MCP server | ShellOrbit

These pages describe ShellOrbit as it runs today. Breaking changes to the HTTP API are announced before they ship, and existing request and response shapes stay supported.

Connect an agent

Server: https://api.shellorbit.com/mcp, streamable HTTP, with an API key from Settings, API keys as a bearer token. Settings, AI & MCP in the dashboard has these steps with copy buttons. Use a read only key unless the agent should start a scan. Keep the key in an environment variable.

In Claude Code:

bash
export SHELLORBIT_API_KEY=your_api_key
claude mcp add --transport http shellorbit https://api.shellorbit.com/mcp \
  --header "Authorization: Bearer $SHELLORBIT_API_KEY"

In Cursor, add it to .cursor/mcp.json in your project, or to ~/.cursor/mcp.json for every project:

json
{
  "mcpServers": {
    "shellorbit": {
      "url": "https://api.shellorbit.com/mcp",
      "headers": { "Authorization": "Bearer ${env:SHELLORBIT_API_KEY}" }
    }
  }
}

Other MCP clients: the same URL and Authorization: Bearer header.

Tools

MCP server: Tool, Key, What it does
Tool	Key	What it does
`list_findings`	Read	Leaked secret findings, each with a masked value and a fix prompt
`leak_overview`	Read	Open findings by severity, tripwire hits, coverage, and limits
`list_tripwire_hits`	Read	Recent tripwire hits: which tripwire, when, and from where
`list_assets`	Read	Watched domains and log drains with their last scan
`list_incidents`	Read	Public incidents affecting you, with evidence, fix, and deadline, and recent incidents marked affected or not
`get_incident`	Read	One incident with every place it affects you
`list_stack`	Read	Your stack: what you declared, and what scans, the SDK, and findings detected
`list_events`	Read	Source events, newest first, filtered by source, time, or text
`get_event`	Read	One source event with its signature result; the body only with `include_payload`
`get_usage`	Read	This month’s source events, the plan, and its limits
`start_scan`	Read and write	Scan one verified domain now

A read only key does not see start_scan. Revoking is not an MCP tool, and no API key can schedule one; a signed-in member does it in the dashboard.

Typical loop: ask what leaked, let the agent read the finding and fix prompt, fix the code, then start_scan.

Safety

Agents see masked secrets only: ingest keys, source secrets, header credentials, fields you mark masked, and known key formats in payloads are cut short.
Results start with a line marking them as untrusted content, since findings and payloads can contain attacker text. Payload bodies are left out unless asked for.
Tools have exactly the key’s permissions and the API’s rate limits.
Every change is in the audit log with MCP as the actor.

Cookies

Connect an agent

Tools

Safety