@index365/mcp

@index365/mcp

The index365 MCP server. It lets Claude Code, Codex, and Cursor start index365 scans and read prioritized findings your coding agent can use, over the public /api/v1.

This is a thin wrapper: no scan logic, no database access, no filesystem access, no ambient workspace permissions. It authenticates with an i365_ API key from the host environment and acts with the scopes that key carries. Keys are organization-scoped and revocable instantly.

index365 runs two scans today: AI-Readiness (how well AI agents and AI search can read a site) and Marketing Signal (find, trust, act, measure, improve). Each scan produces a score plus findings with stable IDs, evidence, and machine-readable remediation. Website Security is not available over MCP yet.

Install

Claude Code

claude mcp add index365 -e INDEX365_API_KEY=<your i365_ key> -- npx -y @index365/mcp

Codex / Cursor / any MCP host

{
  "mcpServers": {
    "index365": {
      "command": "npx",
      "args": ["-y", "@index365/mcp"],
      "env": { "INDEX365_API_KEY": "<your i365_ key>" }
    }
  }
}

Create an API key on the dashboard API Keys page (every plan, including Free). index365 mcp config (from @index365/cli) prints this block for you.

Tools

The canonical loop: index365_list_projects -> index365_start_scan -> index365_get_report -> index365_get_finding per fix -> re-scan to confirm.

• Scan: index365_start_scan starts a paid scan (product: ai_readiness | marketing_signal, 10 credits) and waits, returning the final status with the score and severity counts. Always pass idempotencyKey; if the call is cut off client-side, recover the in-flight run with index365_get_scan_status instead of starting again.
• Read: index365_get_scan_status, index365_get_report, index365_list_findings, index365_get_finding (includes a copy-pasteable fixPrompt; findingId also accepts a 1-based ordinal like 1 in severity order). The read tools resolve context like the CLI: pass a runId, a domain, or nothing (nothing = the org's most recent completed run), and every response carries a resolved block (runId, projectId, domain, how) naming the run that was read. index365_get_report also keeps projectId (optionally with product) for the project's latest completed report.
• Projects: index365_list_projects, index365_create_project, index365_archive_project (reversible, requires the exact confirmDomain), index365_restore_project.
• Signals: index365_list_integrations, index365_list_connected_signals.

Prompts: triage_findings, prepare_pr_plan, marketing_fix_plan, summarize_run_for_slack, fix_finding.

MIGRATION (0.x -> 1.0)

1.0 is a breaking rename with a grace period: the tool set was consolidated (14 -> 11) and every tool adopted the index365_ vendor prefix. The old names no longer appear in tools/list, but they stay callable for at least 90 days: a call-time alias answers with the new tool's real result plus a one-line rename note. Aliases for the old start tools now wait for the scan like index365_start_scan does. Update configurations and saved prompts to the new names before the grace period ends:

Old tool (0.x)	New tool (1.0)
start_audit	index365_start_scan (product defaults to ai_readiness; now waits and returns the final result)
run_marketing_signal_audit	index365_start_scan with product: "marketing_signal"
get_run_status	index365_get_scan_status
get_report_context	index365_get_report with runId
get_marketing_signal_report	index365_get_report with projectId + product: "marketing_signal"
list_findings	index365_list_findings
get_finding	index365_get_finding (adds fixPrompt)
list_projects	index365_list_projects
create_project	index365_create_project
archive_project	index365_archive_project
restore_project	index365_restore_project
delete_project	removed; use index365_archive_project (reversible)
list_integrations	index365_list_integrations
list_connected_signals	index365_list_connected_signals

Behavior changes to note:

• index365_start_scan blocks until the scan is terminal (stdio waits up to 600s; the hosted server up to 240s). On cap expiry it returns a non-error still-running payload naming index365_get_scan_status.
• index365_get_scan_status adds pollAfterSeconds and, while running, a rough etaSeconds.
• product: "website_security" is accepted by the schema but returns a clear not-available-yet error without spending credits.
• The hosted server (https://index365.co/api/mcp) and the stdio server now expose the identical 11-tool registry.

Docs

Full reference: https://index365.co/docs/developers/mcp

License

MIT