---
description: A ready-to-run prompt that onboards an AI agent to Report URI - connects the Report URI MCP server and sets up security reporting on your site.
---

# Onboard your agent to Report URI

You are an AI agent setting up **Report URI** security reporting for the user. Report URI
collects Content Security Policy (CSP), Network Error Logging (NEL), and other browser and
email security reports so the user can monitor and secure their site. Follow the steps below
in order. Everything here is validated by Report URI. Do not skip the confirmation steps, and
never invent credentials - always ask the user for values you do not have.

The canonical version of this prompt lives at
<https://docs.report-uri.com/md/agent-setup/prompt.md>.


## Step 1 - Connect the Report URI MCP server

Report URI exposes a hosted [MCP](https://modelcontextprotocol.io) server so you can read the
user's account data (reports, setup, quota, watch findings) directly.

- **Endpoint:** `https://mcp.report-uri.com/`
- **Auth:** an API key sent as `Authorization: Bearer <KEY>` on every request.

**Get the API key.** Ask the user to paste their Report URI API key. If they do not have one,
tell them to create it at <https://report-uri.com/api/getKey/> - the full key is shown only
once, at creation. Personal-account keys start `ruri_d_`, team keys start `ruri_t_`.

Only a team **owner or an admin** can create a team's API key. If the user is a team member
without that permission, ask them to have their team owner or an admin create the key at
<https://report-uri.com/api/getKey/> and share it with them - or have that owner/admin run this
setup instead. **Do not guess or fabricate a key.**

Then add the server to whichever agent the user is running:

**Claude Code** - run this for the user (substitute their key):

```bash
claude mcp add --transport http report-uri https://mcp.report-uri.com/ --header "Authorization: Bearer ruri_d_YOUR_KEY_HERE"
```

**Claude Desktop** - add to the config file
(`~/Library/Application Support/Claude/claude_desktop_config.json` on macOS,
`%APPDATA%\Claude\claude_desktop_config.json` on Windows):

```json
{
    "mcpServers": {
        "report-uri": {
            "type": "http",
            "url": "https://mcp.report-uri.com/",
            "headers": {
                "Authorization": "Bearer ruri_d_YOUR_KEY_HERE"
            }
        }
    }
}
```

**Cursor / VS Code / other MCP clients** - add an HTTP (streamable) MCP server with URL
`https://mcp.report-uri.com/` and header `Authorization: Bearer ruri_d_YOUR_KEY_HERE`. Any
client that supports the HTTP transport works; protocol version `2025-03-26`.

**Treat the API key as a secret - never commit it.** Some clients keep their MCP config inside
the user's repository (Cursor's `.cursor/mcp.json`, VS Code's `.vscode/mcp.json`), so writing
the key there puts it one `git add` away from version control. If the config file is inside the
repo, either reference the key from an environment variable instead of inlining it, or add the
file to `.gitignore` - and confirm with `git check-ignore <file>` before staging anything. Never
include the key in commits, logs, or output you print back to the user.

**Restart the agent so the server loads.** MCP servers are only picked up when the client
starts, so the `report-uri` tools are NOT available in the current session yet - you cannot
call them until a restart happens. Tell the user to restart now:

- **Claude Code** - exit and start a new session (run `claude` again).
- **Claude Desktop** - fully quit and reopen the app.
- **Cursor / VS Code** - reload the window (or restart the editor).

Then, in the fresh session, run this prompt again. This time the `report-uri` tools will be
present: skip re-adding the server and go straight to confirming the connection below.

Confirm the connection by calling the `get_account_info` tool - it should return the account
type and email (personal) or team name (team). If the tool is not listed, the restart has not
happened yet; if it errors, the key is wrong or not yet active - ask the user to re-check it.
Once confirmed, continue to Step 2.


## Step 2 - Read the account's reporting setup

Call the MCP tool **`get_setup`** (or run the built-in **`generate_security_headers`** prompt).
It returns the values you need to configure reporting, all unique to this account:

- `reportUri.reportOnly` / `reportUri.enforce` / `reportUri.wizard` - the CSP report endpoints.
- `reportingApi` - a JSON object to send as the value of the `Report-To` header.
- `nel` - a JSON object to send as the value of the `NEL` header.
- `dmarc`, `tlsRpt` - email-reporting addresses.

`reportingApi` and `nel` are returned as JSON objects, not as finished header strings: serialise
each one compactly and use it as the header value verbatim. Do not reformat them into any other
syntax.

Use the **real values from the response** in the headers below - never the placeholder
domains from this document.


## Step 3 - Enable the CSP Wizard

**Do this before deploying any header.** The Wizard only collects reports once a policy has been
selected for it to build into. Until one is, every report sent to the Wizard endpoint is
discarded - not queued - so a header deployed first produces nothing and the user waits for data
that will never arrive.

Call the **`get_csp_wizard`** MCP tool:

- If it returns `enabled: true`, a policy is already selected. Note its `policy.name` and
  continue to Step 4.
- If it returns `enabled: false`, there is no policy yet. **You cannot create one** - the Report
  URI MCP tools are read-only - so hand this step to the user and ask them to do it now:

> Go to <https://report-uri.com/account/policies/csp/>, click the **Enable** button on the
> "Setup CSP Wizard" row, enter a name for the policy, and save.

Wait for them to confirm, then call `get_csp_wizard` again. Only continue once it returns
`enabled: true`. If it still returns `false`, the policy was created but not selected for the
Wizard - ask the user to press **Use With Wizard** on it on the same page.


## Step 4 - Add the reporting headers to the user's site

First identify the user's stack (nginx, Apache, IIS, or an app framework such as Express,
Django, Rails, Laravel, etc.) by inspecting the repo. Then add the headers to the right place
(server config or middleware).

Start with **CSP in report-only mode** - it is completely safe and cannot break the site. Use
the account's Wizard endpoint from `get_setup` so Report URI's CSP Wizard can build the policy
from real traffic:

```
Content-Security-Policy-Report-Only: default-src 'none'; form-action 'none'; frame-ancestors 'none'; report-uri <reportUri.wizard>
```

Examples (replace the URL with the account's own value):

```nginx
# nginx
add_header Content-Security-Policy-Report-Only "default-src 'none'; form-action 'none'; frame-ancestors 'none'; report-uri https://YOURSUBDOMAIN.report-uri.com/r/d/csp/wizard";
```

```apache
# Apache
Header set Content-Security-Policy-Report-Only "default-src 'none'; form-action 'none'; frame-ancestors 'none'; report-uri https://YOURSUBDOMAIN.report-uri.com/r/d/csp/wizard"
```

```php
// PHP
header("Content-Security-Policy-Report-Only: default-src 'none'; form-action 'none'; frame-ancestors 'none'; report-uri https://YOURSUBDOMAIN.report-uri.com/r/d/csp/wizard");
```

The `report-uri` value MUST be the account's **Wizard** endpoint - the `/wizard` disposition,
returned as `reportUri.wizard` by `get_setup` (it ends in `/csp/wizard`). The Wizard only
processes reports sent to that endpoint; the `/enforce` and `/reportOnly` endpoints will not
feed it.

If the user prefers the Reporting API `report-to` directive over `report-uri`, they must add a
dedicated `wizard` reporting group whose endpoint URL ends in `/wizard` - see
<https://docs.report-uri.com/setup/wizard/>. Using `report-uri` with the Wizard endpoint, as
above, is the simplest path.

Do **not** deploy an enforcing `Content-Security-Policy` header yet - the Wizard builds and
tunes the policy from real reports first (Step 5).


## Step 5 - Verify and run the Wizard

1. **Confirm the header is live.** `curl -I <url>` (or dev tools -> Network) should show the
   `Content-Security-Policy-Report-Only` header carrying your `/wizard` `report-uri` value.

2. **Confirm reports are reaching the Wizard.** Call the `get_csp_wizard` MCP tool. It should
   return `enabled: true` and, once real traffic arrives (usually a few minutes), a growing
   list of `new` suggested changes. If `enabled` has gone back to `false`, the Wizard's policy
   has been deleted or deselected and reports are being discarded again - redo Step 3.

3. **The Wizard builds the policy selected in Step 3.** It appears under
   <https://report-uri.com/account/policies/csp/>, where the user can rename it or switch the
   Wizard to a different policy.

4. **Process the suggestions (user action).** On the Wizard page
   <https://report-uri.com/account/wizard/csp>, the user reviews each suggested change and clicks
   **Allow** (add the resource to the policy) or **Block**. You cannot click these for the user,
   so hand this step to them - you can call `get_csp_wizard` to report progress (the `new`,
   `allowed`, and `blocked` counts).

5. **Give it time.** Recommend running the Wizard for **at least 7 days** so it sees all traffic
   and users. When no new suggestions remain, the policy in My Policies is ready to deploy in
   report-only mode for testing, and then as an enforcing `Content-Security-Policy` header.


## Reference

Every Report URI documentation page is available as plain Markdown for you to fetch directly.
The index at <https://docs.report-uri.com/llms.txt> lists every page with its Markdown URL - use
it whenever you need detail beyond this prompt: other report types (NEL, DMARC, Certificate
Transparency, Permissions Policy, COOP/COEP), framework-specific header setup, the Watch
products, filtering, or policy tuning. The same pages are also exposed as MCP resources once the
server is connected (Step 1).


## Report back

When you are done, print a short status summary to the user:

```
Report URI setup
-----------------
MCP server connected ............ yes / no
Account reachable (get_setup) ... yes / no
Wizard enabled (get_csp_wizard) . yes / no  (policy: <name>)
CSP report-only (/wizard) added . yes / no  (<file you edited>)
Next: over ~7 days, review the Allow/Block suggestions at
https://report-uri.com/account/wizard/csp, then deploy the built policy (report-only, then enforce).
```