Quickstart

Point an AI client at one URL, sign in with your CentralCSP account, and the agent can register websites, deploy the reporting headers into your codebase, and read what browsers are reporting back.

There is no API key in this flow. Sign-in is OAuth in your browser, so there is nothing to create, paste, or rotate.

https://mcp.centralcsp.com

1. Add the server

claude mcp add --transport http --client-id mcp centralcsp https://mcp.centralcsp.com --scope user

--scope user registers the server for every project you open. Leave it out to add it to the current project only, which writes to that project's .mcp.json.

2. Sign in

1. Start the sign-in from your client: /mcp then Authenticate in Claude Code, codex mcp login centralcsp in Codex, Connect in Claude Desktop.
2. Sign in with your CentralCSP account in the browser that opens.
3. Confirm the server is connected (/mcp again, or codex mcp list).

Ask the agent to list your workspaces as a first check. That call, list_workspaces, is the one every other tool depends on.

3. Set up reporting with one prompt

Paste this into a coding agent with your project open. It registers the site, writes the headers into your code, and checks that reports arrive. Swap the workspace name and id for your own, which Settings > AI tools fills in for you on its copy of this prompt.

Set up browser security reporting for this project with CentralCSP, using the
centralcsp MCP server. Do the work yourself, and stop to ask me only when you
genuinely cannot work something out.

Work in the workspace "<workspace name>" (id <workspace id>).

1. Find this site's public URL in the repo, in env files, config, or deployment
   manifests. Ask me only if you cannot find it. Choose a name from the project
   and tell me what you picked.
2. Create the website with the MCP server and read back the endpointUrl it returns.
3. Find where this project sets HTTP response headers, whether that is middleware,
   a server or framework config, or a CDN or reverse-proxy rule, and add these two
   headers there yourself, matching the file's existing style:
     Reporting-Endpoints: centralcsp="<endpointUrl>"
     Content-Security-Policy-Report-Only: default-src 'self'; report-to centralcsp
   Use Report-Only to begin with, so nothing on the site breaks, and substitute
   the real endpointUrl.
4. Show me the diff and tell me how to deploy it. Do not commit anything.
5. Once I confirm it is live, check whether reports are arriving. If none are,
   fetch the site and look at the headers it actually serves, then fix them.
6. Finish by summarising what the browsers are reporting and what I should fix first.

Report-Only is the point of step 3. The browser sends reports and blocks nothing, so you learn what a policy would break before it breaks it. See Report-Only.

4. Use it

Once the server is connected, ask in plain language. The agent resolves the ids itself.

Two habits make the answers better. Name the site, so the agent filters instead of scanning every website in the workspace. Name a range, because tools default to the last 7 days and reports are only kept for 90.

Your client lists every tool the server exposes, so asking the agent what it can do is the current answer rather than a list here.

What it will not do

Nothing deletes. There is no tool that removes a website, a member, a rule, or a report. There is also no tool for membership, access grants, security settings, or billing, so an agent cannot reach them however it is prompted.

Two tools have effects outside CentralCSP and are worth confirming before they run. test_alert_channel delivers a real notification that real people see, and reconcile_script_inventory queues an inventory rebuild.

Settings > General > Disable AI agent integrations cuts every AI client off from the workspace immediately, without touching dashboard sessions.

If it does not connect

Per-client setup detail is in Connect a client.

Next steps

• Permissions and safety
• REST API