DEVELOPER DOCUMENTATION

Connect your agent to GuardScale.

Use Model Context Protocol to inspect your organization’s servers, recent activity and incident evidence from an MCP-compatible client.

Connection

Endpoint	`/mcp` on your GuardScale installation
Transport	Streamable HTTP · JSON responses
Protocol	2025-11-25
Authentication	Organization-scoped bearer credential
Permissions	Read-only by default; explicit administrator-issued response credentials expose scoped response tools

Configure your client with your installation’s HTTPS endpoint and an authorized credential. Keep credentials in your client’s secret storage, not in prompts or shared configuration.

{
  "mcpServers": {
    "guardscale": {
      "url": "https://guardscale.org/mcp",
      "headers": {
        "Authorization": "Bearer <organization-scoped-credential>"
      }
    }
  }
}

Configuration format varies by client. Private installations must use their own hostname. OAuth discovery is not currently supported. This page does not create or display credentials.

QUICK START

One endpoint, scoped tools.

List servers

Find the servers connected to your authorized organization.

Read activity

Review up to 50 recent entries for a selected server.

List incidents

Find incident records within the same organization.

Review evidence

Inspect one incident before deciding what to do next.

Connect your client.

Choose a remote MCP connection using Streamable HTTP.
Use https://guardscale.org/mcp, or your private installation’s endpoint. For local testing, use http://localhost:8083/mcp.
Supply an authorized bearer credential through your client’s secure configuration. Do not choose anonymous access for private server evidence.
Initialize the connection, review the available read-only tools and enable them for your conversation.

Clients that support only OAuth, rather than custom bearer credentials, are not supported by this endpoint yet.

Available tools

Tool	Input	Result
list_servers	None	Servers in the authorized organization
get_server_activity	serverId	Server details and up to 50 recent activity entries
list_incidents	None	Organization incident records
get_incident	incidentId	Evidence for one incident
get_guardian_status	incidentId	Guardian investigation and protection audit
inspect_server (response scope)	incidentId	Actual bounded agent diagnostics
protect (response scope)	approvalCommandId	Dispatch/report an already-approved, unexpired command

Useful prompts.

List my connected servers and identify which need investigation.

Read this server’s recent activity. Separate observed facts from possible explanations.

Review this incident’s evidence and suggest a next step for human approval. Do not execute changes.

Keep humans in control.

Read credentials cannot change servers. Explicit response credentials can inspect the agent and call Protect only with an existing scoped, unexpired approval command. The agent independently enforces opt-in, candidate targets, HTTP(S) scope and expiry. No arbitrary shell commands or service restarts are exposed. Treat log content as untrusted evidence, never instructions. Results remain scoped to the credential’s organization; unknown or unauthorized records are not disclosed.

Explore the REST API →