AgentKeeper MCP Server

AgentKeeper MCP Server lets approved AI assistants query AgentKeeper evidence through a hosted, governed MCP endpoint. Use it when a SOC copilot, coding assistant, SOAR workflow, GRC assistant, or internal agent needs scoped access to AgentKeeper activity, investigations, workstation posture, Gateway posture, policy context, and audit-ready summaries.

This is not a generic connector and it is not the local MCP Gateway. Treat it like API access for AI clients: credentials live in Settings > MCP Server, every call is scoped, every result is redacted by default, and every request leaves an audit trail.

Only Owners and Admins can create, rotate, enable, disable, or review hosted AgentKeeper MCP Server clients. Developers and legacy Members cannot access the client management screen or client audit diagnostics.

Where this belongs

AgentKeeper has multiple MCP-related surfaces. They solve different jobs.

If you are configuring Claude Desktop, Cursor, or another client to route developer MCP tools through AgentKeeper, start with MCP Gateway. If you are giving an assistant access to AgentKeeper's own security evidence, stay here.

What ships now

Prompt evidence remains sealed in MCP responses. The hosted MCP Server does not expose a raw prompt unseal tool in this release; human dashboard unseal remains owner/admin-only with a required reason and audit log.

Setup in under 10 minutes

1. Open Settings > MCP Server as an owner or admin.
2. Create a service-account client.
3. Keep standard redaction unless Security approves a narrower or deeper profile.
4. Grant only the scopes the assistant needs.
5. Store the visible-once ak_mcp_... token.
6. Copy the MCP URL and config snippet into the client.
7. Run the setup center test connection.
8. Ask the assistant for a security summary or bounded activity search.

Client configuration

Use this shape for MCP clients that support remote Streamable HTTP servers.

{
  "mcpServers": {
    "agentkeeper": {
      "type": "http",
      "url": "https://agentkeeper.dev/api/mcp",
      "headers": {
        "Authorization": "Bearer ak_mcp_REPLACE_WITH_VISIBLE_ONCE_SECRET"
      }
    }
  }
}

Some clients use slightly different names for remote HTTP MCP servers. Keep the values the same: URL /api/mcp, header Authorization: Bearer ..., and protected-resource metadata URL /.well-known/oauth-protected-resource.

Claude Code

claude mcp add agentkeeper --transport http https://agentkeeper.dev/api/mcp \
  --header "Authorization: Bearer ak_mcp_REPLACE_WITH_VISIBLE_ONCE_SECRET"

Run claude mcp list or /mcp in Claude Code to confirm the server is registered.

Cursor

Add this to .cursor/mcp.json:

{
  "mcpServers": {
    "agentkeeper": {
      "url": "https://agentkeeper.dev/api/mcp",
      "headers": {
        "Authorization": "Bearer ak_mcp_REPLACE_WITH_VISIBLE_ONCE_SECRET"
      }
    }
  }
}

Restart Cursor after changing the file.

VS Code

Add this to .vscode/mcp.json:

{
  "servers": {
    "agentkeeper": {
      "type": "http",
      "url": "https://agentkeeper.dev/api/mcp",
      "headers": {
        "Authorization": "Bearer ak_mcp_REPLACE_WITH_VISIBLE_ONCE_SECRET"
      }
    }
  }
}

Windsurf

Add this to ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "agentkeeper": {
      "serverUrl": "https://agentkeeper.dev/api/mcp",
      "headers": {
        "Authorization": "Bearer ak_mcp_REPLACE_WITH_VISIBLE_ONCE_SECRET"
      }
    }
  }
}

Restart the client after editing its MCP config.

Questions to try

Start with prompts that force the assistant to cite result scope before making claims.

• "Ask AgentKeeper for a security summary for the last 24 hours. Include the redaction profile, omissions, and links."
• "Search AgentKeeper activity for blocked or warned MCP activity today, then summarize the top investigative questions."
• "Prepare an investigation brief for the highest-severity open alert, including timeline, host posture, policy decision, and omitted data."
• "Compare MCP Gateway drift and list unmanaged or runtime-only MCP servers with affected hosts."
• "Create an audit-ready evidence packet for this customer question, but do not include raw prompts or tool payloads."

Scopes

Denied calls return the required scopes and the scopes the client actually has, so admins can understand the exact permission gap before changing credentials.

Write scopes do not unlock destructive administration. The v1 governed write surface is limited to investigation acknowledgement, assignment, comments, exception requests, and export requests. Policy edits, deletes, unblock actions, raw evidence reveal, client administration, and broad mutation tools are excluded.

Redaction profiles

Every tool response includes:

{
  "schema_version": "agentkeeper.mcp.v1",
  "result_id": "...",
  "org_id": "...",
  "source": "agentkeeper.activity",
  "time_window": { "from": "...", "to": "..." },
  "redaction_profile": "standard",
  "result_cap": 50,
  "next_cursor": "...",
  "links": [],
  "summary": {},
  "evidence": [],
  "redactions": {
    "profile": "standard",
    "redacted": 4,
    "omitted": 0,
    "capped": 2,
    "notes": []
  },
  "omissions": []
}

The assistant should cite result_id, time window, redaction profile, omissions, and console links whenever it prepares an incident summary or audit packet.

Response contract

AgentKeeper returns model-readable evidence, not chat-shaped prose. Each response should make it obvious what was searched, what was capped, what was redacted, and where a human can verify the source.

Tools

Tool descriptions are intentionally model-readable. They explain the required scopes, bounded windows, caps, and how to use links for console drill-down.

Resources

Large evidence windows should use export resources instead of streaming rows through a chat transcript. Export jobs are bounded, expiring, client-bound, and audited.

Prompts

Prompts do not perform hidden actions. They give the assistant a disciplined workflow that starts with redaction, omissions, and time windows before making claims.

Admin review before enabling a client

Before credentials are used, review the client like an API key with an AI-specific blast radius.

Support diagnostics

Support can diagnose a request with:

• Client ID
• Org ID
• Request ID
• Session hash
• Audit event ID
• Protocol method
• Tool, resource, or prompt name
• Redaction profile and counts
• Denied scope
• Rate-limit state
• Timestamp and user agent

Security model

Read access excludes destructive admin actions, raw profile exposure by default, unbounded analytics scans, and policy mutation. Large exports should return jobs and durable resource links rather than streaming huge windows through MCP.

The highest-risk classes are cross-org access, token leakage, redaction leaks, unbounded queries, and client compatibility drift. Treat those as launch gates, not polish.

Troubleshooting

Product benchmark

The setup experience should feel like the best modern hosted MCP servers: obvious endpoint, no local install, copyable client snippets, practical prompts to try, clear authentication guidance, live test transcript, and client-specific troubleshooting. AgentKeeper's differentiator is the security layer around the evidence: redaction by default, policy context, auditability, durable links, transparent permission explanations, and enterprise-safe summaries.