MCP server
Milgram runs a Model Context Protocol server, so the AI agent you already use (Claude Code, Codex, Cursor, opencode, Gemini CLI, Kimi Code CLI, or your own) can work with your Milgram data: look through sessions and findings, review detections, write an incident report, tune your policies. The agent acts as you, with your permissions, never more.
| Endpoint | https://api.milgram.dev/v1/mcp |
| Transport | Streamable HTTP |
| Authentication | OAuth 2.1 with PKCE, dynamic client registration |
Signing in
Section titled “Signing in”MCP does not use an API key. When you connect a client, it opens your browser on Milgram’s sign-in, and you approve what the agent may do. The client then holds an access token of its own, which you can revoke at any time from the MCP page of the console.
- Add the server to your client (per-client setup).
- Start the sign-in from the client. Your browser opens the console.
- Sign in and review the scopes. The screen lists those the agent asked for and the others your role allows, ticked except imports and member administration: tick or untick them, and approve.
- The agent’s tools appear in the client.
Scopes
Section titled “Scopes”The consent screen lists what the agent may do. mcp:base is always required; everything else is your
choice, and you are only offered what your own role allows.
| Scope | Allows the agent to |
|---|---|
mcp:base |
Establish an MCP session (required) |
scan |
Submit text to be scanned |
samples:write |
Annotate, rescan or delete your samples |
detections:write |
Annotate, correct or delete your detections |
detections:review:org |
Correct and annotate any member’s detections in the organization (admins) |
sessions:write |
Delete your sessions and their samples |
projects:write |
Rename or delete your projects |
rules:list, rules:read |
Browse your rules library and read individual rules |
rules:write |
Create, edit or remove rules |
whitelists:read, whitelists:write |
Read, or create, edit and remove whitelists |
policies:read, policies:write |
Read, or create, edit and remove policies |
org:read |
Read every member’s data in your organization |
imports:write |
Import Claude Code, Codex and opencode session files |
The consent screen can also offer members:invite and members:manage; no MCP tool uses them.
Reading samples, detections, sessions and statistics needs nothing beyond mcp:base. Rules, whitelists and
policies have read scopes of their own, and changing anything needs the matching write scope. See
Tools for what each scope unlocks.
What the agent cannot do
Section titled “What the agent cannot do”The MCP server never exposes credentials or account administration: API keys, scanner keys, stored provider keys, sign-in and organization settings stay in the console. The proxy is not reachable through MCP either.