# MCP Server

> Run Copyleaks scans, read results, and manage scan profiles from any MCP-capable AI client.

The Copyleaks MCP server is a remote **Streamable HTTP** endpoint guarded by OAuth 2.1. There is nothing to install, no local process, and no API key to paste.

<Note>
  **Requires a Copyleaks account that can run a scan in the app on a paid balance** - subscription, prepaid, or an organization-paid account. Free and lapsed accounts cannot connect, and a Copyleaks API key on its own is not a way in.
</Note>

## The endpoint

| | |
|---|---|
| **Server name** | `copyleaks_app` |
| **Endpoint** | `https://extensions.copyleaks.com/mcp` |
| **Transport** | Streamable HTTP (MCP 2025-06-18). Not SSE, not stdio |
| **Authorization** | OAuth 2.1 with PKCE (S256), advertised per RFC 9728 |

The endpoint names its own authorization server, so there is nothing to configure by hand.

## Where to go next

<CardGroup cols={2}>
  <Card title="Quickstart" icon="rocket" href="/mcp/quickstart">
    Connect an agent, run a scan, and read your first result in six steps.
  </Card>
  <Card title="Client setup" icon="plug" href="/mcp/client-setup">
    Exact config for Claude Code, the Claude chat apps, Gemini CLI, Antigravity, Codex CLI, Cursor and VS Code.
  </Card>
  <Card title="Tools" icon="wrench" href="/mcp/tools">
    The twelve tools an agent can call, and the parameters each one takes.
  </Card>
  <Card title="Limits and access" icon="gauge" href="/mcp/limits">
    Credits, throughput, who can connect, and how to disconnect.
  </Card>
</CardGroup>