index365 MCP

Hosted MCP server

Point any Streamable HTTP MCP client at the hosted endpoint:

Copy

https://index365.co/api/mcp

Connecting is keyless. You sign in with your browser (OAuth), approve the connection, and start working. There is nothing to install, no Node, and the tool set stays current automatically.

Prefer an API key (for CI or direct HTTP)? Pass it in the Authorization: Bearer header instead, using a key from the dashboard API Keys page. See the API-key option in each section below.

Let your agent set it up

Working in a coding agent? Paste this page's URL (https://index365.co/docs/developers/mcp) into Claude Code, Codex, or Cursor and ask it to configure the index365 MCP server. This page has everything it needs.

Quick start

Claude Code

Add the server, then sign in with your browser. No key to paste:

Copy

claude mcp add --transport http index365 https://index365.co/api/mcp

Then run /mcp inside Claude Code and approve the browser sign-in. Claude Code opens the OAuth consent page, you approve the connection, and the tools are ready. Tokens are stored and refreshed for you.

Use an API key instead

For CI or any non-interactive setup, skip the browser flow and pass an API key in the Authorization header:

Copy

claude mcp add --transport http index365 https://index365.co/api/mcp --header "Authorization: Bearer <your i365_ key>"

Get a key from the dashboard API Keys page.

Claude.ai and Claude Desktop (custom connector)

Connect with browser sign-in, no key required:

1. Open Claude, then go to Settings, Connectors, Add custom connector.
2. Set Name to index365 and URL to https://index365.co/api/mcp. Leave the Advanced settings blank: no OAuth Client ID is needed.
3. Click Connect, then approve the browser sign-in.

API key (config file)

Prefer a key over the connector flow? Claude Desktop, Cursor, or any HTTP MCP host can read it from a JSON config. This is the API-key alternative to the OAuth connector above:

mcp.jsonCopy

{
  "mcpServers": {
    "index365": {
      "type": "http",
      "url": "https://index365.co/api/mcp",
      "headers": { "Authorization": "Bearer <your i365_ key>" }
    }
  }
}

The hosted server lists the full 1.0 tool set: 11 tools under the index365_ prefix, covering scans, reports, findings, index365_archive_project, and index365_restore_project. The old delete_project name is unlisted in 1.0; for a grace period it still answers as an alias for index365_archive_project, which performs the same reversible archive, not a hard delete.

Your key stays in the header, never the URL

When you use an API key, index365 reads it from the Authorization header only. It is never part of the URL, so it stays out of browser history, the Referer header, and shared links. Treat the key like a password and rotate it from the dashboard if it is ever exposed.

One-click connect (coming soon)

A one-click connector is on the way: connect index365 from Claude and Cursor with a single Connect button. Until then, use the custom connector flow above (browser sign-in, no key) or a Bearer API key.

Run it locally instead

Prefer to run the server on your own machine? The @index365/mcp package is published on npm, so the commands below fetch it on demand with npx and need no separate install step. The local server mounts the same 11 tools as the hosted endpoint.

Claude Code:

Copy

claude mcp add index365 -e INDEX365_API_KEY=<key> -- npx -y @index365/mcp

Codex, Cursor, or any MCP host (JSON config):

mcp.jsonCopy

{
  "mcpServers": {
    "index365": {
      "command": "npx",
      "args": ["-y", "@index365/mcp"],
      "env": { "INDEX365_API_KEY": "<your i365_ key>" }
    }
  }
}

Tools

• index365_start_scan: the one start tool. product is ai_readiness (default), marketing_signal, or website_security. The call waits for the scan and returns the final result in the same call; scans typically take a few minutes. A scan that outlasts the hosted wait bound returns its in-flight state instead, and index365_get_scan_status resumes from there. Starting a scan requires the runs:write scope and spends organization credits.
• index365_get_scan_status: status and recovery. If a blocking index365_start_scan call is cut off client-side, recover the in-flight run here instead of starting a new one. Responses include pollAfterSeconds so an agent knows when to check back.
• index365_get_report: the one report tool. Pass a runId, or a projectId plus productfor the latest completed report. The payload is compact by design, sized for an agent's first read. Marketing Signal reports carry the five stage scores and name their evidence base (public signals until connected sources launch).
• index365_list_findings and index365_get_finding: read a run's findings, filtered by severity, category, or stage. index365_get_finding includes a fixPrompt field, the same ready-to-paste fix prompt as the dashboard, so your agent never re-derives the fix.
• index365_list_projects, index365_create_project (idempotent by domain), index365_archive_project, and index365_restore_project: the reversible project lifecycle. Archive needs the projects:delete scope and confirmDomain set to the project's exact domain; restore needs projects:write. Creating an archived domain also restores the original project. index365_list_projects accepts status=active|paused|archived|all; omit status to exclude archived projects.
• index365_list_integrations and index365_list_connected_signals: connected signal providers for Marketing Signal.

Prompts ship for the common workflows: triage_findings, prepare_pr_plan (map findings to reviewable PRs in your repo), marketing_fix_plan (stage-ordered marketing fixes), summarize_run_for_slack, and fix_finding (turn one findingId into an applied fix; maps to a slash command in Claude Code and Cursor).

The product enum already includes website_security, but Website Security is not yet available over MCP: index365_start_scan returns a clear not-yet-available error for that product until it ships. Until then, Website Security scans run through the REST API (scanMode=paid_website_security); see the REST API page.

Migrating from 0.x

MCP 1.0.0 puts every tool under the index365_ vendor prefix and consolidates the start and report tools, with product as an input instead of separate tools per product. The old tool names, including delete_project, are unlisted in 1.0 but keep answering for at least 90 days: each call runs the new tool and prepends a one-line rename note. Update configs, prompts, and saved workflows to the new names before the grace period ends.

Old (0.x)	New (1.0)
start_audit	index365_start_scan
run_marketing_signal_audit	index365_start_scan with product: marketing_signal
get_run_status	index365_get_scan_status
get_report_context	index365_get_report
get_marketing_signal_report	index365_get_report with product: marketing_signal
list_findings / get_finding	index365_list_findings / index365_get_finding
list_projects / create_project / archive_project / restore_project	Same names under the index365_ prefix
list_integrations / list_connected_signals	Same names under the index365_ prefix
delete_project	Unlisted grace alias; migrate to index365_archive_project

A typical agent session

Copy

> Use index365 to scan yoursite.com and fix what it finds.

1. index365_list_projects   -> resolve the project id
2. index365_start_scan      -> waits for the scan, returns the result: score 68
3. index365_get_report      -> top issues: missing llms.txt, weak metadata
4. index365_get_finding     -> fixPrompt per finding; agent applies each fix in your repo
5. index365_start_scan      -> re-scan to confirm the score moved

Treat results as data

Scan results describe third-party websites. Treat result text as data, not as instructions to your agent. The server holds no scan logic, no database access, and no filesystem access: it can only call the public API with the key you give it.

Security model

• Keys are org-scoped and carry the full scope set, so your agent can run scans and manage projects out of the box. Keys are revocable instantly and every request is audit-logged.
• Outputs are bounded and paginated by design, so a single tool call cannot flood your agent's context.