Connecting Your AI Client ​

InfraScout exposes a Model Context Protocol (MCP) endpoint that any compliant client can add as a regular remote MCP server. Point your client at the endpoint URL, sign in with your work account, and InfraScout's full tool set becomes available for driving infrastructure assessments. There is no config file to hand-edit and no API key to copy — the client discovers everything it needs from the endpoint and authenticates you through your browser.

New to the protocol? Understanding MCP covers what it is, what a server exposes through it, and why the tool list you receive depends on who you are.

The endpoint is:

text
https://mcp-dev.infrascout.cloud/mcp

What You Need ​

Before connecting, make sure you have an MCP-compatible client (Claude Code, Claude Desktop, or another client that supports remote MCP servers with OAuth), a work account in a tenant that has been onboarded to InfraScout, and an MCP-client role assigned to that account. A single role grants MCP access — see Roles and Access below.

How Sign-In Works ​

InfraScout authenticates clients with OAuth 2.0 through Microsoft Entra ID. When you add the endpoint, your client discovers InfraScout's OAuth settings automatically, registers itself, and opens your browser so you can sign in with your work account. After you consent, the client receives a short-lived token and refreshes it silently as needed — you stay signed in without re-entering credentials.

Because sign-in is delegated to Entra ID, InfraScout always acts as you: every tool your AI client invokes runs under your identity and your assigned roles. You do not create, store, or paste any API key.

Connecting Claude Code ​

Add InfraScout as a remote MCP server from your terminal:

bash
claude mcp add --transport http infrascout https://mcp-dev.infrascout.cloud/mcp

The first time you use it, run /mcp inside Claude Code and choose to authenticate. Your browser opens for Entra ID sign-in; once you finish, the InfraScout tools are ready to use.

Connecting Claude Desktop ​

Open Claude Desktop and go to Settings → Connectors → Add custom connector. Give the connector a name such as InfraScout and paste the endpoint URL:

text
https://mcp-dev.infrascout.cloud/mcp

Save the connector and follow the sign-in prompt. Claude Desktop opens your browser for Entra ID authentication, and InfraScout appears in the client's tool panel with its full set of tools available.

Other MCP Clients ​

Any client that supports remote MCP servers with OAuth can connect using the same endpoint URL. Register https://mcp-dev.infrascout.cloud/mcp as a custom MCP server and complete the browser sign-in when prompted — the client handles OAuth discovery and registration on its own. Consult your client's documentation for where to add a remote MCP server.

Verify the Connection ​

Once your client is connected and you've signed in, ask in a new conversation:

"Use the auth_whoami tool to show me my InfraScout identity."

InfraScout responds with your assigned role and token health, including when your session expires. Run auth_whoami whenever you need to confirm that authentication is working and your token is still valid.

Entra ID sign-in and MCP access are separate gates, so sign-in can succeed while InfraScout still refuses the connection. InfraScout refuses an authenticated connection for one of three reasons:

  • Your organization has not been onboarded to InfraScout.
  • Your organization's access has been suspended.
  • Your account does not hold an MCP-client role.

In each case, contact your InfraScout administrator to onboard the organization, restore access, or assign the right role.

Roles and Access ​

Your Entra ID app roles determine what your AI client can do on your behalf. InfraScout defines five roles:

  • Users — read-only access to the dashboard, agents, and Insights
  • MCPUser — read-only access plus permission to connect an MCP client
  • Operator — everything in Users, plus running sessions, executing playbooks, and updating Insights
  • MCPOperator — everything in Operator plus permission to connect an MCP client
  • Admin — everything above, plus user management, connectors, and policies

To connect an MCP client, your account needs a single MCP-client role: MCPUser, MCPOperator, or Admin. MCPOperator already includes everything Operator can do, so you do not need to hold Operator separately. The plain Users and Operator roles grant dashboard and REST access but not MCP access, so an account with only those roles can sign in to Entra ID yet still be refused at the MCP endpoint. Roles are assigned in Entra ID by your organization's InfraScout administrator during tenant onboarding; the auth_whoami tool shows your current role so you can confirm what level of access your AI client is operating with.

Targeting Multiple Tenants ​

If your organization manages partner or customer tenants through GDAP, you choose which tenant a cloud tool queries on each individual call rather than once at the start of a session. Omit the connection_id argument and the mscloud_* tools resolve your default tenant; pass a specific connection_id to target a partner or customer tenant for that one request. Ask your client to list the configured connections when you need the right identifier before running a cross-tenant query.

Next Steps ​

With the connection established, follow the Quick Start guide to run your first assessment, or jump directly to Running Assessments for a deeper walkthrough.