AI Agents¶

Report URI runs a hosted MCP server, so an AI agent can read your account directly - your reports, your setup values, your Wizard progress - and then add the reporting headers to your site for you. There is also a ready-to-run prompt that walks an agent through the whole setup end to end.

This page is about connecting your agent. For what it can do once connected - every tool, prompt and resource the server exposes - see MCP.

The fast path¶

Give your agent this instruction:

Fetch https://docs.report-uri.com/md/agent-setup/prompt.md and follow it.

The prompt is written for the agent rather than for you, and it takes it through six steps:

Connect the MCP server using an API key it asks you for, then stop and have you restart the client, because MCP servers are only loaded at startup.
Discover where you are before changing anything: your plan and its features, the hostnames you collect reports for, whether anything is arriving already, the Wizard and Watch state, and the headers your site sends today. It picks a path from that - the Wizard starter policy for a site with no CSP, additions to your existing policy if you have one, the Magento prompt on Magento, or the matching platform guide for Shopify, BigCommerce, WordPress and the others.
Pre-flight the two things only you can do: every hostname must be in "Sites to collect reports for", and on the Wizard path a policy must be selected for the Wizard to build into. Reports that arrive before either is done are discarded rather than queued, so it hands you each one with a link and confirms with a tool afterwards.
Deploy CSP and CSP Integrity together. A report-only CSP header, 'report-sha256' in script-src, and the two Reporting API headers, all with your account's own values from get_setup. Report-only cannot break anything, and the agent will not deploy an enforcing header.
Verify and show you the first results: the headers are live, CSP and CSP Integrity reports are being accepted, the Wizard is receiving, and then a summary of the scripts running on your site - which libraries and versions, and anything flagged with a known advisory.
Build a deployment plan for the rest, ordered by effort: the Watch products and alert destinations (dashboard only), NEL (one more header), finishing and later enforcing the CSP, and the longer tail - Integrity Policy, Connection Allowlist, DMARC and TLS-RPT, PCI DSS. Each item says where to do it, how to confirm it, and what it needs from your plan. It offers to save the plan as a checklist in your repository.

Three things it deliberately will not do. It will never invent an API key or an endpoint - if you do not have a key it stops and asks, and every endpoint comes from your account. It cannot change your account, because the MCP tools are read-only, so anything that needs a click comes back to you with a link. And it will not deploy an enforcing policy; that stays your decision, with data in front of you.

It is safe to run again. The discovery step reads your account and your site first, so a second run picks up where the first stopped.

You can read the whole prompt before you run it: https://docs.report-uri.com/md/agent-setup/prompt.md

On Magento, use the Magento prompt instead¶

Fetch https://docs.report-uri.com/md/agent-setup/magento.md and follow it.

Magento, Adobe Commerce and Mage-OS already send a CSP of their own, generated from every installed module's csp_whitelist.xml, so the general prompt above gives an agent the wrong instructions on those stores: it would add a second header alongside Magento's, and point it at the CSP Wizard, which has nowhere to deploy the policy it builds. The Magento prompt configures the reporting Magento already has, covers the four fields and the two that enforce since 2.4.7, and installs our module so reports from Chromium browsers are not lost to the Report-To problem described in the Adobe Commerce and Magento guide.

You can read it first: https://docs.report-uri.com/md/agent-setup/magento.md

Your API key¶

Every client below authenticates the same way. Create a key at report-uri.com/api/getKey/ - the full key is shown only once, at creation.

Personal-account keys start ruri_d_, team keys start ruri_t_.
Only a team owner or admin can create a team's key.

Connecting your agent¶

Every client connects to the same endpoint, https://mcp.report-uri.com/, over the streamable HTTP transport, with the key in an Authorization: Bearer header. Only where you put those three things changes.

Claude Code¶

claude mcp add --transport http report-uri https://mcp.report-uri.com/ --header "Authorization: Bearer ruri_d_YOUR_KEY_HERE"

Claude Desktop¶

Add to ~/Library/Application Support/Claude/claude_desktop_config.json on macOS, or %APPDATA%\Claude\claude_desktop_config.json on Windows:

{
    "mcpServers": {
        "report-uri": {
            "type": "http",
            "url": "https://mcp.report-uri.com/",
            "headers": {
                "Authorization": "Bearer ruri_d_YOUR_KEY_HERE"
            }
        }
    }
}

Cursor¶

Add to .cursor/mcp.json in your project, or ~/.cursor/mcp.json to make it available everywhere. Remote servers need no type field:

{
    "mcpServers": {
        "report-uri": {
            "url": "https://mcp.report-uri.com/",
            "headers": {
                "Authorization": "Bearer ${env:REPORT_URI_API_KEY}"
            }
        }
    }
}

Cursor interpolates ${env:VAR}, so the key can stay in your environment rather than in the file. See keeping your key out of your repository below - .cursor/mcp.json is inside your project.

VS Code¶

VS Code uses servers, not mcpServers. Add to .vscode/mcp.json for one workspace, or run MCP: Open User Configuration from the Command Palette to apply it everywhere:

{
    "inputs": [
        {
            "type": "promptString",
            "id": "report-uri-key",
            "description": "Report URI API key",
            "password": true
        }
    ],
    "servers": {
        "report-uri": {
            "type": "http",
            "url": "https://mcp.report-uri.com/",
            "headers": {
                "Authorization": "Bearer ${input:report-uri-key}"
            }
        }
    }
}

${input:...} with password: true means VS Code prompts for the key once, stores it securely, and never writes it into the file - which matters, because .vscode/mcp.json is inside your repository.

Gemini CLI¶

Add to ~/.gemini/settings.json, or .gemini/settings.json for one project. Note the key is httpUrl, not url - url selects the SSE transport instead:

{
    "mcpServers": {
        "report-uri": {
            "httpUrl": "https://mcp.report-uri.com/",
            "headers": {
                "Authorization": "Bearer ruri_d_YOUR_KEY_HERE"
            }
        }
    }
}

Codex CLI¶

Add to ~/.codex/config.toml. Supplying url rather than command selects the streamable HTTP transport:

[mcp_servers.report-uri]
url = "https://mcp.report-uri.com/"
bearer_token_env_var = "REPORT_URI_API_KEY"

bearer_token_env_var names an environment variable rather than holding the key, so nothing secret ends up in the file. If you would rather set the header directly, http_headers takes a table of static headers and env_http_headers takes headers whose values come from environment variables.

Clients that cannot connect yet¶

Our MCP server authenticates with a static API key in an Authorization header. Two clients worth naming support remote MCP servers but do not offer a documented way to send one:

ChatGPT custom connectors expect OAuth. OpenAI's guidance covers Client ID Metadata Documents and dynamic client registration, with no documented option for a static bearer header. If you use ChatGPT, Codex CLI is the route in for now.
Goose supports remote Streamable HTTP extensions, added with goose configure or goose session --with-streamable-http-extension, but its documented configuration takes a URL with no place to attach headers.

If either has changed, tell us and we will add it.

Keep your API key out of your repository¶

Several clients keep their MCP configuration inside your project, so pasting a key into the file puts it one git add away from being published:

Client	File	Safe alternative
Cursor	`.cursor/mcp.json`	`${env:REPORT_URI_API_KEY}`
VS Code	`.vscode/mcp.json`	`${input:...}` with `password: true`
Gemini CLI	`.gemini/settings.json` (project)	Use `~/.gemini/settings.json` instead
Codex CLI	`~/.codex/config.toml`	`bearer_token_env_var`

Claude Desktop's config lives outside any project, and Claude Code stores the header in its own configuration rather than in your working tree.

If you do put a key in a file inside the repository, add it to .gitignore and confirm with git check-ignore <file> before you stage anything. A key that reaches a remote should be treated as compromised - delete it at report-uri.com/api/getKey/ and create a new one.

Things to watch for¶

MCP servers load at startup. After adding the server, the tools are not available in the session you are already in. Restart the client, then continue.
The tools are read-only. An agent can read your reports, setup and Wizard state, but it cannot create policies, change settings or spend your quota. Anything that changes your account comes back to you.
The endpoint values are per-account. An agent that writes the example URLs from this documentation into your site config has produced a header that reports to nobody. Every value should come from get_setup.

Official documentation¶

Client	Documentation
Claude Code	Connect Claude Code to tools via MCP
Cursor	Model Context Protocol
VS Code	MCP servers in VS Code
Gemini CLI	MCP servers with the Gemini CLI
Codex CLI	Codex configuration

Start Monitoring with Report URI¶

Already using us? Create an API key at getKey, then point your agent at the prompt above.

New to Report URI? Create an account, then let your agent do the setup - it reads your endpoints from your account and adds the header to your site.

Start your free trial