Skip to main content

Azimuth MCP Server

Azimuth ships a hosted Model Context Protocol (MCP) server, so AI agents and assistants — Claude Code, Claude Desktop, Cursor, or anything else that speaks MCP — can start security scans, poll results, and validate findings directly.

Endpoint​

https://api.testmachine.ai/v1/mcp
  • Transport: Streamable HTTP (stateless, JSON responses). There is no stdio or SSE variant — point your client at the URL above.
  • Methods: MCP requests are sent with POST.

Authentication​

Requests are authenticated with a TestMachine API key. Create one on the API Keys page in the TestMachine app.

Send the key in either header:

X-API-Key: YOUR_API_KEY

or, for MCP clients that only support bearer-token configuration:

Authorization: Bearer YOUR_API_KEY
caution

Treat your API key like a password. Do not commit it to source control or embed it in client-side applications.

Setup​

Claude Code​

claude mcp add --transport http azimuth https://api.testmachine.ai/v1/mcp \
  --header "X-API-Key: YOUR_API_KEY"

Or add it to your project's .mcp.json:

{
  "mcpServers": {
    "azimuth": {
      "type": "http",
      "url": "https://api.testmachine.ai/v1/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Cursor​

Add to ~/.cursor/mcp.json (or .cursor/mcp.json in your project):

{
  "mcpServers": {
    "azimuth": {
      "url": "https://api.testmachine.ai/v1/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Other clients​

Any MCP client that supports remote servers over Streamable HTTP works. Configure:

  • URL: https://api.testmachine.ai/v1/mcp
  • Auth: an X-API-Key header, or a bearer token set to your API key if the client only supports bearer auth

Verify the connection​

List the available tools with a raw request:

curl -s https://api.testmachine.ai/v1/mcp \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

A successful response lists the tools your API key can use. An empty list means the key is valid but has no Azimuth permissions — check the key's permissions on the API Keys page.

Tools​

The tools cover starting scans, browsing and polling results, and validating findings against live chain state. Your client's tool list is the source of truth: availability follows your API key's permissions (and, for live-state validation, whether the feature is enabled for your organization), and new tools are added over time.