MCP Client Setup

The server exposes an MCP endpoint alongside the REST API on the same port. Any MCP-compatible client (Cursor, Continue, Claude, custom agents built on any LLM provider, …) can connect directly without needing the curl-loop agent prompt.

Endpoints

After the server starts, two MCP transports are available under /mcp:

Transport	URL	Protocol version
SSE	`http://localhost:8000/mcp/sse`	MCP 2024-11-05 (widely supported)
Streamable HTTP	`http://localhost:8000/mcp/`	MCP 2025-03-26 (newer clients)

Use SSE unless your client specifically requires Streamable HTTP.

Generic MCP client (JSON config)

Most MCP-capable tools accept a JSON server list. Add an entry pointing at the SSE endpoint:

{
  "mcpServers": {
    "terraform-analyzer": {
      "url": "http://localhost:8000/mcp/sse"
    }
  }
}

With API key auth enabled (a member key is sufficient for analysis — see Authentication):

{
  "mcpServers": {
    "terraform-analyzer": {
      "url": "http://localhost:8000/mcp/sse",
      "headers": {
        "X-API-Key": "your-key-here"
      }
    }
  }
}

Restart the client after editing.

CLI-based MCP clients

Many CLI tools expose an mcp add command:

# SSE transport (most compatible)
mcp add terraform-analyzer http://localhost:8000/mcp/sse

# With API key
mcp add terraform-analyzer http://localhost:8000/mcp/sse \
  --header "X-API-Key: your-key-here"

# List configured servers
mcp list

Refer to your specific client’s documentation for the exact flags.

Exposing MCP behind a reverse proxy

The mcp.base_url config field controls where FastMCP routes internal tool calls — for a server calling itself, loopback (http://localhost:8000) works and avoids an extra network hop. If you put a reverse proxy or ingress in front of the server for external clients, configure your MCP client with the proxy’s public URL:

{
  "mcpServers": {
    "opentremor": {
      "url": "https://your-host.example.com/mcp/sse"
    }
  }
}

Disabling the MCP endpoint

Set mcp.enabled: false in the config to run REST-only:

mcp:
  enabled: false

The fastmcp package must still be installed (it ships with the default image). The endpoint is simply not mounted.

Available MCP tools

FastMCP generates one tool per REST endpoint (FastMCP.from_fastapi(app)), so the tool surface mirrors the entire REST API — the client-led analysis loop, server-side /analyze, findings triage, org/quota management, and everything else in Endpoints. A representative subset:

Tool (generated name)	REST equivalent	Description
`get_rules`	`GET /{analyzer}/rules`	Fetch security ruleset
`ingest`	`POST /{analyzer}/{namespace}/ingest`	Parse and split a plan (client-led loop)
`get_next_resource`	`GET /{namespace}/resource/next`	Next unanalysed resource
`submit_analysis`	`PUT /resource/{hash}/analysis`	Store findings
`analyze`	`POST /{analyzer}/{namespace}/analyze`	One-call server-side analysis (see Server-Side Analysis)
`generate_report`	`GET /{namespace}/report`	Consolidated report
`get_resource`	`GET /resource/{hash}`	Fetch a single resource
`dump_namespace`	`GET /{namespace}/dump`	All resources in namespace
`list_analyzers`	`GET /analyzers`	Available analyzers
`list_findings`	`GET /findings`	Filter finding triage records
`update_finding_status`	`PATCH /findings/{hash}/{rule_id}`	Suppress/acknowledge a finding

The LLM uses these tools directly in a conversation — no system prompt or curl commands needed. Every call is still scoped by the caller’s X-API-Key/session exactly as the REST endpoint would be — MCP is a transport, not a separate auth model.