# Connecting an MCP client

The Titan platform exposes the **same public API surface** through the [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) so LLM agents (Claude, Cursor, etc.) can call every public RPC as an MCP tool. **The client credentials issued from Credential Management work for both REST and MCP** — you don't need separate credentials.

## Endpoint

```
https://titanapi.securityscorecard.io/v1/mcp
```

Every public RPC is registered as an MCP tool. Tool names track the RPC names (`GetObservations`, `FlagObservations`, …).

## Add as a custom MCP connector (Claude)

Instead of wiring up the endpoint by hand, teams using **Claude** can add Titan AI MCP as a reusable custom connector. Once added to your workspace, anyone on the team can enable it from Claude's **Connectors** list.

> **Note:** Adding a custom connector is an organization-level action. Depending on your enterprise license configuration, your Claude workspace may restrict custom connectors to administrators — a one-time setup by your IT or workspace admin may be required.


### 1. Create the custom connector (admin, one-time)

In Claude, open **Settings → Connectors** and click **Add custom connector**. Enter:

- **Name:** `Titan AI`
- **URL:** `https://titanapi.securityscorecard.io/v1/mcp`


Click **Add**.

![Claude Settings → Connectors with the Add custom connector button, and the Add custom connector dialog filled in with the name Titan AI and the Titan MCP endpoint URL](/assets/1-add-custom-connector.b27ffd9efa79ddaef1e9dcd9276b279fb9e9156c9b24ff4ee79fab4b7568ca70.26657085.png)

### 2. Open the Titan AI connector

Each team member opens **Settings → Connectors**, finds **Titan AI** in the list, and clicks **Connect**.

![Claude Connectors list with the Titan AI custom connector selected, showing the Titan MCP endpoint URL and a Connect button; a callout notes the connector requires a one-time IT admin setup](/assets/2-claude-connectors-titan-ai.345357f9d089a67e3866a9f088aed520e3832942c175c1de00402612088314bf.26657085.png)

### 3. Authorize the application

Claude opens the SecurityScorecard authorization screen. Review the requested permissions and click **Allow**.

![SecurityScorecard Authorize Application dialog for Claude, listing Read security findings and Flag security findings permissions with Deny and Allow buttons](/assets/3-authorize-application.92856635d59b4d1acfe7da49e9fbdb26fb3895678301dd1ced0c87d4b11eb33d.26657085.png)

## Authentication

MCP uses **OAuth 2.0 client credentials** — the same flow described in [Getting Started](/docs/guides/getting-started). Obtain a `CLIENT_ID` / `CLIENT_SECRET` pair, exchange it for a bearer token, and attach the token to every MCP request.

```bash
# 1. Get a token (same call as REST).
TITAN_API_TOKEN=$(curl -sX POST 'https://titanapi.securityscorecard.io/v1/oauth/token' \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -d 'grant_type=client_credentials' | jq -r .access_token)

# 2. List available tools.
curl -N -X POST 'https://titanapi.securityscorecard.io/v1/mcp' \
  -H "Authorization: Bearer $TITAN_API_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
```

## Configuring a client

```json
{
  "mcpServers": {
    "titan": {
      "type": "streamable-http",
      "url": "https://titanapi.securityscorecard.io/v1/mcp",
      "headers": {
        "Authorization": "Bearer <TITAN_API_TOKEN>"
      }
    }
  }
}
```

## Scopes

- **Read security findings** — enables every read-only MCP tool.
- **Flag security findings** — additionally enables mutating tools (e.g. flagging observations).


## Rate limits

MCP calls count against the same **per-organization** rate limits as REST (see [Usage Limits](/docs/guides/usage-limits)). REST and MCP have shared numeric limits but **independent counters** — a burst on one surface will not starve the other.

## Errors

MCP surfaces errors through the JSON-RPC error envelope. The underlying HTTP transport still returns standard status codes — `401` (token missing/expired), `403` (insufficient scope), `429` (rate limit exceeded). See [Errors](/docs/guides/errors).

## Prompting: getting the client to call Titan MCP

Interactive AI clients do **not always auto-invoke** the Titan MCP connector from a generic prompt. Use any of the following patterns — most reliable first:

1. **Name the tool explicitly:** *"Use `GetObservations` to list this week's CVE findings across my vendors."*
2. **Name the connector:** *"Using the Titan MCP connector, show me high-severity findings from the last 7 days."*
3. **Ask the client to list tools first:** *"List the tools available from the Titan MCP server, then answer: what CVEs are affecting my vendors this week?"*


## What MCP is not

- **Not a separate API surface.** Every MCP tool is a thin wrapper around a public RPC. Behaviour, request/response shapes, and lifecycle state are identical to REST.
- **Not a Try-It sandbox.** Calls hit real data with real permissions.
- **Not exempt from lifecycle rules.** Deprecations and sunsets apply identically across REST and MCP.