New: export PCI DSS v4 evidence from real browser traffic.

API and MCP

Anything you can click, you can curl.

Sites, reports, scripts, scores, members, alerts: the whole workspace is a REST API with scoped tokens. AI agents get the same reach through the built-in MCP server.

Read the API docsStart free trial

Coverage

The dashboard is just another API client.

Every workspace resource has endpoints to read it and manage it. If a number is on a screen, there is a call that returns it.

  • GET /workspaces/:id/websites

    Sites

    List, create and configure monitored sites. Each returns its managed reporting endpoint, ready for the header.

    View endpoints
  • GET …/websites/:id/reports/:type/raw

    Reports

    Raw and aggregated browser reports, filterable by type, directive, origin and time range.

    View endpoints
  • GET …/websites/:id/compliance/scripts

    Scripts and SBOM

    The script inventory with integrity hashes, library versions and known CVEs.

    View endpoints
  • GET …/websites/:id/stats/metrics/:id

    Metrics and charts

    The same metrics and chart series the dashboard renders, per site or across the workspace, for your own reporting.

    View endpoints
  • POST …/websites/:id/alerts/rules

    Alerting

    Create alert rules and route them to Slack, Teams or any webhook.

    View endpoints
  • GET /workspaces/:id/members

    Members and audit

    Invite members, assign roles and read the workspace audit log.

    View endpoints

MCP server

Put the API in your agent's hands.

MCP (Model Context Protocol) is the standard agents use to call tools. CentralCSP ships a first-party MCP server: connect it from Claude Code, Cursor or any MCP client and ask in plain language. The agent makes the API calls, under a token you scope.

  • Works with Claude Code, Cursor and any MCP client
  • Same coverage as the REST API
  • Scoped tokens decide what an agent can touch
  • Revoke a token, the agent is out
Set up the MCP server

What teams script first.

No SDK required. Three calls with curl and a cron get you further than most integrations.

Gate your deploys

Run a scan from CI and fail the build when a release would weaken your policy or drop a security header.

Feed your own tooling

Pull raw reports, scores and inventories into your SIEM, warehouse or weekly client report.

Onboard sites in a pipeline

Create the site, read back its reporting endpoint and ship the header in the same run.

FAQ

Frequently asked questions

MCP, tokens and plans, answered.

Collect the signal. Script the rest.

Start free, add the header, and automate from day one. API and MCP are included from the Pro plan.

Start free trialRead the API docs