Connect your agent

Connect your coding agent to the Enoki MCP server, then register your first target. Claude Code, Claude Desktop, Cursor, and other MCP-capable clients all work.

Endpoint: https://mcp.enokilabs.ai/mcp (streamable HTTP).

Prerequisites

An Enoki workspace (you sign in at app.enokilabs.ai).
A workspace API key with the read and write scopes — and test:run if you want your agent to trigger assessments. See API keys & scopes for how to mint one (workspace admins only). Keys look like egk_… and are shown once.

The full setup flow needs both read and write (write does not imply read), plus test:run to trigger runs. Keys land in config files and connector settings, so grant the least you need.

Connect your client

Authenticate with your API key as a Bearer token. Pick your client:

Claude Code
Cursor
VS Code / other
Claude Desktop / claude.ai

One command. --scope user makes the server available in every project, not just the current one:

claude mcp add --scope user --transport http enoki \
  https://mcp.enokilabs.ai/mcp \
  --header "Authorization: Bearer egk_your_key_here"

Verify with claude mcp list (or /mcp inside a session). The tools appear as mcp__enoki__get_setup_guide, mcp__enoki__create_target, and so on.

Add Enoki to your ~/.cursor/mcp.json (global) or a project .cursor/mcp.json:

{
  "mcpServers": {
    "enoki": {
      "url": "https://mcp.enokilabs.ai/mcp",
      "headers": {
        "Authorization": "Bearer egk_your_key_here"
      }
    }
  }
}

Cursor picks it up from Settings → MCP; the Enoki tools show as connected.

Any client that supports remote MCP over mcp-remote works. Point it at the endpoint with the Bearer header:

{
  "mcpServers": {
    "enoki": {
      "command": "npx",
      "args": [
        "-y", "mcp-remote", "https://mcp.enokilabs.ai/mcp",
        "--header", "Authorization: Bearer egk_your_key_here"
      ]
    }
  }
}

This covers VS Code, Windsurf, Zed, and most other MCP clients.

Add Enoki as a custom connector. The connector runs on Anthropic’s servers rather than your machine, so it also works from claude.ai and mobile.Go to Settings → Connectors → Add custom connector:

Field	Value
Name	`Enoki`
URL	`https://mcp.enokilabs.ai/mcp`
Authentication	None
Additional request headers	`Authorization` → `Bearer egk_your_key_here`

If Claude pre-selects Always required (marked Detected), change it to None. Enoki has no OAuth flow, so leaving that default makes Claude try to register an OAuth client instead of sending your header, and the connection fails with api_key_malformed. Pass the key as a header.

Under Advanced, Transport is detected as Streamable HTTP. Leave it.

Register your first target

A target is one of your agent endpoints, registered so Enoki can test it. Your agent builds the config from your endpoint’s own API docs; start with get_setup_guide, which ships the full field reference and worked examples.

Read the setup guide

Call get_setup_guide. It returns the config field reference plus the semantics the schema can’t express (dot-paths, request-body templating, streaming modes, session capture) and worked examples for HTTP, SSE, and WebSocket endpoints.

Check for duplicates

Call list_targets first. Creates aren’t deduplicated, so a matching name and endpoint_host in the same environment is the same target; reuse its model_id rather than making a second. If only the name or only the host matches, confirm before creating.

Create the target

Call create_target with your config. It’s atomic prove-then-persist: Enoki fires one live probe and saves the target only if it succeeds. On failure it returns a category (unreachable, auth_failed, parse_error, unknown) and saves nothing, so fix and retry (see Troubleshooting). There’s no update or delete over MCP; edit stored targets in the dashboard.

If your agent sits behind OAuth, use it. Set auth_type to oauth_client_credentials and pass an oauth block (token_url, client_id, and scope or audience if your provider wants one), with the client secret as credential. Enoki mints an access token and re-mints it before it expires.That matters because an assessment can run for hours: a static bearer that lapses part-way through fails the run, not just one request. Reach for a hand-minted token only when your provider offers nothing else.

Run an assessment

On success you get a model_id. Pass it to trigger_assessment, poll get_assessment_status, then read results with list_findings and get_finding. See the MCP tool reference.

Scoped, change-relevant runs

A full assessment covers the whole security taxonomy. To gate a frequent deploy on something faster, focus the run on the categories a change actually touches: list the categories, pick the relevant subset, pass those keys to the trigger.

List the categories

MCP: call list_categories. REST: GET /api/v1/category (scope read). Each entry carries a key, a display_name, and a description. The description is what makes an automated choice viable, so hand your agent the whole list rather than a name-only summary. The response is static platform metadata and is cacheable for an hour.

Trigger with the subset

Pass the chosen keys as categories to trigger_assessment (MCP) or POST /api/v1/run (REST), then poll as usual.

What’s next

What we test for

The coverage summary behind the category catalogue.

MCP tool reference

Every tool, its inputs and outputs, and the scope each requires.

Troubleshooting

Probe error categories, auth failures (401/403), and rate limits.

Get started

Connect

MCP

REST API

Prerequisites

Connect your client

Register your first target

Scoped, change-relevant runs

What’s next

What we test for

MCP tool reference

Troubleshooting

​Prerequisites

​Connect your client

​Register your first target

​Scoped, change-relevant runs

​What’s next

What we test for

MCP tool reference

Troubleshooting

Prerequisites

Connect your client

Register your first target

Scoped, change-relevant runs

What’s next