MCP Server

Seclai exposes a Model Context Protocol (MCP) server that lets AI-powered coding tools manage your agents and their definitions directly from your editor or terminal.

Overview

The MCP server provides tools for the full agent lifecycle:

• List, create, update, and delete agents
• Read and update agent definitions (steps, tags, configuration)
• Manage agent evaluations — criteria CRUD, draft testing, and results inspection
• Manage knowledge bases — create, update, and delete KB configurations
• Create, list, and configure content sources — create, view, update, and delete sources
• Search resources — find agents, knowledge bases, sources, solutions, memory banks, alerts, API keys, and governance policies
• Monitor alerts — list, view, resolve, and comment on alerts; manage alert configurations
• Manage solutions — create, update, delete solutions and link/unlink agents, KBs, and sources
• Agent AI assistant — generate step configs and full agent workflows
• Solution AI assistants — generate and execute plans for managing sources, knowledge bases, and full solution configurations
• Manage governance — configure policies, settings, evaluations, and use the governance AI assistant
• Browse reference resources like the agent definition schema and string substitutions

This means you can ask your AI assistant things like "create a new agent that summarizes RSS feeds daily", "create a knowledge base from my podcast sources", "change the polling interval on my news feed to hourly", "show me any open alerts", "use the AI assistant to generate a transform step that extracts article titles", "create a solution to organize my podcast workflow", "use the AI assistant to set up sources and a knowledge base for my new project", "show me my governance stats", or "use the governance assistant to add a PII policy" and it will use the MCP tools to make those changes in Seclai directly.

Prerequisites

Before setting up the MCP server, you need:

1. A Seclai account with an active subscription that includes API access
2. An MCP-compatible client such as Claude Desktop, Claude Code, Cursor, or Windsurf

Authentication

The MCP server supports two authentication methods:

OAuth (recommended) — Most MCP clients support OAuth automatically. Simply enter the server URL and your client will open a sign-in page. No API key needed. OAuth provides automatic token refresh and doesn't require sharing secrets.

API key (fallback) — For clients or environments that don't support OAuth, use a user-scoped API key via the X-API-Key header. Create one from the API Keys page.

Your plan must have API access enabled. Upgrade your plan in account settings if needed.

If using API keys, MCP requires user-scoped keys. If you get an error about user association, re-create your API key.

Available Tools

The MCP server provides these tools:

Agent Tools

Agent Evaluation Tools

Use these tools to configure step-level quality criteria, run ad-hoc evaluation tests, and inspect evaluation outcomes.

pass_threshold is supported by create/update/test-draft tools and must be in the range 0.0 to 1.0.

Knowledge Base Tools

Memory Bank Tools

Memory banks give agents persistent conversation memory. See Memory Banks for full details.

Content Source Tools

Search Tools

Alert Tools

Solution Tools

Solutions let you group related agents, knowledge bases, and content sources into projects.

Agent AI Assistant Tools

All AI assistant tools use a cost-effective model with tool-use support.

Prompt Call convention used by MCP AI tools:

• Use {{agent.input}} for the user's original message
• Use {{input}} only for previous-step output/context
• Place instruction logic in the Prompt Call system_template

Model lifecycle fields can also be generated and updated through MCP:

• Agent-level defaults: prompt_model_auto_upgrade_strategy, prompt_model_auto_rollback_enabled, prompt_model_auto_rollback_triggers
• Step-level overrides on prompt_call and insight: auto_upgrade_strategy, auto_rollback_enabled, auto_rollback_triggers

Recommended prompt for generate_step_config:

"Configure this prompt_call step to use cautious auto-upgrade with rollback enabled on governance_block and agent_eval_fail, while keeping temperature low for deterministic output."

Recommended prompt for generate_agent_steps:

"Build an agent that uses model lifecycle defaults: middle_of_road auto-upgrade, rollback enabled, triggers agent_eval_fail + governance_block."

Solution AI Assistant Tools

The solution AI assistants use a propose-then-accept workflow: you describe what you want in natural language, the assistant generates a plan with proposed actions, and you review and accept or decline the plan before any changes are made. Destructive actions (deletions) require explicit confirmation.

Governance Tools

Governance lets you define policies that evaluate agent and source content for safety, PII, bias, and other concerns. All governance tools require a subscription plan with governance access enabled. If your plan does not include governance, these tools will return an error.

See the Governance documentation for a full explanation of policies, scoping, enforcement levels, knowledge base associations, and other concepts.

Policy management:

Knowledge base associations:

Settings and statistics:

Evaluations and testing:

Audit trail and cost estimation:

Governance AI Assistant Tools

The governance AI assistant uses the same propose-then-accept workflow as the solution AI assistant: describe what you want, review the proposed policy changes, then accept or decline.

Available Resources

The server also exposes reference resources that your AI assistant can read for context:

Setup

The MCP server endpoint is:

https://mcp.seclai.com/

It uses the HTTP transport and supports OAuth authentication (recommended) or API key authentication via the X-API-Key header.

Most MCP clients support OAuth automatically — just enter the server URL and sign in when prompted. For clients that require manual API key configuration, see the instructions below.

Claude Desktop

Claude Desktop supports OAuth natively. Add the server URL to your config:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "seclai": {
      "type": "http",
      "url": "https://mcp.seclai.com/"
    }
  }
}

Restart Claude Desktop. It will prompt you to sign in via your Seclai account.

{
  "mcpServers": {
    "seclai": {
      "type": "http",
      "url": "https://mcp.seclai.com/",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Claude Code (CLI)

Claude Code supports OAuth natively. Add the server:

claude mcp add seclai \
  --transport http \
  "https://mcp.seclai.com/"

Claude Code will handle OAuth authentication automatically when you first use the server.

claude mcp add seclai \
  --transport http \
  "https://mcp.seclai.com/" \
  --header "X-API-Key: YOUR_API_KEY"

{
  "mcpServers": {
    "seclai": {
      "type": "http",
      "url": "https://mcp.seclai.com/",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Cursor

1. Open Cursor Settings (Cmd+, on macOS, Ctrl+, on Windows/Linux)
2. Navigate to MCP in the sidebar
3. Click Add new MCP server
4. Set:
   • Name: seclai
   • Type: http
   • URL: https://mcp.seclai.com/
5. Save

Cursor will prompt you to authenticate via OAuth when you first use the server.

{
  "mcpServers": {
    "seclai": {
      "type": "http",
      "url": "https://mcp.seclai.com/",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Windsurf

Add to your ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "seclai": {
      "type": "http",
      "url": "https://mcp.seclai.com/"
    }
  }
}

Windsurf will prompt you to authenticate via OAuth when connecting.

{
  "mcpServers": {
    "seclai": {
      "type": "http",
      "url": "https://mcp.seclai.com/",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Other MCP Clients

Any client that supports the HTTP MCP transport can connect. Configure it with:

• URL: https://mcp.seclai.com/
• Transport: HTTP
• Auth: OAuth (automatic) or X-API-Key: YOUR_API_KEY header

Usage Examples

Once connected, you can interact with Seclai through natural language. Here are some examples:

List your agents:

"Show me all my Seclai agents"

Create a new agent:

"Create a new Seclai agent called 'Daily News Digest' with a schedule trigger and the summarizer template"

Read an agent's definition:

"Get the full definition for my Daily News Digest agent"

Modify an agent's steps:

"Add a retrieval step before the display step in my Daily News Digest agent that searches the news knowledge base"

Delete an agent:

"Delete the test agent I created earlier"

List your knowledge bases:

"Show me all my knowledge bases"

Create a knowledge base:

"Create a knowledge base called 'Podcast Archive' using my podcast sources"

Create and manage sources:

"Create an RSS feed source for https://example.com/feed.xml"

"Show me all my content sources and change the news feed to poll hourly"

Manage solutions:

"Create a solution called 'Podcast Pipeline' for my podcast-related agents and sources"

"Link my summarizer agent and podcast knowledge base to the Podcast Pipeline solution"

Use the solution AI assistants:

"Use the AI assistant to set up RSS feed sources for my three favorite news sites within the News Digest solution"

"Generate a knowledge base plan for my podcast solution that creates a KB from all my podcast sources"

"Generate a comprehensive plan for my solution that adds a new source, creates a KB, and configures an agent"

"Accept the proposed plan" or "Accept the plan and confirm the deletions"

"Decline the proposed plan, I want to try a different approach"

View and manage alerts:

"Show me any open alerts for my Daily News Digest agent"

"Resolve alert abc123 with a comment that the upstream API is fixed now"

Configure alert rules:

"Set up an alert that fires after 3 consecutive failures on my Daily News Digest agent"

"Show me all alert configurations for my agent"

Use the agent AI assistant to generate configs:

"Use the AI assistant to generate a transform step configuration that extracts article titles and URLs"

"Generate a full agent workflow that monitors RSS feeds and sends a daily email summary"

Configure evaluation criteria and thresholds:

"Create evaluation criteria for step final-answer with prompt 'Check factual accuracy and completeness', pass_threshold 0.75, tier balanced"

"Update criteria abc123 and set pass_threshold to 0.85"

"Test draft evaluation for this step output with pass_threshold 0.8 before saving"

Use evaluate_step in a workflow:

"Add an evaluate_step after generate-report targeting generate-report with pass_threshold 0.7"

"Add a gate after the evaluate_step so the workflow branches on passed/failed"

Review agent AI suggestions:

"Show me the AI conversation history for the transform step of my agent"

"Accept the last AI suggestion for my transform step"

Manage governance policies:

"Provision the default governance policies for my account"

"List my governance policies"

"Create a PII policy scoped to my customer support agent"

"Disable the bias policy and set the content safety policy's block threshold to 0.95"

"Delete the custom policy I created earlier"

Governance settings and monitoring:

"Show me my governance settings"

"Enable input review for my agent and set the evaluation tier to thorough"

"Show me my governance stats for the last 7 days"

"List any unresolved flagged evaluations"

"Resolve evaluation abc123 — it was a false positive"

Test governance policies:

"Test the text 'Please send your social security number' against my governance policies"

Use the governance AI assistant:

"Use the governance assistant to add PII and content safety policies with strict thresholds"

"Accept the proposed governance plan"

"Decline the governance plan, I want different thresholds"

Your AI assistant will use the MCP tools to perform these actions. It can also read the agent definition schema and string substitutions resources for reference when building definitions.

Optimistic Locking

When updating agent definitions, the MCP server uses optimistic locking to prevent overwriting concurrent changes:

1. Call get_agent_definition — the response includes a change_id
2. Call update_agent_definition with the expected_change_id set to the change_id from step 1
3. If the definition was modified between steps 1 and 2, you'll get a conflict error — re-read and retry

Your AI assistant handles this automatically. If you see a conflict error, simply repeat your request and it will re-read the latest definition before applying changes.

Agent Templates

When creating agents, you can specify a template to start with a pre-configured definition:

Rate Limits

MCP calls are rate-limited per account based on your subscription plan. Each tool call counts as one MCP call. The limit is enforced as a sliding window per minute.

When you exceed the limit, tool calls will return an error with a retry_after value indicating how many seconds to wait before retrying. Most AI assistants will handle this automatically.

If you need higher limits, contact us about an Enterprise plan or request a per-account override.

Streaming agents via MCP: Agents with a streaming_result step work normally when run via MCP — the agent executes and you receive the final output. However, real-time token streaming (stream_token / stream_end SSE events) is only available via the REST API streaming endpoint. MCP runs always return the complete output after the run finishes.

Troubleshooting

"Invalid API key" error

• Verify your API key is correct and hasn't been archived or deleted
• Ensure your account is in good standing (not suspended or delinquent)
• Confirm your plan includes API access
• MCP requires user-scoped API keys — if you get a "user-scoped" error, re-create your key

"MCP requires a user-scoped API key" error

• Your API key was created before user-scoping was introduced
• Create a new API key from your account settings — new keys are automatically user-scoped
• Delete or archive your old key to avoid confusion

"Rate limit exceeded" error

• Wait the number of seconds indicated in the error before retrying
• Consider upgrading your plan if you consistently hit the limit
• Check that you aren't running multiple MCP clients with the same key simultaneously

Tools not appearing in your client

• Restart your MCP client after configuration changes
• Verify the URL is exactly https://mcp.seclai.com/
• Check that you're using the http transport type (not sse or stdio)
• Look at your client's MCP logs for connection errors

"Missing X-API-Key header" error

• Ensure the X-API-Key header is configured in your MCP client settings
• Some clients require restarting after adding headers

Conflict errors when updating definitions

• This means the definition was changed since you last read it
• Simply retry your request — your AI assistant will re-read the latest definition and try again

OAuth sign-in page doesn't appear

• Confirm your MCP client supports OAuth (Claude Desktop, Claude Code, Cursor, and Windsurf all do)
• If your client doesn't support OAuth, fall back to API key authentication
• Check your client's MCP logs for connection or redirect errors

OAuth token expired

• Most clients refresh tokens automatically. If you see repeated 401 errors, disconnect and reconnect the server to re-authenticate
• Clearing your client's MCP credential cache may also help

Next steps:

• API Keys — Create and manage API keys
• Agents — Learn about agent concepts
• Agent Steps — Reference for all step types
• API Introduction — REST API overview