MCP server

MCP server overview

Connect your own AI assistant to Arachne over the Model Context Protocol: advisory data, repository scans and metered fix actions, with your model doing the reasoning.

What the Arachne MCP server is#

The Model Context Protocol (MCP) is an open standard that lets an AI application call tools on external servers. Arachne runs an MCP server, so the assistant you already use (Claude Code, Claude Desktop, Cursor, VS Code, or anything that speaks MCP) can ask Arachne questions and take a small number of well-guarded actions on your behalf.

Every request needs Authorization: Bearer <token>; there is no anonymous access. The usual token is a personal access token that starts with arpat_. See Authentication.

Bring your own LLM#

Arachne does not put a model in the loop of your conversation. Your client's model does the reasoning: it reads your question, decides which tools to call, interprets the JSON that comes back, and explains it to you. Arachne supplies data and actions: the advisory database, scans of your connected repositories, deterministic version proposals, and the metered fix and PR actions with all their checks.

• You choose the model, and its costs and data terms are between you and your model provider.
• Arachne's answers are deterministic data (advisory records, findings, gate results), never generated prose, so they are the same whichever model asks.
• Actions that cost a use or touch GitHub (fix_submit, pr_open) go through exactly the same checks as the web app, and a PR still needs a person's approval in the web app.

flowchart TB
  subgraph YOURS["Your machine or AI app"]
    ME["You"] <--> LLM["Your model"]
    LLM <--> CL["MCP client: Claude Code, Cursor, VS Code ..."]
  end
  CL -- "JSON-RPC over HTTPS, Bearer arpat_..." --> S
  S -- "JSON results" --> CL
  subgraph ARACHNE["Arachne"]
    S["MCP server /mcp"] --> CHK["token, rate limits, scope + role, argument checks"]
    CHK --> T1["read tools: advisories, repos_affected, propose_version, job_status"]
    CHK --> T2["metered tools: fix_submit, pr_open"]
    T1 --> D[("advisory DB and your projects")]
    T2 --> Q["fix job queue; PR only after approval"]
  end

The model never talks to Arachne directly; the client sends tool calls on its behalf with your token.

What you can do with it#

Protocol support#

The server implements the parts of MCP a tools server needs:

Tool results are JSON documents in result.content[0].text. Tool-level failures (not found, quota, rate limit) come back as a normal result with isError: true so your model can read and explain them; see Errors.