> For the complete documentation index, see [llms.txt](https://docs.devarmor.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devarmor.com/getting-started/mcp-access.md).

# MCP Access

Connect Claude, ChatGPT, and other MCP clients to DevArmor.

## Overview

DevArmor runs a remote MCP (Model Context Protocol) server, so AI assistants — Claude Desktop, Claude Code, ChatGPT, and other MCP-compatible clients — can call DevArmor's threat-modeling and security-review tools directly instead of going through the REST API by hand.

* **Endpoint:** `https://secrev.mcp.devarmor.com/mcp`
* **Transport:** Streamable HTTP

## Authentication

The MCP server uses the same bearer token as the [API](/getting-started/api-access.md). If you don't have one yet, create it from **Settings → API Tokens** in the DevArmor web app.

Send it as a header when connecting a client:

```
Authorization: Bearer <your-api-token>
```

## Connecting a client

In each example below, replace `<API_KEY>` with your DevArmor API token.

### Claude Desktop

Claude Desktop only launches local clients and can't connect to a remote MCP server directly. Connect through the `mcp-remote` proxy, which ships as an `npx` package (requires Node.js).

Edit your Claude Desktop configuration file:

* macOS: `~/Library/Application Support/Claude/claude_desktop_config.json`
* Windows: `%APPDATA%\Claude\claude_desktop_config.json`

Add the server:

```json
{
  "mcpServers": {
    "DevArmor": {
      "command": ".../npx",
      "args": [
        "-y",
        "mcp-remote@latest",
        "https://secrev.mcp.devarmor.com/mcp",
        "--header",
        "Authorization:Bearer <API_KEY>"
      ]
    }
  }
}
```

> **Note:** `command` needs the full path to `npx` (find it with `which npx`) — Claude Desktop launches with a minimal `PATH` and often can't resolve a bare `npx`. Also note there's no space between `Authorization:` and `Bearer` — a known `mcp-remote` quirk.

Fully quit and restart Claude Desktop. DevArmor then appears under **+ → Connectors**, with its tools available to both chat and code mode.

### Claude Code CLI

```shell
claude mcp add --transport http --scope user "DevArmor" \
  https://secrev.mcp.devarmor.com/mcp --header "Authorization: Bearer <API_KEY>"
```

Prefix the command with a space ( `claude` instead of `claude`) so your shell doesn't save the API key to its history file.

`--scope user` makes the server available in every project; drop it, or use `--scope project`, to scope it to one project instead.

Verify with:

```shell
claude mcp list
```

### ChatGPT Desktop

Go to **Settings → Plugins → Add → Add MCP server** and fill in:

* **Name:** DevArmor
* **Type:** Streamable HTTP
* **URL:** `https://secrev.mcp.devarmor.com/mcp`
* **Header:** `Authorization` / `Bearer <API_KEY>`

Fully quit and restart the ChatGPT desktop app. This also makes the server available in the Codex CLI. There's currently no way to use it from ChatGPT's web/chat mode.

## Next steps

Once connected, ask your assistant to list its available tools to confirm the connection, then see the [API reference](/getting-started/api-access.md) for what each tool maps to under the hood.