> ## Documentation Index
> Fetch the complete documentation index at: https://docs.asymptotelabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect an MCP client

> Let Claude Code, Cursor, and other MCP clients search your organization's Beacon telemetry and security findings, read-only.

## Overview

Asymptote runs a hosted, read-only [Model Context Protocol](https://modelcontextprotocol.io) server. Connect an agent to it to investigate with Beacon data: grep prompts, agent responses, commands and tool output across your organization's sessions, read a session around a match, and review security findings and the evidence they cite.

* **URL:** `https://asymptotelabs.ai/api/mcp` (Streamable HTTP)
* **Authentication:** an Asymptote API key with the `mcp:read` scope, sent as `Authorization: Bearer <key>`
* **Access:** read-only. Nothing the server exposes can change telemetry, findings, or their review status.

Members see what the dashboard shows them. Organization owners and admins can search everyone's telemetry. Other members see only their own. Every member can read the organization's findings.

## Create an API key

1. Log in to the Asymptote dashboard and open **API Keys**.
2. Click **Create key**.
3. Name the key, select the **mcp:read** scope, and choose an expiration.
4. Copy the key. It is shown once.

The key acts as you, in the organization you were viewing when you created it. It works only with the MCP endpoint: the rest of the Asymptote API refuses it, so the key can't do more than these read-only tools allow. It stops working when it expires, when you revoke it, or when you leave the organization.

## Add the server to your client

**Claude Code**

```bash theme={null}
claude mcp add --transport http asymptote https://asymptotelabs.ai/api/mcp \
  --header "Authorization: Bearer $ASYMPTOTE_API_KEY"
```

**Cursor**

Add to `~/.cursor/mcp.json`:

```json theme={null}
{
  "mcpServers": {
    "asymptote": {
      "url": "https://asymptotelabs.ai/api/mcp",
      "headers": { "Authorization": "Bearer ${env:ASYMPTOTE_API_KEY}" }
    }
  }
}
```

**Codex CLI**

Add to `~/.codex/config.toml`:

```toml theme={null}
[mcp_servers.asymptote]
url = "https://asymptotelabs.ai/api/mcp"
bearer_token_env_var = "ASYMPTOTE_API_KEY"
```

Keep the key in an environment variable or your client's secret store rather than in a file you commit.

## Tools

| Tool | What it does |
| - | - |
| `asymptote_grep` | Search event content with an RE2 regular expression or plain text: prompts, agent responses and reasoning, commands, tool calls and raw tool payloads (output, diffs), file paths, MCP calls, approvals and policy decisions. It returns the session and event IDs of each match. |
| `asymptote_search_sessions` | List sessions by user, agent, repository, model, and time. |
| `asymptote_read_session` | Read a session's events in order, centered on a grep match with `aroundEventId`. |
| `asymptote_get_event` | One event's complete record. |
| `asymptote_lookup` | The users, agents, repositories, models, devices, and event actions present in the data. |
| `asymptote_findings_list` | Security findings, by default open findings nobody has reviewed. |
| `asymptote_grep_findings` | Search findings' titles, summaries, metadata, raw payloads, and evidence. |
| `asymptote_get_finding` | One finding in full, with its evidence timeline, the sessions and events it cites, and its review history. |

Searches cover a bounded time window: by default the last 7 days for `asymptote_grep` and longer for the other tools. Ask for a wider one with `since` (for example `90d`), or with `after` and `before`. Patterns use RE2 syntax, which has no backreferences or lookaround. Set `literal` to search for text exactly as written.

## Example prompts

* "Search our Beacon telemetry from the last 30 days for `sk_live_` and tell me which sessions printed a Stripe key."
* "Which open high-severity findings are there? For the newest one, read the session around its evidence and tell me whether it's a real problem."
* "Find sessions where an agent ran `terraform apply` in the payments repository."

## Security

* The server is read-only and every tool call is recorded in an audit log, with the key and the arguments.
* Session content and finding text are treated as data. The server instructs clients never to follow directions found inside them.
* Revoking the key in **API Keys** cuts off access within 30 seconds.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.