[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_107":108},"routes/modules.$creator.$moduleId",{"_14":15,"_16":17,"_18":19,"_20":21},"routes/modules.$creator.$moduleId.endpoints",{"_11":12,"_13":-5},"error","Module '@arcjet/mcp' is not configured","tools","module",{"_20":22,"_23":24,"_25":26,"_27":28,"_29":30,"_31":32,"_33":26,"_34":-5,"_35":36,"_37":-5,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":52,"_53":54,"_55":48,"_56":57,"_58":59,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":65,"_66":67,"_68":69,"_70":71,"_72":73,"_74":-5,"_75":-5,"_76":-5,"_77":48,"_78":-5,"_79":80,"_81":82,"_83":84,"_85":86,"_87":88,"_89":90,"_91":92},"apiUrl","https://odel.app/api","creator","arcjet","moduleId","mcp","@arcjet/mcp","displayName","Arcjet","tagline","An MCP server for Arcjet - the runtime security platform that ships with your AI code.","iconKey","https://avatars.githubusercontent.com/u/24397786?v=4","category","dev-tools","status","published","metaDescription","metaKeywords","deploymentType","external","workerName","bindingName","mcpConfig","{\"url\":\"https://api.arcjet.com/mcp\",\"transport\":\"streamable-http\",\"authType\":\"none\"}","pricingModel","free","creatorUserId","system:external-import","createdAt",1781363244000,"updatedAt",1781499365000,"sourceRegistry","official-mcp-registry","sourceUrl","https://registry.modelcontextprotocol.io/v0/servers?search=com.arcjet%2Fmcp","sourceVerified",false,"importedAt","upstreamStars",1,"upstreamUpdatedAt",1775760637000,"detectedTransport","detectedAuthType","probeStatus","lastProbedAt","githubRepoUrl","https://github.com/arcjet/mcp","githubRepoFullName","arcjet/mcp","releaseId","ext-arcjet-mcp","version","1.0.0","descriptionMarkdown","\n

\n\n\n# Arcjet - MCP Server\n\n[Arcjet](https://arcjet.com) is the runtime security platform that ships with your code. Enforce budgets, stop prompt injection, detect bots, and protect personal information with Arcjet's AI security building blocks.\n\nThe Arcjet MCP server gives AI coding assistants the skills of a security engineer. By connecting to the Arcjet MCP server, your AI coding tools can:\n\n- **List teams** you belong to.\n- **List sites** within a team.\n- **Create new sites** within a team.\n- **Get site keys** (`ARCJET_KEY`) for use in your projects.\n- **List requests** received by a site with optional filtering.\n- **Explain decisions** to understand why requests were allowed or denied.\n- **Get request details** including headers, rules executed, and decision info.\n- **Get site quota** usage and limits for the current billing window.\n- **Analyze traffic** patterns, denial rates, top paths, and top IPs.\n- **Detect anomalies** by comparing current traffic to the previous period.\n- **Investigate IPs** with geo, threat intelligence, and request activity.\n- **Get dry-run impact** analysis before promoting rules to live.\n- **Get a security briefing** combining traffic, threats, anomalies, and recommendations.\n- **List remote rules** configured for a site.\n- **Create remote rules** with DRY_RUN or LIVE mode — configure rules with no code changes needed.\n- **Update remote rules** by replacing the full rule configuration.\n- **Delete remote rules** to immediately stop evaluation.\n- **Promote remote rules** from DRY_RUN to LIVE after verification.\n\nThe MCP server is available at:\n\n```\nhttps://api.arcjet.com/mcp\n```\n\nIt implements the latest\n[MCP Authorization](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization)\nand\n[Streamable HTTP](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#streamable-http)\nspecifications with OAuth-based authentication.\n\n## Supported clients\n\nAny client that supports the latest [MCP\nspecification](https://modelcontextprotocol.io/specification/2025-06-18) with\n[Streamable HTTP transport](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#streamable-http)\nand [OAuth authorization](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization)\nis supported. This includes:\n\n- [ChatGPT](#chatgpt)\n- [Claude Code](#claude-code)\n- [Claude Desktop](#claude-desktop)\n- [Cursor](#cursor)\n- [VS Code with Copilot](#vs-code-with-copilot)\n- [Windsurf](#windsurf)\n- Many others that implement the MCP specification.\n\n## Setup\n\n### ChatGPT\n\n1. In ChatGPT, go to **Settings**.\n2. Navigate to **Connectors** and select **Add connection**.\n3. Enter `https://api.arcjet.com/mcp` as the server URL.\n4. Select **OAuth** for authentication.\n5. Click **Create**.\n\nChatGPT handles the OAuth flow automatically.\n\n### Claude Code\n\n```bash\nclaude mcp add arcjet --transport http https://api.arcjet.com/mcp\n```\n\nClaude Code will open a browser for OAuth authentication on first connection.\nOnce authenticated, you can use the `/mcp` command to verify the connection.\n\n### Claude Desktop\n\n\n\n1. Open **Settings** in the sidebar.\n2. Navigate to **Connectors** and select **Add custom connector**.\n3. Configure the connector:\n - **Name:** `Arcjet`\n - **URL:** `https://api.arcjet.com/mcp`\n\n### Cursor\n\nAdd to `.cursor/mcp.json` in your project:\n\n```json\n{\n \"mcpServers\": {\n \"arcjet\": {\n \"type\": \"streamable-http\",\n \"url\": \"https://api.arcjet.com/mcp\"\n }\n }\n}\n```\n\nAfter adding the server, Cursor will show a **Needs login** prompt. Click it to\nauthorize Cursor to access your Arcjet account.\n\n### VS Code with Copilot\n\nAdd to your `.vscode/mcp.json` in your project or user settings:\n\n```json\n{\n \"servers\": {\n \"arcjet\": {\n \"type\": \"http\",\n \"url\": \"https://api.arcjet.com/mcp\"\n }\n }\n}\n```\n\nOr add it via the command palette:\n\n1. Open the Command Palette (Ctrl+Shift+P on\n Windows/Linux or Cmd+Shift+P on macOS).\n2. Run **MCP: Add Server**.\n3. Select **HTTP**.\n4. Enter the URL: `https://api.arcjet.com/mcp`\n5. Enter the name: `Arcjet`\n6. Select **Workspace** or **User** depending on your preference.\n\nVS Code will prompt you to authenticate via OAuth on first use.\n\n### Windsurf\n\nAdd to your `mcp_config.json` file:\n\n```json\n{\n \"mcpServers\": {\n \"arcjet\": {\n \"serverUrl\": \"https://api.arcjet.com/mcp\"\n }\n }\n}\n```\n\nFor more details, see the\n[Windsurf MCP documentation](https://docs.windsurf.com/windsurf/cascade/mcp#adding-a-new-mcp-plugin).\n\n## Available tools\n\nOnce connected, the following tools are available to your AI assistant:\n\n- **`list-teams`** — Lists teams the authenticated user belongs to.\n- **`list-sites`** — Lists sites within a specified team.\n- **`create-site`** — Creates a new site within a specified team.\n- **`get-site-key`** — Returns the SDK key (`ARCJET_KEY`) for a specific site.\n- **`list-requests`** — Lists recent requests for a site. Supports filtering by conclusion (`ALLOW`, `DENY`, `ERROR`) and pagination.\n- **`get-request-details`** — Returns full details for a specific request including headers, rules executed, and decision information.\n- **`explain-decision`** — Explains why Arcjet allowed or denied a specific request. Returns a natural language summary, per-rule breakdown, and suggested next steps.\n- **`get-site-quota`** — Returns quota usage and limits for a site in the current billing window.\n- **`analyze-traffic`** — Analyzes request traffic over a time period. Returns total requests, denials, denial rate, top paths, top IPs, top denial reasons, and trend vs the previous period.\n- **`get-anomalies`** — Detects unusual security patterns by comparing current traffic to the previous period. Identifies traffic spikes, geographic shifts, new threat activities, new bot signatures, risk escalation, and suspicious IP patterns.\n- **`investigate-ip`** — Investigates an IP address in the context of a site. Returns geo location, threat intelligence (network type, threat activities, entity classification, risk level), and the IP's recent request activity (conclusion breakdown, denial reasons, targeted paths, daily timeline).\n- **`get-dry-run-impact`** — Analyzes what would happen if dry-run rules were promoted to live. Shows how many currently-allowed requests would have been blocked by each rule type, which IPs would be most affected, and a false-positive estimate.\n- **`get-security-briefing`** — Returns a comprehensive security briefing: active rules summary, traffic analysis, threat intelligence, anomaly detection, dry-run promotion readiness, quota status, and prioritized actionable recommendations. Designed for daily consumption.\n- **`list-rules`** — Lists all remote rules configured for a site with their ID, type, mode, and configuration summary.\n- **`create-rule`** — Creates a new remote rule for a site. Supports rate limit, bot, shield, and filter rule types.\n- **`update-rule`** — Replaces an existing remote rule configuration. All fields must be provided (full replacement).\n- **`delete-rule`** — Deletes a remote rule, immediately stopping it from being evaluated.\n- **`promote-rule`** — Promotes a remote rule from DRY_RUN to LIVE mode after verification.\n\n### Remote rules\n\nRemote rules are managed through the MCP server or the Arcjet dashboard — no\ncode changes or redeployment needed. They apply globally to all requests for a\nsite. Only `rate_limit`, `bot`, `shield`, and `filter` rule types are supported\nas remote rules. Rules that need parsed request body content (`email`,\n`sensitive_info`, `prompt_injection`) require the SDK.\n\nThe most common use case for remote rules is responding to an active attack. For\nexample, if you notice suspicious traffic from a specific country, VPN, or IP\naddress, you can create a filter rule to block it immediately without deploying\nnew code:\n\n1. Use `list-requests` to investigate the suspicious traffic and identify\n patterns (e.g. a specific country, IP range, or VPN usage).\n2. Use `create-rule` to add a filter rule in `DRY_RUN` mode to verify it\n matches the right traffic. For example, block a specific country:\n `ip.src.country == \"XX\"` (ISO 3166-1 alpha-2 country code e.g. `US`, `CN`,\n `RU`), block VPN traffic: `ip.src.vpn`, or block an IP range:\n `ip.src in { 1.2.3.0/24 }`.\n3. Use `list-requests` again to confirm the rule is matching the expected\n traffic without blocking legitimate users.\n4. Use `promote-rule` to switch the rule from `DRY_RUN` to `LIVE`, immediately\n blocking the attack traffic.\n5. Once the attack subsides, use `delete-rule` to remove the block.\n\n### Security monitoring\n\nUse the analysis tools to maintain ongoing security awareness:\n\n- **Daily briefing:** Call `get-security-briefing` periodically to get a\n comprehensive overview of your site's security posture — traffic trends,\n threat landscape, anomalies, dry-run readiness, quota status, and prioritized\n recommendations — all in a single call.\n- **Traffic analysis:** Use `analyze-traffic` to understand request patterns,\n denial rates, top paths, and top IPs. This provides the same data as the\n Arcjet dashboard analytics.\n- **Anomaly detection:** Use `get-anomalies` to detect unusual patterns by\n comparing current traffic to the previous period — traffic spikes, geographic\n shifts, new threat activities, or suspicious IP behavior.\n- **IP investigation:** When you identify a suspicious IP (from `analyze-traffic`\n or `list-requests`), use `investigate-ip` to get full context: geo location,\n threat intelligence, and the IP's complete request activity on your site.\n- **Dry-run validation:** Before promoting a rule from `DRY_RUN` to `LIVE`, use\n `get-dry-run-impact` to see exactly how many currently-allowed requests would\n be blocked, which IPs are most affected, and a false-positive risk estimate.\n\n## Usage examples\n\n### Investigate and block suspicious traffic\n\n> \"I'm seeing a spike in denied requests on my site. Can you investigate what's\n> happening and help me block the source?\"\n\nThe assistant will call `analyze-traffic` to identify the spike, then\n`list-requests` filtered to `DENY` to surface the top offending IPs. It uses\n`investigate-ip` to pull threat intelligence for each IP, then\nsuggests a filter rule. Using `create-rule`, it creates the rule in `DRY_RUN`\nmode so you can verify the match before calling `promote-rule` to go live.\n\n### Get a daily security briefing\n\n> \"Give me a security briefing for my production site.\"\n\nThe assistant calls `list-teams` and `list-sites` to locate your production\nsite, then calls `get-security-briefing`. It returns a summary covering active\nrules, traffic trends vs. the previous period, anomaly detection, threat\nintelligence highlights, dry-run promotion readiness, quota status, and\nprioritized recommendations you can act on immediately.\n\n### Set up bot protection without redeploying\n\n> \"Add bot protection to my marketing site — start in dry-run mode so I can\n> check it's not blocking real users.\"\n\nThe assistant calls `list-teams` and `list-sites` to find the site, then\n`create-rule` to add a `bot` rule with `mode: DRY_RUN` configured to block\nautomated traffic. After traffic flows through, you can ask the assistant to call\n`get-dry-run-impact` to see how many requests would have been blocked and\nestimate false-positive risk, then `promote-rule` to switch the rule to `LIVE`\nwhen you're satisfied.\n\n## Authentication\n\nThe MCP server uses OAuth for authentication. When you first connect from any\nsupported client, you will be redirected to sign in with your Arcjet account.\nOnce authenticated, your AI assistant can securely access your account resources.\n\n## Security\n\n- **Verify the endpoint** — always confirm you are connecting to\n `https://api.arcjet.com/mcp`.\n- **Review tool calls** — enable confirmation prompts in your AI client so you\n can review actions before they execute.\n- **Trusted clients only** — only connect from AI clients you trust. Connecting\n grants the AI tool the same access as your Arcjet account.\n\n## Privacy and support\n\n- **Privacy policy:** [arcjet.com/privacy](https://arcjet.com/privacy)\n- **Support:** [support@arcjet.com](mailto:support@arcjet.com) or [join our\n Discord](https://arcjet.com/discord). See our [support page](https://github.com/arcjet/mcp/blob/main/support) for\n more details.\n","changelogMarkdown","videoKey","requiredSecretsJson","publishedAt","priceCents","trialDays",0,"categoryDisplayName","Developer Tools","upstream",{"_95":96,"_97":-5,"_98":-5,"_99":100,"_101":102},"requiredSecrets",[],"tags",[],"assets",[],"stats",{"_93":80,"_94":80},"ratingAvg","reviewCount","topics",[103,104,21,105,106],"license","language","registryName","com.arcjet/mcp","homepage","https://docs.arcjet.com/mcp-server","bot-detection","devtools","mcp-server","security","ENV",{"_109":110,"_111":112,"_113":114},"ENVIRONMENT","production","TURNSTILE_SITE_KEY","0x4AAAAAAB8-rEI2gNDf_QhU","SENTRY_DSN","https://45fd1229f78089d5c3ee78be128030e1@o4510583261757440.ingest.de.sentry.io/4510584253448272"]