MCP server

These pages describe ShellOrbit as it runs today. Breaking changes to the HTTP API are announced before they ship, and existing request and response shapes stay supported.

Connect an agent

The server is at https://api.shellorbit.com/mcp. It uses MCP’s streamable HTTP transport and takes a ShellOrbit API key as a bearer token. Create a key in the dashboard under Settings, API keys: a read only key for an agent that only reads, a read and write key for one that may replay or scan. Keep the key in an environment variable, never in a file you commit.

In Claude Code:

bash
export SHELLORBIT_API_KEY=your_api_key
claude mcp add --transport http shellorbit https://api.shellorbit.com/mcp \
  --header "Authorization: Bearer $SHELLORBIT_API_KEY"

In Cursor, add it to .cursor/mcp.json in your project, or to ~/.cursor/mcp.json for every project:

json
{
  "mcpServers": {
    "shellorbit": {
      "url": "https://api.shellorbit.com/mcp",
      "headers": { "Authorization": "Bearer ${env:SHELLORBIT_API_KEY}" }
    }
  }
}

Any other client that speaks MCP over HTTP connects the same way: the URL above and an Authorization: Bearer header.

Tools

MCP server: Tool, Key, What it does
Tool	Key	What it does
`list_findings`	Read	Leaked secret findings, each with a masked value and a fix prompt
`leak_overview`	Read	Open findings by severity, tripwire hits, coverage, and limits
`list_tripwire_hits`	Read	Recent tripwire hits: which tripwire, when, and from where
`list_assets`	Read	Watched domains, GitHub repos, and log drains with their last scan
`list_endpoints`	Read	Webhook endpoints and their destinations
`list_events`	Read	Received events, newest first, filtered by endpoint, state, time, or text
`get_event`	Read	One event with every delivery attempt; the body only with `include_payload`
`get_usage`	Read	This month’s event usage, the plan, and its limits
`start_scan`	Read and write	Scan one verified domain now
`replay_event`	Read and write	Deliver a stored event again
`send_test_event`	Read and write	Send a JSON event through an endpoint

A read only key is not offered the last three at all. Revoking a key is not available to agents yet; do it from the dashboard.

The loop that makes it useful: ask what leaked, let the agent read the finding and its fix prompt, fix the code, commit, and ask ShellOrbit to scan again.

Safety

An agent only ever sees masked secrets. Ingest keys, signing secrets, credentials in headers, and known key formats inside payloads are cut down to a few characters, and destination URLs show their host only.
Findings and webhook payloads can contain text written by an attacker. Every result starts with a line saying it is untrusted content, payload bodies are left out unless the agent asks for one, and agents should treat what they read as data, not instructions.
A tool runs with exactly the permissions of its key and the same rate limits as the API.
Every change an agent makes is recorded in the audit log with MCP as the actor.