AI Agents

Report URI runs a hosted MCP server, so an AI agent can read your account directly - your reports, your setup values, your Wizard progress - and then add the reporting headers to your site for you. There is also a ready-to-run prompt that walks an agent through the whole setup end to end.

This page is about connecting your agent. For what it can do once connected - every tool, prompt and resource the server exposes - see MCP.

The fast path

Give your agent this instruction:

Fetch https://docs.report-uri.com/md/agent-setup/prompt.md and follow it.

The prompt is written for the agent rather than for you, and it takes it through five steps:

Connect the MCP server using an API key it asks you for, then stop and have you restart the client, because MCP servers are only loaded at startup.
Read your account's reporting values with the get_setup tool - your endpoints are unique to your account, so it never uses the examples from the documentation.
Enable the CSP Wizard before deploying anything. Reports sent to the Wizard endpoint before a policy is selected are discarded rather than queued, so a header deployed first collects nothing.
Add a report-only CSP header to your site, after identifying your stack from the repository. Report-only cannot break anything.
Verify the header is live and reports are arriving, then hand the Allow/Block decisions back to you.

Two things it deliberately will not do. It will never invent an API key - if you do not have one it stops and asks. And it cannot create or select a CSP policy for you, because the MCP tools are read-only, so it hands that step back with a link.

You can read the whole prompt before you run it: https://docs.report-uri.com/md/agent-setup/prompt.md

Your API key

Every client below authenticates the same way. Create a key at report-uri.com/api/getKey/ - the full key is shown only once, at creation.

Personal-account keys start ruri_d_, team keys start ruri_t_.
Only a team owner or admin can create a team's key.

Connecting your agent

Every client connects to the same endpoint, https://mcp.report-uri.com/, over the streamable HTTP transport, with the key in an Authorization: Bearer header. Only where you put those three things changes.

Claude Code

claude mcp add --transport http report-uri https://mcp.report-uri.com/ --header "Authorization: Bearer ruri_d_YOUR_KEY_HERE"

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json on macOS, or %APPDATA%\Claude\claude_desktop_config.json on Windows:

{
    "mcpServers": {
        "report-uri": {
            "type": "http",
            "url": "https://mcp.report-uri.com/",
            "headers": {
                "Authorization": "Bearer ruri_d_YOUR_KEY_HERE"
            }
        }
    }
}

Cursor

Add to .cursor/mcp.json in your project, or ~/.cursor/mcp.json to make it available everywhere. Remote servers need no type field:

{
    "mcpServers": {
        "report-uri": {
            "url": "https://mcp.report-uri.com/",
            "headers": {
                "Authorization": "Bearer ${env:REPORT_URI_API_KEY}"
            }
        }
    }
}

Cursor interpolates ${env:VAR}, so the key can stay in your environment rather than in the file. See keeping your key out of your repository below - .cursor/mcp.json is inside your project.

VS Code

VS Code uses servers, not mcpServers. Add to .vscode/mcp.json for one workspace, or run MCP: Open User Configuration from the Command Palette to apply it everywhere:

{
    "inputs": [
        {
            "type": "promptString",
            "id": "report-uri-key",
            "description": "Report URI API key",
            "password": true
        }
    ],
    "servers": {
        "report-uri": {
            "type": "http",
            "url": "https://mcp.report-uri.com/",
            "headers": {
                "Authorization": "Bearer ${input:report-uri-key}"
            }
        }
    }
}

${input:...} with password: true means VS Code prompts for the key once, stores it securely, and never writes it into the file - which matters, because .vscode/mcp.json is inside your repository.

Gemini CLI

Add to ~/.gemini/settings.json, or .gemini/settings.json for one project. Note the key is httpUrl, not url - url selects the SSE transport instead:

{
    "mcpServers": {
        "report-uri": {
            "httpUrl": "https://mcp.report-uri.com/",
            "headers": {
                "Authorization": "Bearer ruri_d_YOUR_KEY_HERE"
            }
        }
    }
}

Codex CLI

Add to ~/.codex/config.toml. Supplying url rather than command selects the streamable HTTP transport:

[mcp_servers.report-uri]
url = "https://mcp.report-uri.com/"
bearer_token_env_var = "REPORT_URI_API_KEY"

bearer_token_env_var names an environment variable rather than holding the key, so nothing secret ends up in the file. If you would rather set the header directly, http_headers takes a table of static headers and env_http_headers takes headers whose values come from environment variables.

Clients that cannot connect yet

Our MCP server authenticates with a static API key in an Authorization header. Two clients worth naming support remote MCP servers but do not offer a documented way to send one:

ChatGPT custom connectors expect OAuth. OpenAI's guidance covers Client ID Metadata Documents and dynamic client registration, with no documented option for a static bearer header. If you use ChatGPT, Codex CLI is the route in for now.
Goose supports remote Streamable HTTP extensions, added with goose configure or goose session --with-streamable-http-extension, but its documented configuration takes a URL with no place to attach headers.

If either has changed, tell us and we will add it.

Keep your API key out of your repository

Several clients keep their MCP configuration inside your project, so pasting a key into the file puts it one git add away from being published:

Client	File	Safe alternative
Cursor	`.cursor/mcp.json`	`${env:REPORT_URI_API_KEY}`
VS Code	`.vscode/mcp.json`	`${input:...}` with `password: true`
Gemini CLI	`.gemini/settings.json` (project)	Use `~/.gemini/settings.json` instead
Codex CLI	`~/.codex/config.toml`	`bearer_token_env_var`

Claude Desktop's config lives outside any project, and Claude Code stores the header in its own configuration rather than in your working tree.

If you do put a key in a file inside the repository, add it to .gitignore and confirm with git check-ignore <file> before you stage anything. A key that reaches a remote should be treated as compromised - delete it at report-uri.com/api/getKey/ and create a new one.

Things to watch for

MCP servers load at startup. After adding the server, the tools are not available in the session you are already in. Restart the client, then continue.
The tools are read-only. An agent can read your reports, setup and Wizard state, but it cannot create policies, change settings or spend your quota. Anything that changes your account comes back to you.
The endpoint values are per-account. An agent that writes the example URLs from this documentation into your site config has produced a header that reports to nobody. Every value should come from get_setup.

Official documentation

Client	Documentation
Claude Code	Connect Claude Code to tools via MCP
Cursor	Model Context Protocol
VS Code	MCP servers in VS Code
Gemini CLI	MCP servers with the Gemini CLI
Codex CLI	Codex configuration

Start Monitoring with Report URI

Already using us? Create an API key at getKey, then point your agent at the prompt above.

New to Report URI? Create an account, then let your agent do the setup - it reads your endpoints from your account and adds the header to your site.

Start your free trial