---
title: "MCP server & REST API for client-side security"
description: "Drive CSP, reporting and alerts over the CentralCSP REST API with scoped tokens. AI agents get the same reach through the built-in MCP server."
url: "https://next.centralcsp.com/en/platform/api-mcp/"
lang: "en"
---

API and MCP

# Anything you can click, you can curl.

Sites, reports, scripts, scores, members, alerts: the whole workspace is a REST API with scoped tokens. AI agents get the same reach through the built-in MCP server.

[Read the API docs](https://next.centralcsp.com/en/docs/api-mcp) [Start free trial](https://app.next.centralcsp.com)

Coverage

## The dashboard is just another API client.

Every workspace resource has endpoints to read it and manage it. If a number is on a screen, there is a call that returns it.

-   `GET /workspaces/:id/websites`
    
    Sites
    
    List, create and configure monitored sites. Each returns its managed reporting endpoint, ready for the header.
    
    [View endpoints](https://next.centralcsp.com/en/docs/api-mcp)
-   `GET …/websites/:id/reports/:type/raw`
    
    Reports
    
    Raw and aggregated browser reports, filterable by type, directive, origin and time range.
    
    [View endpoints](https://next.centralcsp.com/en/docs/api-mcp)
-   `GET …/websites/:id/compliance/scripts`
    
    Scripts and SBOM
    
    The script inventory with integrity hashes, library versions and known CVEs.
    
    [View endpoints](https://next.centralcsp.com/en/docs/api-mcp)
-   `GET …/websites/:id/stats/metrics/:id`
    
    Metrics and charts
    
    The same metrics and chart series the dashboard renders, per site or across the workspace, for your own reporting.
    
    [View endpoints](https://next.centralcsp.com/en/docs/api-mcp)
-   `POST …/websites/:id/alerts/rules`
    
    Alerting
    
    Create alert rules and route them to Slack, Teams or any webhook.
    
    [View endpoints](https://next.centralcsp.com/en/docs/api-mcp)
-   `GET /workspaces/:id/members`
    
    Members and audit
    
    Invite members, assign roles and read the workspace audit log.
    
    [View endpoints](https://next.centralcsp.com/en/docs/api-mcp)

MCP server

## Put the API in your agent's hands.

MCP (Model Context Protocol) is the standard agents use to call tools. CentralCSP ships a first-party MCP server: connect it from Claude Code, Cursor or any MCP client and ask in plain language. The agent makes the API calls, under a token you scope.

-   Works with Claude Code, Cursor and any MCP client
-   Same coverage as the REST API
-   Scoped tokens decide what an agent can touch
-   Revoke a token, the agent is out

[Set up the MCP server](https://next.centralcsp.com/en/docs/api-mcp)

## What teams script first.

No SDK required. Three calls with curl and a cron get you further than most integrations.

### Gate your deploys

Run a scan from CI and fail the build when a release would weaken your policy or drop a security header.

### Feed your own tooling

Pull raw reports, scores and inventories into your SIEM, warehouse or weekly client report.

### Onboard sites in a pipeline

Create the site, read back its reporting endpoint and ship the header in the same run.

FAQ

## Frequently asked questions

MCP, tokens and plans, answered.

### What is an MCP server?

A standard interface AI agents use to discover and call a product's capabilities. Point any MCP client at the CentralCSP server and it lists the available tools itself: no API glue code, no custom plugin.

### Does the MCP server replace the API?

No. It sits on top of the same API with the same permissions. Agents and assistants talk MCP; your scripts, CI jobs and integrations call REST directly.

### Is it safe to connect an AI agent to my security data?

The server is first-party and every session is authenticated with a token you create. You choose the token's scope, and revoking it cuts the agent off immediately.

### Which plan includes the API and MCP?

Pro and up. Starter covers collection and the dashboard; the API and MCP server come in with the automation tier.

### Which AI tools can use it?

Any MCP client: Claude Code, Claude, Cursor, VS Code, Windsurf and the rest of the growing agent ecosystem.

## Collect the signal. Script the rest.

Start free, add the header, and automate from day one. API and MCP are included from the Pro plan.

[Start free trial](https://app.next.centralcsp.com) [Read the API docs](https://next.centralcsp.com/en/docs/api-mcp)

---

Available in: [en](https://next.centralcsp.com/en/platform/api-mcp/), [fr](https://next.centralcsp.com/fr/platform/api-mcp/)