MCP server

openshield runs a remote Model Context Protocol server. An AI agent connected to it can read your organization's usage, decisions, keys, workflows and fraud data, search these docs, moderate a text or an image, and, if you allow it, take a few fraud actions. It acts as the person who connected it, with that person's role, and every call is logged.

https://mcp.openshield.dev/mcp

To wire openshield into your own code instead, see AI coding agents.

Connect an agent

The dashboard's AI agents page shows the address and these snippets with a copy button.

• Claude Code: run claude mcp add --transport http openshield https://mcp.openshield.dev/mcp, then type /mcp to sign in.
• Claude.ai: in Settings, Connectors, add a custom connector with the address.
• Cursor: add it to .cursor/mcp.json or ~/.cursor/mcp.json:

  { "mcpServers": { "openshield": { "url": "https://mcp.openshield.dev/mcp" } } }
  

• VS Code: add it to .vscode/mcp.json:

  { "servers": { "openshield": { "type": "http", "url": "https://mcp.openshield.dev/mcp" } } }
  

The client opens openshield in your browser. You sign in (with your second factor if you have one), pick the organization, and read what the agent asks for before you allow it. The agent never sees your password or your session.

What the agent may do

Three scopes, asked for one by one. An agent starts with mcp:read and asks for more only when it needs it, so you approve each step.

A scope is never more than your role. The agent sees only the tools your role allows: a developer's agent does not see the balance, and a billing member's agent sees no fraud data. If your role changes or you leave the organization, the agent's access follows on its next call.

Tools

Every tool says whether it only reads, and the archive and wake tools are marked destructive, so a client that asks before such a call asks you. A tool answers with structured data and a text copy of it. The text reminds the agent that strings in the data (an event attribute, an email, a list item) were written by your users or by third parties, and are data, not instructions.

moderate_text takes up to 20,000 characters and moderate_image an image of up to 5 MB, in base64. They go through the same checks as the API: the workflow, your balance and your limits. The content is checked and kept nowhere, like the dashboard's Try it console.

Headless agents: an API key

An agent that cannot open a browser (a job in CI, a script) can use a live API key with the MCP server scope, sent as Authorization: Bearer om_live_.... Create it in API keys. A key reads only (mcp:read): it can never moderate or change anything through the MCP server, and it acts with the role of the person who created it, so only that person may give a key this scope. A key's workflow restriction applies to the API, not to these reads: the key reads what its creator's role reads. Sandbox keys (om_test_) are refused.

Organization settings

Owners and admins set, on the AI agents page:

• whether agents may connect at all (on by default). Off, every agent is refused at once;
• whether agents may change fraud data (off by default);
• which roles may connect an agent (owner, admin and developer by default).

Connected agents and the call log

The AI agents page lists the agents connected to the organization: each member sees their own, owners and admins see every one. Disconnect ends the agent's access at once: its tokens stop working and it has to be connected again.

Owners and admins also see the call log: each tool call with its time, the agent, the outcome and how long it took. The log never holds what the agent sent or what it got back. It is kept 90 days. Settings changes, disconnections and every fraud action an agent takes are also in the audit log, marked as coming from the MCP server.

Security

• OAuth 2.1 with PKCE (S256 only), exact redirect addresses, and the iss parameter in every answer. Clients register with a Client ID Metadata Document or by dynamic registration.
• Tokens for this server only: a token is issued for https://mcp.openshield.dev/mcp and refused anywhere else. Access tokens last 10 minutes and are checked on every call; refresh tokens last 30 days and change on every use, and a reused one ends the whole connection.
• Consent per organization: a connection is bound to the organization you picked. To use the agent with another one, connect it again.
• Account recovery: resetting your password disconnects every agent you connected, in every organization. API keys are not tied to your password: revoke a key with the MCP server scope in API keys.
• No browser access: the server answers only POST requests of JSON from programs, one JSON-RPC message per request (no batches). A request from a web page (with an Origin header) is refused.
• Limits: 120 calls a minute per connection or key, and 600 requests a minute per address. A moderation call also counts against the Try it limit of 20 a minute per person.

Protocol details

• Streamable HTTP, stateless, JSON answers. The server speaks MCP 2026-07-28 and 2025-11-25.
• The Protected Resource Metadata (RFC 9728) is at https://mcp.openshield.dev/.well-known/oauth-protected-resource/mcp, and a 401 points to it in WWW-Authenticate.
• The authorization server is https://openshield.dev/api/auth; its metadata is at https://openshield.dev/.well-known/oauth-authorization-server/api/auth.