor’s id if you want to run just one instead of the full catalog.

​
Resources and prompts

The server exposes tools only — no MCP resources or prompts are published.