MCP server
Install & connect
Add the Arachne MCP server to Claude Code, Claude Desktop, Cursor, VS Code or any MCP client with a personal access token, then check it works with curl.
Every client needs the same two things: the server URL and an Authorization header carrying your token.
| Setting | Value |
|---|---|
| URL | https://arachne.withaadhi.com/mcp |
| Transport | Streamable HTTP (sometimes labelled "HTTP" or "remote") |
| Header | Authorization: Bearer arpat_… |
1. Create a token#
- Sign inOpen the app and stay on the Dashboard.
- Find "MCP access tokens"At the bottom of the dashboard. Type a label that names the client, for example Claude Code laptop.
- Create token and copy itClick Create token. The token (
arpat_followed by 43 characters) is shown once. Copy it now; Arachne keeps only a hash and cannot show it again.
Warning
The token acts as you. Keep it in an environment variable or your client's secret store, never in a file you commit.
The examples below read it from ARACHNE_TOKEN. Details in Authentication.
# macOS / Linux: put this in your shell profile or a secrets manager, not in a repo
export ARACHNE_TOKEN="arpat_REPLACE_WITH_YOUR_TOKEN"
2. Add the server to your client#
One command. The shell expands $ARACHNE_TOKEN when you run it, and Claude Code stores the header in its local
(per-project, private) configuration.
claude mcp add --transport http arachne https://arachne.withaadhi.com/mcp \
--header "Authorization: Bearer $ARACHNE_TOKEN"
To share the server with your team without sharing a token, check in a project .mcp.json that references an
environment variable; each person sets their own ARACHNE_TOKEN:
{
"mcpServers": {
"arachne": {
"type": "http",
"url": "https://arachne.withaadhi.com/mcp",
"headers": { "Authorization": "Bearer ${ARACHNE_TOKEN}" }
}
}
}
Check it with claude mcp list, or run /mcp inside a session: arachne should show as connected with 8 tools (fewer if your role is member or viewer).
Option A: custom connector with a request header. In Claude, go to Customize → Connectors →
Add → Add custom connector, enter the name Arachne and the URL https://arachne.withaadhi.com/mcp.
Under authentication choose No sign-in, open Request headers, pick authorization and
enter the value Bearer arpat_… (include the word Bearer and the space). Anthropic documents request-header
authentication as a beta that only some organisations have; if you do not see Request headers, use option B.
Option B: the mcp-remote bridge. mcp-remote is a community package (not made by Anthropic or
Arachne) that runs locally as a stdio server and forwards to a remote HTTP server with your header. It needs Node.js.
Open the config file from Settings → Developer → Edit Config, or directly:
- macOS:
~/Library/Application Support/Claude/claude_desktop_config.json - Windows:
%APPDATA%\Claude\claude_desktop_config.json
{
"mcpServers": {
"arachne": {
"command": "npx",
"args": [
"-y", "mcp-remote",
"https://arachne.withaadhi.com/mcp",
"--header", "Authorization:${ARACHNE_AUTH}"
],
"env": { "ARACHNE_AUTH": "Bearer arpat_REPLACE_WITH_YOUR_TOKEN" }
}
}
}
The header value goes through env with no space after the colon in args: that is the workaround the
mcp-remote README gives for Claude Desktop on Windows splitting arguments at spaces, and it works everywhere. Restart
Claude Desktop afterwards. This file holds the token in plain text, so keep it out of backups you share.
Add the server to ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (one project). Cursor
expands ${env:NAME} in url and headers, so the token stays in your environment:
{
"mcpServers": {
"arachne": {
"url": "https://arachne.withaadhi.com/mcp",
"headers": { "Authorization": "Bearer ${env:ARACHNE_TOKEN}" }
}
}
}
Start Cursor from a shell where ARACHNE_TOKEN is set, then check Settings → MCP: arachne should list its tools.
Create .vscode/mcp.json in your workspace (or run MCP: Open User Configuration for all
workspaces). An inputs entry with "password": true makes VS Code prompt for the token once and store it securely,
so the file itself is safe to commit:
{
"inputs": [
{
"type": "promptString",
"id": "arachne-token",
"description": "Arachne MCP token (arpat_...)",
"password": true
}
],
"servers": {
"arachne": {
"type": "http",
"url": "https://arachne.withaadhi.com/mcp",
"headers": { "Authorization": "Bearer ${input:arachne-token}" }
}
}
}
Start the server from the mcp.json editor (or MCP: List Servers), enter the token when asked, and the tools appear in Copilot Chat's agent mode tool picker.
Any MCP client that can send a custom header to a remote Streamable-HTTP server works. Configure:
{
"url": "https://arachne.withaadhi.com/mcp",
"headers": { "Authorization": "Bearer arpat_REPLACE_WITH_YOUR_TOKEN" }
}
If your client only speaks stdio, put the mcp-remote bridge from the Claude Desktop tab in front of it. To
call the server by hand, see the next section.
3. Verify it works#
These three calls are what every client does on connect. Run them with your token in ARACHNE_TOKEN.
MCP=https://arachne.withaadhi.com/mcp
AUTH="Authorization: Bearer $ARACHNE_TOKEN"
curl -s "$MCP" -H "$AUTH" -H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}'
Expected:
{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-06-18","capabilities":{"tools":{}},"serverInfo":{"name":"remediation-mcp","version":"1.1"}}}
curl -s "$MCP" -H "$AUTH" -H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'
Expected shape (abbreviated; an owner or admin sees all eight tools):
{"jsonrpc":"2.0","id":2,"result":{"tools":[
{"name":"advisories_latest","description":"Newest advisories in the local database, ...",
"inputSchema":{"type":"object","properties":{"since_cursor":{"type":"string"},"ecosystem":{"type":"string"},
"limit":{"type":"integer","minimum":1,"maximum":100}},"required":[],"additionalProperties":false},
"annotations":{"readOnlyHint":true,"destructiveHint":false}},
{"name":"advisories_search", ...}, {"name":"advisory_explain", ...}, {"name":"repos_affected", ...},
{"name":"propose_version", ...}, {"name":"job_status", ...}, {"name":"fix_submit", ...}, {"name":"pr_open", ...}]}}
And a real tool call, free and read-only:
curl -s "$MCP" -H "$AUTH" -H 'Content-Type: application/json' -d '{
"jsonrpc":"2.0","id":3,"method":"tools/call",
"params":{"name":"advisories_search","arguments":{"ecosystem":"PyPI","package":"requests","version":"2.30.0"}}}'
The answer is a JSON document inside result.content[0].text; with jq:
… | jq -r '.result.content[0].text' | jq .
If something is off
401 {"error":"invalid_token","detail":"missing bearer token"}: the header did not arrive (check quoting and the variable).401 … "invalid or revoked access token": wrong, truncated or revoked token.- The client connects but shows fewer than 8 tools: your role in the organisation does not allow the others (see roles).
More in Troubleshooting.
Clients that prefer OAuth#
Arachne also accepts OAuth access tokens from its Cognito user pool, through a pre-registered public client. Because Cognito does not offer dynamic client registration, "just sign in" auto-discovery does not complete in most clients; use a personal access token unless your client lets you supply a client id, a fixed callback port and scopes. The details are in Authentication → OAuth.