---
description: Connect Claude Code, Claude Desktop, Cursor, VS Code, Gemini CLI or Codex CLI to Report URI over MCP, or hand your agent the ready-to-run onboarding prompt.
---

# AI Agents

Report URI runs a hosted MCP server, so an AI agent can read your account directly - your reports, your setup values, your Wizard progress - and then add the reporting headers to your site for you. There is also a ready-to-run prompt that walks an agent through the whole setup end to end.

This page is about connecting your agent. For what it can do once connected - every tool, prompt and resource the server exposes - see [MCP](/integrations/mcp/).

## The fast path

Give your agent this instruction:

    Fetch https://docs.report-uri.com/md/agent-setup/prompt.md and follow it.

The prompt is written for the agent rather than for you, and it takes it through five steps:

1. **Connect the MCP server** using an API key it asks you for, then stop and have you restart the client, because MCP servers are only loaded at startup.
2. **Read your account's reporting values** with the `get_setup` tool - your endpoints are unique to your account, so it never uses the examples from the documentation.
3. **Enable the CSP Wizard** before deploying anything. Reports sent to the Wizard endpoint before a policy is selected are discarded rather than queued, so a header deployed first collects nothing.
4. **Add a report-only CSP header** to your site, after identifying your stack from the repository. Report-only cannot break anything.
5. **Verify** the header is live and reports are arriving, then hand the Allow/Block decisions back to you.

Two things it deliberately will not do. It will never invent an API key - if you do not have one it stops and asks. And it cannot create or select a CSP policy for you, because the MCP tools are read-only, so it hands that step back with a link.

You can read the whole prompt before you run it: <https://docs.report-uri.com/md/agent-setup/prompt.md>

## Your API key

Every client below authenticates the same way. Create a key at [report-uri.com/api/getKey/](https://report-uri.com/api/getKey/) - **the full key is shown only once, at creation**.

- Personal-account keys start `ruri_d_`, team keys start `ruri_t_`.
- Only a team **owner or admin** can create a team's key.

## Connecting your agent

Every client connects to the same endpoint, `https://mcp.report-uri.com/`, over the streamable HTTP transport, with the key in an `Authorization: Bearer` header. Only where you put those three things changes.

### Claude Code

    claude mcp add --transport http report-uri https://mcp.report-uri.com/ --header "Authorization: Bearer ruri_d_YOUR_KEY_HERE"

### Claude Desktop

Add to `~/Library/Application Support/Claude/claude_desktop_config.json` on macOS, or `%APPDATA%\Claude\claude_desktop_config.json` on Windows:

```json
{
    "mcpServers": {
        "report-uri": {
            "type": "http",
            "url": "https://mcp.report-uri.com/",
            "headers": {
                "Authorization": "Bearer ruri_d_YOUR_KEY_HERE"
            }
        }
    }
}
```

### Cursor

Add to `.cursor/mcp.json` in your project, or `~/.cursor/mcp.json` to make it available everywhere. Remote servers need no `type` field:

```json
{
    "mcpServers": {
        "report-uri": {
            "url": "https://mcp.report-uri.com/",
            "headers": {
                "Authorization": "Bearer ${env:REPORT_URI_API_KEY}"
            }
        }
    }
}
```

Cursor interpolates `${env:VAR}`, so the key can stay in your environment rather than in the file. See [keeping your key out of your repository](#keep-your-api-key-out-of-your-repository) below - `.cursor/mcp.json` is inside your project.

### VS Code

VS Code uses `servers`, not `mcpServers`. Add to `.vscode/mcp.json` for one workspace, or run **MCP: Open User Configuration** from the Command Palette to apply it everywhere:

```json
{
    "inputs": [
        {
            "type": "promptString",
            "id": "report-uri-key",
            "description": "Report URI API key",
            "password": true
        }
    ],
    "servers": {
        "report-uri": {
            "type": "http",
            "url": "https://mcp.report-uri.com/",
            "headers": {
                "Authorization": "Bearer ${input:report-uri-key}"
            }
        }
    }
}
```

`${input:...}` with `password: true` means VS Code prompts for the key once, stores it securely, and never writes it into the file - which matters, because `.vscode/mcp.json` is inside your repository.

### Gemini CLI

Add to `~/.gemini/settings.json`, or `.gemini/settings.json` for one project. Note the key is `httpUrl`, not `url` - `url` selects the SSE transport instead:

```json
{
    "mcpServers": {
        "report-uri": {
            "httpUrl": "https://mcp.report-uri.com/",
            "headers": {
                "Authorization": "Bearer ruri_d_YOUR_KEY_HERE"
            }
        }
    }
}
```

### Codex CLI

Add to `~/.codex/config.toml`. Supplying `url` rather than `command` selects the streamable HTTP transport:

```toml
[mcp_servers.report-uri]
url = "https://mcp.report-uri.com/"
bearer_token_env_var = "REPORT_URI_API_KEY"
```

`bearer_token_env_var` names an environment variable rather than holding the key, so nothing secret ends up in the file. If you would rather set the header directly, `http_headers` takes a table of static headers and `env_http_headers` takes headers whose values come from environment variables.

## Clients that cannot connect yet

Our MCP server authenticates with a static API key in an `Authorization` header. Two clients worth naming support remote MCP servers but do not offer a documented way to send one:

- **ChatGPT custom connectors** expect OAuth. OpenAI's guidance covers Client ID Metadata Documents and dynamic client registration, with no documented option for a static bearer header. If you use ChatGPT, Codex CLI is the route in for now.
- **Goose** supports remote Streamable HTTP extensions, added with `goose configure` or `goose session --with-streamable-http-extension`, but its documented configuration takes a URL with no place to attach headers.

If either has changed, [tell us](https://report-uri.com/home/contact) and we will add it.

## Keep your API key out of your repository

Several clients keep their MCP configuration **inside your project**, so pasting a key into the file puts it one `git add` away from being published:

| Client | File | Safe alternative |
|---|---|---|
| Cursor | `.cursor/mcp.json` | `${env:REPORT_URI_API_KEY}` |
| VS Code | `.vscode/mcp.json` | `${input:...}` with `password: true` |
| Gemini CLI | `.gemini/settings.json` (project) | Use `~/.gemini/settings.json` instead |
| Codex CLI | `~/.codex/config.toml` | `bearer_token_env_var` |

Claude Desktop's config lives outside any project, and Claude Code stores the header in its own configuration rather than in your working tree.

If you do put a key in a file inside the repository, add it to `.gitignore` and confirm with `git check-ignore <file>` before you stage anything. A key that reaches a remote should be treated as compromised - delete it at [report-uri.com/api/getKey/](https://report-uri.com/api/getKey/) and create a new one.

## Things to watch for

- **MCP servers load at startup.** After adding the server, the tools are not available in the session you are already in. Restart the client, then continue.
- **The tools are read-only.** An agent can read your reports, setup and Wizard state, but it cannot create policies, change settings or spend your quota. Anything that changes your account comes back to you.
- **The endpoint values are per-account.** An agent that writes the example URLs from this documentation into your site config has produced a header that reports to nobody. Every value should come from `get_setup`.

## Official documentation

| Client | Documentation |
|---|---|
| Claude Code | [Connect Claude Code to tools via MCP](https://docs.anthropic.com/en/docs/claude-code/mcp) |
| Cursor | [Model Context Protocol](https://cursor.com/docs/context/mcp) |
| VS Code | [MCP servers in VS Code](https://code.visualstudio.com/docs/copilot/customization/mcp-servers) |
| Gemini CLI | [MCP servers with the Gemini CLI](https://github.com/google-gemini/gemini-cli/blob/main/docs/tools/mcp-server.md) |
| Codex CLI | [Codex configuration](https://github.com/openai/codex/blob/main/docs/config.md) |

## Start Monitoring with Report URI

**Already using us?** Create an API key at [getKey](https://report-uri.com/api/getKey/), then point your agent at the prompt above.

**New to Report URI?** Create an account, then let your agent do the setup - it reads your endpoints from your account and adds the header to your site.

[Start your free trial](https://report-uri.com/register/?plan=starter2025)