Integration

Connect LLM agents to CipherCue

CipherCue exposes an MCP (Model Context Protocol) server so Claude Desktop, Claude Code, Mistral Le Chat, and any other MCP-aware agent can query observed cybersecurity infrastructure directly from your prompts.

For Paid and Enterprise workspace owners connecting CipherCue to their team's AI workflows.

What is MCP?

MCP (Model Context Protocol) is Anthropic's open standard for letting LLM agents discover and call external tools over a uniform interface. With CipherCue's MCP server connected, you can ask Claude questions like "find German companies running Fortinet VPNs" or "give me the dossier for ciphercue.com" and the agent will call the right tool and synthesise an answer over the structured response.

CipherCue's MCP server is hosted at https://ciphercue.com/mcp. It speaks the Streamable HTTP transport, so no local install or npm package is needed: paste the URL plus your CipherCue API token into your agent's MCP configuration.

Paid and Enterprise only. The MCP server requires a Paid or Enterprise subscription. Free workspaces can read these docs, but cannot generate API tokens or use the /mcp endpoint until they upgrade. See pricing.

Generate an API token

MCP reuses the same workspace API tokens as the REST API. Owners and admins can issue tokens from Settings › API tokens.

Open Settings › API tokens.
Choose Create token. Give it a descriptive name (e.g. claude-desktop-chris).
Tick the abilities your tools need (most workflows want all four):
- read:entities — required for search_entities, get_entity, match_domains, tech_vendor_search
- read:facts — required for get_entity_facts, get_entity_changes, tech_vendor_search
- read:signals — required for list_signals
- read:accounts — required for list_accounts
Copy the token shown on the next screen. The full token is only visible once. Store it in your password manager.

The CipherCue settings page showing the API tokens screen with the Create token form expanded and the four ability checkboxes ticked. — Create a token with the abilities your MCP tools need. Most workflows want all four.

The CipherCue settings page after token creation, showing the full token string with a copy button. The token value is partially redacted as cc_pat_dots. — Copy the token immediately — it is only shown once.

Claude Desktop setup

Claude Desktop's config file supports only stdio MCP servers. The HTTP transport CipherCue uses is reached via a small open-source shim called mcp-remote, which runs locally and forwards your requests over HTTPS (including your bearer token). You need Node.js installed.

Open the Claude Desktop config file. The path depends on your operating system:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
Linux: ~/.config/Claude/claude_desktop_config.json

Add (or extend) the mcpServers object:

{
  "mcpServers": {
    "ciphercue": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://ciphercue.com/mcp",
        "--header",
        "Authorization:Bearer cc_pat_your_token_here"
      ]
    }
  }
}

Fully quit Claude Desktop (Cmd+Q on macOS — not just close the window) and reopen it. On first launch, npx will download mcp-remote from npm (10–20 seconds).

To confirm CipherCue is connected, open a new conversation, click the + button below the message box, choose Connectors, and click ciphercue. The Tool permissions panel shows all eight tools, each with allow / ask / deny controls.

The claude_desktop_config.json file open in an editor with the CipherCue mcp-remote block highlighted. — Add the CipherCue block under `mcpServers`. Replace the placeholder token with the one you generated.

Claude Desktop's Connectors detail view for CipherCue, showing all eight tools (get_entity_changes, search_entities, list_accounts, tech_vendor_search, get_entity, get_entity_facts, match_domains, list_signals) with per-tool allow / ask / deny permission controls. — All eight CipherCue tools appear under Tool permissions, each with per-tool allow / ask / deny controls.

Why not the "Add custom connector" GUI?

Claude Desktop's in-app Add custom connector dialog only accepts MCP servers that implement the full OAuth 2.1 authorisation flow with dynamic client registration. CipherCue uses workspace API tokens (bearer auth), which is simpler to issue and revoke per integration but not what the GUI dialog expects. The mcp-remote shim is the official path for bearer-auth servers and works identically once connected.

Claude Code setup

From a terminal, register the MCP server with the claude CLI:

claude mcp add ciphercue \
  --transport http \
  --url https://ciphercue.com/mcp \
  --header "Authorization: Bearer cc_pat_your_token_here"

List configured servers to confirm:

claude mcp list

Mistral Le Chat setup

Mistral's Le Chat treats CipherCue as a Custom MCP Connector. Because Mistral hosts inference exclusively in the EU and conversations on Pro and Enterprise tiers are never used for model training, this is the recommended path for sovereign EU workflows where prospect data must not leave Europe.

EU-resident inference. Le Chat runs on Mistral's European infrastructure, so the prompt, tool call, and response all stay inside the EU when you connect to CipherCue from Le Chat. CipherCue's MCP server is hosted in the EU as well.

Sign in to chat.mistral.ai. Custom MCP Connectors are available on all plans; Knowledge Connectors require Team or Enterprise.
Open Settings › Connectors (or use the + button in a conversation and choose Connectors).
Choose Add Custom Connector.
Fill in the connector form:
- Name: CipherCue
- Server URL: https://ciphercue.com/mcp
- Authorization header: Bearer cc_pat_your_token_here
Save. Le Chat verifies the server, lists the eight CipherCue tools, and asks you to confirm which the connector may call.

To use CipherCue in a conversation, toggle the CipherCue connector on from the connector picker beside the message box. Ask a natural-language question — Le Chat selects the right tool, calls it over HTTPS, and renders the structured response inline.

Recommended models

Mistral Large 3 and Mistral Medium 3 both handle the CipherCue tool schemas well. For high-volume agent workflows where latency matters more than reasoning depth, Mistral Small 3.2 is also a good fit.

Studio and the Mistral Agents API

If you are building a hosted agent on Mistral's Agents API (rather than chatting through Le Chat), register CipherCue as a managed Connector in Mistral Studio with the same server URL and bearer token. Once registered, any agent in your Studio workspace can invoke CipherCue's tools as part of its workflow.

See it in action

A live demo in Claude Desktop. The user asks a natural-language question about a single company; Claude calls get_entity against CipherCue's MCP server and returns the observed evidence — vendor, host, confidence, observation timestamp, primary source — with no fabrication.

One prompt, one tool call, a sourced observation ready for outreach.

Available tools

Eight tools are exposed. Use natural-language prompts and the agent will pick the right one.

Tool	What it does	Parameters	Ability
`search_entities`	Filter the entity directory by country, region, type, public index, or signal count.	`query`, `country`, `region`, `type`, `index`, `min_signals`, `limit`	`read:entities`
`get_entity`	Full dossier for one entity: tech stack, DNS, CISA KEV matches, certificate transparency.	`id` or `domain`	`read:entities`
`get_entity_facts`	Raw observed facts (tech_fingerprint, dns_compliance, etc.) for one entity.	`entity_id`, `type`, `since`, `limit`	`read:facts`
`get_entity_changes`	Temporal change events for one entity: what was added, removed, or updated and when.	`entity_id`, `since`, `limit`	`read:facts`
`list_signals`	Signals matched to your tracked accounts.	`since`, `status`, `severity`, `limit`	`read:signals`
`list_accounts`	Accounts you are tracking.	`limit`	`read:accounts`
`match_domains`	Bulk-match up to 50 domains to CipherCue entities.	`domains` (array)	`read:entities`
`tech_vendor_search`	Find entities observed running a given VPN, IAM, email-security, SIEM, or endpoint vendor.	`category`, `vendor`, `country`, `region`, `limit`	`read:entities` + `read:facts`

Sample prompts

"Search CipherCue for German companies running Fortinet VPNs."
"Give me the full dossier for ciphercue.com."
"What changed for entity {uuid} in the last 14 days?"
"Match this list of domains to CipherCue entities: acme.com, contoso.eu, example.fr."
"List all critical signals from the past week."

Quota and rate limits

MCP calls count against the same monthly API quota as the REST API:

Free: API tokens unavailable.
Paid: 1,000 calls / month.
Enterprise: 100,000 calls / month.

Each MCP tool call counts as one API call, with one exception: match_domains charges one call per domain in the batch (a 50-domain batch consumes 50 calls). Burst limit is 60 requests per minute per token.

Every response includes X-Quota-Limit, X-Quota-Remaining, and X-Quota-Reset headers so you can see your current usage.

Troubleshooting

403 tier_required

Your workspace is on the Free tier. MCP requires Paid or Enterprise. Upgrade in settings.

401 Unauthenticated

The bearer token is missing, malformed, or revoked. Generate a fresh token from Settings › API tokens.

Tools don't appear in the picker

The token is missing the abilities the tool requires. The MCP server still connects (so the agent shows it as available), but individual tool calls fail. Regenerate the token with all four abilities ticked.

429 monthly_quota_exceeded

You've hit the monthly call cap. Quota resets at the start of next month UTC. Enterprise quota uplifts are available — contact us.

Tool call returns "opt_out"

That specific entity has opted out of public observation via DNS TXT or email to abuse@ciphercue.com. The entity is filtered from MCP responses to honour the opt-out.

Claude Desktop's "Add custom connector" dialog rejects the URL

The in-app dialog requires OAuth 2.1 with dynamic client registration; CipherCue uses bearer tokens. Use the mcp-remote shim in the config file instead.

Claude Desktop shows "Some MCP servers could not be loaded"

You likely added a url + headers block to claude_desktop_config.json. That format is not supported there — Claude Desktop's config file only accepts stdio servers (command + args). Switch to the mcp-remote config shown above.

← Back to all docs · REST API reference