> ## Documentation Index
> Fetch the complete documentation index at: https://docs.37audits.com/llms.txt
> Use this file to discover all available pages before exploring further.
# MCP Server
> Connect an AI client to the 37 Audits MCP server to query your organizations, projects, and audit results
**MCP Server** — gives any [Model Context Protocol](https://modelcontextprotocol.io/) client read access to your 37 Audits organizations, projects, and audit history, plus one tool to trigger a fresh audit run.
Query your monitored URLs and audit results directly from Claude, Cursor, or any MCP-compatible client.
Every tool is read-only except `run_audits`, which spends organization credits.
37 Audits exposes an MCP server over Streamable HTTP so AI clients can browse your organizations, projects, monitored URLs, and audit results without leaving the conversation. The server shares its authorization and data layer with the [37audits.com](https://www.37audits.com) website and the [REST API](/api-reference) — an MCP client only ever sees organizations the authenticated caller belongs to.
## Connecting
1. **Point your client at the endpoint** — `https://mcp.37audits.com`, using the Streamable HTTP transport.
2. **Let the client discover authorization** — an unauthenticated request receives a `401` with a `WWW-Authenticate: Bearer resource_metadata="..."` challenge. A spec-compliant client follows it to the [OAuth discovery documents](#authentication) automatically; no token needs to be pasted in.
3. **Approve access** — the client redirects you to `https://www.37audits.com/oauth/consent`, where you sign in and approve the requested scopes. The client then holds a short-lived access token and refreshes it as needed.
Desktop MCP hosts (Claude Desktop, Cursor, VS Code) don't need CORS. Browser-based clients (Claude.ai, MCP Inspector, ChatGPT) are supported too — `/mcp` and `/.well-known/**` return `Access-Control-Allow-Origin: *`.
## Authentication
The MCP server accepts two credential types on the same endpoint:
### OAuth 2.1 (recommended)
Standard OAuth 2.1 with PKCE, discovered automatically by spec-compliant clients:
| Endpoint | Purpose |
| ----------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| `/.well-known/oauth-protected-resource` | RFC 9728 — tells the client which authorization server protects `/mcp`. |
| `/.well-known/oauth-authorization-server` | RFC 8414 — authorization server metadata (authorize, token, and dynamic client registration endpoints), backed by Supabase Auth. |
Once authorized, the client sends `Authorization: Bearer ` with every request. An access token obtained another way (for example, one already used to sign in to the website) works the same way if pasted in manually.
### API key (programmatic access)
For non-interactive or server-to-server use, send an organization-scoped key as `x-api-key` instead of a bearer token. Create one at **`https://www.37audits.com/organizations/{orgSlug}/api-keys`**. The key identifies the user who created it and is scoped to one organization and role.
## Available tools
The server exposes 15 tools. All but `run_audits` are read-only, and none of them ever returns an organization, project, or record the caller isn't a member of — asking for an id you can't access returns "not found," never "forbidden."
### Organizations
| Tool | Parameters | Description |
| -------------------- | ---------- | -------------------------------------------------- |
| `list_organizations` | — | Organizations the authenticated caller belongs to. |
| `get_organization` | `idOrSlug` | One organization, by UUID or slug. |
### Projects
| Tool | Parameters | Description |
| --------------- | ------------- | -------------------------------------------------- |
| `list_projects` | `orgIdOrSlug` | Projects in an organization the caller belongs to. |
| `get_project` | `id` | One project. |
### Monitored URLs
| Tool | Parameters | Description |
| --------------------- | ----------- | --------------------------------------------------------------------------------------------------------------------------------- |
| `list_monitored_urls` | `projectId` | URLs monitored under a project. |
| `get_monitored_url` | `id` | One monitored URL. Basic-auth credentials are write-only and never returned; a `hasBasicAuth` flag indicates whether they're set. |
### Project software
| Tool | Parameters | Description |
| ------------------------ | ----------- | ------------------------------------------------------- |
| `list_project_softwares` | `projectId` | Software/tech-stack entries recorded against a project. |
| `get_project_software` | `id` | One software entry. |
### Auditor catalog
| Tool | Parameters | Description |
| --------------- | ---------- | ---------------------------------------------------------------------------- |
| `list_auditors` | — | Active auditors in the catalog. Inactive auditors are invisible, even by id. |
| `get_auditor` | `id` | One active auditor. |
### Audit results
| Tool | Parameters | Description |
| -------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
| `list_audit_results` | `urlId`, `page` (default `0`), `size` (default `20`) | Paginated audit runs for a monitored URL, newest first. |
| `get_audit_result` | `id` | One audit run. |
| `list_check_results` | `auditResultId` | Individual findings belonging to one audit run. |
| `get_check_result` | `id` | One finding. |
### Running audits
| Tool | Parameters | Description |
| ------------ | ------------------------------- | --------------------------------------------------------------------------------------------------------- |
| `run_audits` | `urlId`, `auditorId` (optional) | Runs one auditor, or every active auditor when `auditorId` is omitted, against a monitored URL right now. |
`run_audits` is the only tool that writes anything or spends credits — treat it like any other action that spends money on the user's behalf, and only call it on explicit request. It checks the organization's credit balance before running anything and fails with "insufficient credits" rather than partially running; credits are deducted only for auditors that actually complete, so a failed auditor isn't charged. Use `list_auditors`/`get_auditor` first to find a specific auditor's id if you want to run just one instead of the full catalog.
## Resources and prompts
The server exposes tools only — no MCP resources or prompts are published.