SETUP GUIDE

AntOps MCP

Use the published bounded stdio MCP server from a local MCP client with a workspace API key.

Before you start

  • A workspace API key
  • Node.js and npm
  • A local MCP client configuration that can read environment variables

Setup

  1. Install the current package with npm install @antops/[email protected].
  2. Create an MCP server entry that runs antops-mcp.
  3. Provide ANTOPS_API_KEY from your environment or secret manager, never from committed config.
  4. Start the client and call a bounded status or lookup tool to verify access.
{
  "mcpServers": {
    "antops": {
      "command": "antops-mcp",
      "env": { "ANTOPS_API_KEY": "load-from-your-secret-manager" }
    }
  }
}

Verify and expected result

The server exposes bounded company, domain, tender, event, Change Risk and private-document status tools. Controlled actions are deterministic Change Risk analysis and a safe domain check.

MCP uses the workspace key's existing scope. It has no workspace-admin access, billing mutation, API-key creation or revocation, production-monitor deletion, private-secret retrieval or arbitrary prompt-driven actions.

Common safe checks

Server cannot authenticate

Confirm ANTOPS_API_KEY is available to the MCP process. Do not put it in a committed client configuration file.

A tool is unavailable

Check the key scope and the relevant existing workspace asset. Retrying will not broaden access.

Security and revocation

MCP does not create or revoke keys. Change Risk remains deterministic; AntOps does not retrieve private secrets through MCP.

Revoke the workspace API key in AntOps. This stops MCP access without changing other workspace settings.

Open API documentation