CentralCSP MCP server
Give an AI client read and limited write access to CentralCSP over the Model Context Protocol, signed in as you, with your own roles and plan.
Last update:
The CentralCSP MCP server exposes your workspaces, websites, browser reports, PCI DSS script inventory, Technologies inventory, and alerting to an AI client as Model Context Protocol tools.
It is a thin layer over the same REST API you would call yourself. Every tool call is forwarded upstream carrying your own access token, so your roles, your plan, your quotas, and your audit entries apply exactly as they would on a direct API call.
| Server URL | https://mcp.centralcsp.com |
| Server name | centralcsp |
| Transport | Streamable HTTP, stateless |
| Authentication | OAuth 2.0 with PKCE, no client secret |
| Tools | 49 |
Requires a plan that includes AI tools. See Billing.
What it is good at
The server is built for investigation. An agent can list your websites, pull the ranked breakdown of what browsers are blocking, drill into individual reports, and read your script inventory, without you translating any of it into API calls.
Typical questions it answers well:
- What is being blocked on this site, and which directive fires most?
- Which scripts on our payment pages still have no justification?
- Did any new script origin appear this week?
- Are our alert channels actually delivering?
What it can change
Most tools read. 23 of the 49 read only, and the rest are annotated so your client knows to confirm before calling them.
| Kind | Count | Behaviour |
|---|---|---|
| Read | 23 | Changes nothing |
| Create | 7 | Adds something. Calling twice adds twice |
| Update | 16 | Changes something in place |
| Action | 3 | Has an effect elsewhere, such as sending a test alert |
Nothing deletes. There is no tool that removes a website, a member, a rule, or a report, and none is annotated as destructive because none is.
The three action tools are worth knowing by name: test_alert_channel sends a real notification that real people see, reconcile_script_inventory queues a rebuild of the inventory, and start_security_scan runs a rate-limited scan against a live domain.
What it cannot do at all
Some things have no tool, by design rather than omission:
- Deleting anything
- Inviting, removing, or changing a member's role
- Changing website access grants
- Changing security settings or creating API keys
- Reading or changing billing
An agent asking to do one of these has no way to, regardless of your permissions.
Next steps
- Quickstart, the short path from nothing to reports arriving
- Connect a client
- Permissions and safety