Client Posture
Start free

Documentation

MCP server

Connect an AI assistant you already use — Claude, ChatGPT, Cursor, or VS Code — to Client Posture with a per-person API key. We host no model and do not pay for tokens. The assistant can read your organization's data and, on Pro, draft quotes. It cannot send, accept, or delete.

Included with Pro and Founding Partner. Try it free: 7 days of Pro, no card.

Start free

Who can use it

Gating matches the live MCP server. See pricing.

PlanMCP access
FreeNone
StarterNone
Founding PartnerSame as Pro except quote drafts. Per-person API keys. No sends, accepts, or deletes.
ProConnect Claude or ChatGPT through MCP to read your org's scans, findings, and prospects, and draft quotes. Per-person API keys. No sends, accepts, or deletes.
  • Create a key in Settings › AI assistants.
  • Founding Partner who later upgrades to Pro gets quote drafts as well (quoting is Pro-only).
  • Founding Partner can add prospects in the app and through MCP. Quote drafts stay Pro-only.

Supported clients

ClientAPI key
CursorYes
VS Code (Copilot agent mode)Yes
Claude CodeYes
Claude DesktopYes
ChatGPT desktopYes
claude.ai / ChatGPT webNot yet. OAuth on a separate /mcp endpoint is deferred.

Quick start

  1. Create a key in Settings › AI assistants. Copy it once.
  2. Paste a snippet below. Endpoint: https://www.clientposture.com/api/mcp
  3. Try the prompt “Run the morning risk digest.”

Cursor

Put the key in CLIENT_POSTURE_API_KEY so it is not synced in mcp.json.

{
  "mcpServers": {
    "client-posture": {
      "url": "https://www.clientposture.com/api/mcp",
      "headers": { "Authorization": "Bearer ${env:CLIENT_POSTURE_API_KEY}" }
    }
  }
}

VS Code (Copilot agent mode)

Use mcp.json (not .mcp.json). VS Code prompts once and stores the key.

{
  "inputs": [
    { "type": "promptString", "id": "cp-key", "description": "Client Posture API key", "password": true }
  ],
  "servers": {
    "client-posture": {
      "type": "http",
      "url": "https://www.clientposture.com/api/mcp",
      "headers": { "Authorization": "Bearer ${input:cp-key}" }
    }
  }
}

Claude Code

Replace the key after you create one.

claude mcp add --transport http client-posture https://www.clientposture.com/api/mcp \
  --header "Authorization: Bearer cp_live_XXXX"

Claude Desktop

Requires Node.js 18+. No space after Authorization:. Restart Claude after saving.

{
  "mcpServers": {
    "client-posture": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://www.clientposture.com/api/mcp",
               "--header", "Authorization:${CP_AUTH}"],
      "env": { "CP_AUTH": "Bearer cp_live_XXXX" }
    }
  }
}

ChatGPT desktop

Set CLIENT_POSTURE_API_KEY in the environment that launches the app, then fully restart it.

[mcp_servers.client-posture]
url = "https://www.clientposture.com/api/mcp"
bearer_token_env_var = "CLIENT_POSTURE_API_KEY"

Tools

Generated from the live tool catalog. 18 read tools and 4 act tools. Read keys see the 18 read tools. Pro act keys see all 22. Founding Partner act keys see 21 tools — everything except create_quote_draft.

get_account_contextreadPro and Founding Partner

Who you are, plan features, remaining MCP budget, and org counts. Call this first.

No arguments

list_clientsreadPro and Founding Partner

List client domains with the latest grade. A client is a domains row; label is the client name.

  • query — string
  • grade — array
  • include_archived — boolean
  • sort — string
  • limit — integer
  • cursor — string
get_domainreadPro and Founding Partner

Full detail for one client domain. Provide domain_id or domain hostname.

  • domain_id — string
  • domain — string
get_findingsreadPro and Founding Partner

All checks for a scan (latest by default), with filters.

  • domain_id — string
  • prospect_id — string
  • scan_id — string
  • status — array
  • min_severity — integer
  • category — array
get_grade_historyreadPro and Founding Partner

Score and grade time series for a client domain.

  • domain_id (required) — string
  • days — integer
compare_scansreadPro and Founding Partner

What changed between two scans. Defaults to latest vs previous.

  • domain_id (required) — string
  • from_scan_id — string
  • to_scan_id — string
get_insurance_answersreadPro and Founding Partner

Insurance-readiness answers with provenance. Never returns the client-link token.

  • domain_id (required) — string
  • include_history — boolean
  • category — array
list_prospectsreadPro and Founding Partner

List prospects in the pipeline.

  • status — array
  • query — string
  • include_converted — boolean
  • sort — string
  • limit — integer
  • cursor — string
get_prospectreadPro and Founding Partner

Prospect detail, scans, snapshots, and quotes.

  • prospect_id — string
  • domain — string
pipeline_summaryreadPro and Founding Partner

Aggregate of prospects plus quotes for a period.

  • days — integer
list_quotesreadPro and Founding Partner

List Fix-it quotes. Public URL is only present when the quote is published.

  • status — array
  • domain_id — string
  • prospect_id — string
  • viewed — boolean
  • expiring_within_days — integer
  • limit — integer
  • cursor — string
get_quotereadPro and Founding Partner

Quote detail including lines and tiers. Does not return IP, user agent, or PDF path.

  • quote_id (required) — string
list_alertsreadPro and Founding Partner

Change alerts. Read-only: does not mark alerts read.

  • since_days — integer
  • unread_only — boolean
  • domain_id — string
  • limit — integer
  • cursor — string
list_reportsreadPro and Founding Partner

Reports and share links for a domain, plus prospect Security Briefs.

  • domain_id — string
  • prospect_id — string
  • shared_only — boolean
find_grade_dropsreadPro and Founding Partner

Which client domains got worse in the last N days.

  • days — integer
  • min_score_drop — integer
  • grade_only — boolean
find_stalled_followupsreadPro and Founding Partner

Who viewed a quote, report, or Security Brief but did not accept.

  • kind — string
  • viewed_at_least_days_ago — integer
  • max_age_days — integer
explain_checkreadPro and Founding Partner

Static reference text for one scanner check. No tenant data.

  • check_id (required) — string
get_scan_statusreadPro and Founding Partner

Poll a scan job started with start_scan.

  • job_id (required) — string
start_scanactPro and Founding Partner

Queue a rescan of a client domain or prospect. Does not send email. Dedupes work from the last 15 minutes.

  • domain_id — string
  • prospect_id — string
add_prospectactPro and Founding Partner

Add a prospect. If scan_now, queues a scan. AI-created snapshots start unshared until a human enables them in the app.

  • company_name (required) — string
  • domain (required) — string
  • contact_name — string
  • scan_now — boolean
create_quote_draftactPro only

Create a draft Fix-it quote. Never publishes or sends. A human reviews, edits, and publishes in the app. Pro-only.

  • domain_id — string
  • prospect_id — string
  • scan_id — string
enable_share_linkactPro and Founding Partner

Create a share-link record for a client report or prospect Security Brief. The link stays disabled until a human enables it in Client Posture. This tool never makes a URL publicly accessible. Quotes are out of scope.

  • domain_id — string
  • scan_id — string
  • prospect_id — string

Prompts

qbr_summary

Quarterly business review brief for one client: grade trend, wins, top risks, insurance, open proposals.

morning_risk_digest

Overnight digest: what changed, who got worse, stalled proposals, expiring quotes.

prospect_followup_list

Call/email list of prospects who viewed but did not move, with a talking point.

explain_finding_for_client

Plain-English explanation of one scanner check for a client conversation.

Security model

  • Per-user keys, hashed with HMAC. Shown once, then masked.
  • Read vs act. Act tools never send email, publish, accept, or delete.
  • Share links created via MCP start disabled until a human enables them in the app. Available on Pro and Founding Partner.
  • Org isolation: every query is scoped to the key's organization.
  • Every tools/call is written to an audit log (180 days).
  • Prompt injection: scan-derived and client-typed strings are sanitized and labeled untrusted_data. They are data, not instructions.
  • Which data your AI vendor receives: whatever your assistant fetches is sent to that AI provider under your agreement with them. Client Posture hosts no model.

Limits and errors

  • 60 calls/min per key
  • 120 calls/min per org
  • 2,000 calls/day per org (midnight ET)
  • 100 act calls/day per org
  • 401 invalid/expired/revoked key · 403 plan or MCP disabled · 429 rate or daily cap

FAQ

Cursor keeps opening OAuth

If a server advertises OAuth discovery, Cursor may ignore your Authorization header. This endpoint 404s OAuth discovery on purpose. Use the key snippet as written.

VS Code dropped my headers

Use mcp.json, not the older .mcp.json plugins format. VS Code stores the key from the promptString input.

401 vs 403

401 means the key is missing, malformed, revoked, expired, or the member left the org. 403 means the org plan does not include MCP, or an admin turned it off.

Rotating keys

Revoke and create a new one. Rotating the server pepper invalidates every key.

Changelog

v1 — API keys on /api/mcp. OAuth on /mcp is deferred.

MCP server · Client Posture